[
    {
        "id": "282cd7f6-86f9-4174-95c2-df26b2b6395e",
        "source": "android_sec_doc",
        "question": "You are tasked with designing a secure storage system for an Android device's hardware identifiers as part of an ID attestation implementation. Which of the following properties are essential for ensuring the system's integrity and security?",
        "choices": [
            "A: The storage must contain the original identifiers to enable the TEE to verify their authenticity during attestation.",
            "B: The storage should be tamper-evident to ensure any modification is detectable, rendering the attestation invalid.",
            "C: The `destroyAttestationIds()` method should be able to restore the identifier-derived data after a factory reset.",
            "D: RMA facilities must not have the ability to regenerate hardware identifier-derived data to prevent unauthorized attestation."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Tamper-evident"
    },
    {
        "id": "28355cb5-4b9a-44b8-8419-38fd17d335e4",
        "source": "owasp_mastg",
        "question": "An Android application developer is tasked with ensuring the security of sensitive user information. The developer has several options for data storage, each with different security implications. Which of the following storage options should the developer avoid to prevent exposing sensitive user data to other applications on the device?",
        "choices": [
            "A: Using SharedPreferences with MODE_PRIVATE to store user preferences and settings.",
            "B: Storing user credentials in an unencrypted SQLite database accessible to the app.",
            "C: Implementing SQLCipher to encrypt SQLite databases containing sensitive user information.",
            "D: Saving encrypted user data in the Android Keystore system."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "SQLite"
    },
    {
        "id": "27ea6d4b-b7f6-4370-8877-ba80887727ff",
        "source": "owasp_mastg",
        "question": "In a DevSecOps framework, why is it crucial to automate security activities as part of the Continuous Integration/Continuous Delivery (CI/CD) pipeline?",
        "choices": [
            "A: Because automated security activities can slow down the delivery process, ensuring that only high-priority features are shipped.",
            "B: Because the frequency of deliveries increases, necessitating the automation of security activities to maintain an appropriate level of security.",
            "C: Because automation allows for more manual security reviews, increasing the number of identified defects before production.",
            "D: Because automation of security activities is only necessary for high sensitivity apps, not for low or medium sensitivity apps."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DevSecOps"
    },
    {
        "id": "7a1db287-9f9b-4621-ba2c-9667a765bbab",
        "source": "cs161_textbook",
        "question": "In a wireless local network, if the network is not secured using WPA2-Enterprise, what is a likely consequence an on-path attacker may achieve?",
        "choices": [
            "A: The attacker could potentially learn the encryption keys from the handshake and decrypt messages.",
            "B: The attacker may be unable to access the network due to the presence of network firewalls.",
            "C: The attacker could exploit the network to gain unlimited internet access without being detected.",
            "D: The attacker might cause a denial of service by flooding the network with fake authentication requests."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "On-path Attack"
    },
    {
        "id": "a9c613bb-2b24-4a04-8bf5-fdabf6724322",
        "source": "owasp_wstg",
        "question": "As a web application security tester, you are evaluating a web application that uses server-side scripting. You suspect that the application might be vulnerable to code injection attacks. Which of the following steps would be most effective in identifying and assessing potential injection points for code execution vulnerabilities?",
        "choices": [
            "A: Inspecting the application's source code to identify places where input is directly included into dynamic queries or commands without proper sanitization.",
            "B: Checking for strong encryption on data transmission to prevent code from being injected into the application.",
            "C: Testing for SQL injection vulnerabilities since code injection is a subset of SQL injection.",
            "D: Looking for user input fields and ensuring they have maximum length restrictions as the sole security measure."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Code Injection"
    },
    {
        "id": "b4a451ca-16d2-4ab7-ba99-6bc146ea5b86",
        "source": "android_sec_doc",
        "question": "In an Android system, version binding has been implemented to enhance the security of keys used by applications. If an attacker were to discover a vulnerability in a previous version of the system, why is it still challenging for them to exploit this vulnerability using the keys created with a newer version?",
        "choices": [
            "A: Because the keys are bound to the operating system version and are invalidated if the device is rolled back to a vulnerable version.",
            "B: Because the keys automatically upgrade to stronger cryptographic algorithms whenever a new vulnerability is discovered.",
            "C: Because all keys are permanently deleted if a vulnerability is discovered, thus preventing any misuse.",
            "D: Because key attestation prevents the use of keys if any vulnerability is detected, irrespective of the system version."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Version Binding"
    },
    {
        "id": "f4274a51-8a0e-47a8-b472-115c3fe85924",
        "source": "cs161_textbook",
        "question": "In the HMAC-DRBG algorithm, when generating pseudorandom bits with additional true random input 's', which of the following statements accurately describe the process and rationale for updating the internal state and generating the output? Select all that apply.",
        "choices": [
            "A: The internal state 'K' and 'V' is updated after generating the pseudorandom bits to ensure that the next output cannot be predicted if the current state is compromised.",
            "B: True randomness 's' is added to the internal state to refresh 'K' and 'V', ensuring the unpredictability of subsequent pseudorandom outputs even if the initial state was known.",
            "C: The use of different constants (`0x00` and `0x01`) when updating 'K' with true randomness 's' is to maintain a clear distinction between seed and reseed operations.",
            "D: The internal state is never updated after the initial seeding process to maintain the highest level of performance in pseudorandom bit generation."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HMAC-DRBG"
    },
    {
        "id": "780100a0-98da-49fc-9acb-476ab4edf3a9",
        "source": "apple_platform_security",
        "question": "Consider a scenario where a Mac with Apple silicon is in use. How does enabling or disabling FileVault affect the encryption and security of the system's internal storage, and what is the role of Secure Enclave in this context?",
        "choices": [
            "A: When FileVault is off, the volume encryption key is only protected by the hardware UID, and enabling FileVault later will secure the volume with both the user's password and hardware UID.",
            "B: FileVault uses the Secure Enclave to perform all encryption and decryption operations, thus exposing encryption keys to the main CPU.",
            "C: Disabling FileVault immediately decrypts the contents of the internal storage and removes all encryption keys from the Secure Enclave.",
            "D: FileVault's encryption keys are stored outside the Secure Enclave for ease of access and are not involved in the boot process."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "FileVault"
    },
    {
        "id": "61dfb73d-1f20-4d58-b491-747e21cf66bb",
        "source": "attck",
        "question": "As a penetration tester, you are tasked with setting up a detection strategy for identifying adversarial shutdown/reboot activities as described in the ATT&CK framework. Which of the following methods would be effective for detection?",
        "choices": [
            "A: Monitoring network throughput for significant drops, which can indicate a system shutdown.",
            "B: Monitoring executed commands and arguments of binaries involved in shutting down or rebooting systems.",
            "C: Setting up alerts for any increases in CPU temperature, as this may signify an imminent system shutdown.",
            "D: Implementing strict file permissions to prevent unauthorized execution of shutdown/reboot commands."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Detection Strategy"
    },
    {
        "id": "37c5e212-2d90-4a25-ab6e-e454daba4db3",
        "source": "owasp_mastg",
        "question": "You are evaluating the network security of a mobile application. Select the controls that should be implemented to ensure secure communication between the mobile application and its backend servers. (Select TWO.)",
        "choices": [
            "A: Enforcing SSL/TLS with proper certificate validation for data in transit",
            "B: Using device IMEI as an encryption key for data at rest",
            "C: Implementing a custom encryption protocol for data transmission",
            "D: Ensuring backend services are only accessible over a VPN"
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SSL/TLS"
    },
    {
        "id": "d02c0cdd-0b29-45c1-9a22-db3f518339ef",
        "source": "cs161_textbook",
        "question": "Alice's computer is trying to communicate with Bob's computer within the same local area network (LAN). Alice's computer knows Bob's IP address but not his MAC address. Which of the following steps will Alice's computer and Bob's computer undertake according to the ARP protocol?",
        "choices": [
            "A: Alice's computer sends a broadcast message to the LAN asking for the MAC address of Bob's IP, and Bob's computer responds with its MAC address.",
            "B: Alice's computer sends a direct message to Bob's IP address asking for the MAC address, and Bob's computer responds with its MAC address.",
            "C: Bob's computer sends a broadcast message with its MAC address to the LAN, and Alice's computer captures this information.",
            "D: Alice's computer queries a central directory server to find the MAC address associated with Bob's IP address."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "ARP"
    },
    {
        "id": "eca9c056-32d5-466d-a94c-c144a8d959a2",
        "source": "cs161_textbook",
        "question": "Which of the following countermeasures would be ineffective at preventing clickjacking attacks?",
        "choices": [
            "A: Implementing Content Security Policy (CSP) headers to restrict where resources can be loaded from.",
            "B: Using frame-busting scripts to prevent a webpage from being framed by potentially malicious sites.",
            "C: Enabling a CAPTCHA challenge on every user click to verify the action's legitimacy.",
            "D: Employing visual design best practices to make the webpage more aesthetically pleasing."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Countermeasures"
    },
    {
        "id": "657f1246-4867-434b-a538-1b160b916803",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating an incident where an adversary exploited a software vulnerability to gain unauthorized access to system credentials. Which of the following actions could the analyst recommend to prevent similar incidents in the future? Select two.",
        "choices": [
            "A: Implementing a robust intrusion detection system that can recognize patterns typical of exploitation attempts.",
            "B: Advising application developers to validate authentication requests with measures such as one-time passwords or digital signatures.",
            "C: Setting up a firewall to filter out malicious IP addresses and prevent attackers from reaching internal network resources.",
            "D: Utilizing application isolation and sandboxing techniques to limit the impact of potential exploitation."
        ],
        "answer": "BD",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Exploitation for Credential Access"
    },
    {
        "id": "cc9574c6-5d6e-4814-aeee-fd257d7b85e4",
        "source": "cwe",
        "question": "A software development team is reviewing their project's codebase and discovers multiple instances where global variables are heavily used to maintain state across various components. What are the potential disadvantages of continuing with this approach?",
        "choices": [
            "A: It can lead to tighter coupling between components, making the codebase harder to maintain and understand.",
            "B: Global variables may increase the application's performance by reducing the overhead of parameter passing.",
            "C: Excessive reliance on global variables can result in unexpected side effects and make debugging more difficult.",
            "D: Global variables simplify the management of application state, especially in large, complex systems."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Disadvantages"
    },
    {
        "id": "1c26e147-59bf-4fda-af21-f51bd064cf1c",
        "source": "owasp_mastg",
        "question": "When designing a security testing guide for mobile applications, why might a security expert recommend including platform-independent security measures?",
        "choices": [
            "A: Because platform-independent security measures provide a consistent baseline for all mobile apps regardless of the underlying operating system.",
            "B: Because platform-specific security measures are too complex to implement across different operating systems.",
            "C: Because all mobile operating systems are essentially the same and do not require tailored security measures.",
            "D: Because platform-independent security measures are less important and therefore easier to test."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Platform-Independent Security"
    },
    {
        "id": "8b8b51f3-e3ba-4d6a-8f18-6fe28acf8e45",
        "source": "windows_security",
        "question": "In designing a Windows-based security system for an enterprise, which of the following practices would not be recommended if you are relying on the 'Other Events' auditing subcategory to monitor security-relevant information?",
        "choices": [
            "A: Setting up alerts for system-related events that might indicate potential security breaches.",
            "B: Using the 'Other Events' log to track detailed file access information and modifications.",
            "C: Implementing custom scripts to parse 'Other Events' logs for unusual patterns.",
            "D: Excluding the 'Other Events' logs from regular review because they contain only high-volume trivial information."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Auditing subcategory"
    },
    {
        "id": "940df4b2-5377-4a5a-84c1-dc2ace45059b",
        "source": "apple_platform_security",
        "question": "An organization is assessing their security protocols for their fleet of Intel-based Mac computers without T2 chips and is considering implementing firmware passwords. As a security consultant, you are evaluating which actions can enhance the security of these Mac systems against physical attacks and unauthorized access. From the options below, which would effectively contribute to securing the Mac systems?",
        "choices": [
            "A: Enabling the -disable-reset-capability option to prevent firmware password reset via software means.",
            "B: Allowing only AppleCare to digitally sign and validate firmware password reset resources.",
            "C: Implementing a policy to set firmware passwords using mobile device management (MDM) solutions.",
            "D: Using a unique model-specific string provided by users to bypass the firmware password."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "firmware_security"
    },
    {
        "id": "9bd639c1-6e40-4de9-8198-6e42a8781743",
        "source": "owasp_mastg",
        "question": "A network administrator is configuring a mobile application's backend server interface to communicate with the AP. The administrator suggests using the IP address '10.0.0.1'. What could be a valid counterargument against using this IP address?",
        "choices": [
            "A: The IP address '10.0.0.1' is commonly used as a default gateway, potentially resulting in network routing issues if used for the server.",
            "B: Assigning '10.0.0.1' to the server will enhance network security as it is a non-routable address in public networks.",
            "C: Using '10.0.0.1' will automatically configure the server as a DHCP server, providing dynamic IP assignment to devices.",
            "D: The choice of '10.0.0.1' as an IP address will increase network performance due to its placement at the start of the IP range."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "default gateway"
    },
    {
        "id": "34a393a9-dee4-47b0-bdd0-ebda4f64cbd3",
        "source": "owasp_mastg",
        "question": "Which of the following statements is NOT a vulnerability when developing an iOS application?",
        "choices": [
            "A: Allowing the application to execute unsigned code.",
            "B: Implementing strict mode to limit the permissions granted to the application.",
            "C: Enabling debugging tools in the production version of the application.",
            "D: Disabling ATS (App Transport Security) to allow the app to communicate over HTTP."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "ATS (App Transport Security)"
    },
    {
        "id": "33e5c40e-3a0b-4b21-a09a-c09aeb006e5b",
        "source": "attck",
        "question": "An adversary is using a popular encryption algorithm to protect their command and control (C2) communications. While the algorithm is secure, their implementation might be flawed. Which of the following scenarios could potentially expose the adversary's C2 traffic to reverse engineering and detection?",
        "choices": [
            "A: The adversary uses a custom, proprietary encryption algorithm instead of a known secure one.",
            "B: The adversary hardcodes secret keys within the malware's configuration files.",
            "C: The adversary employs strong, dynamically generated keys for each session.",
            "D: The adversary utilizes a standard communication protocol with no additional encryption."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "5969085a-2425-4d26-892f-a87a8bc3f539",
        "source": "cwe",
        "question": "Analyze the following code snippets and select the one(s) that do not demonstrate the vulnerability associated with using hard-coded cryptographic keys for authentication purposes.",
        "choices": [
            "A: int Authenticate(String password) { String key = getKeyFromEnvironmentVariable(); if (password.Equals(key)) { Console.WriteLine(\"Access Granted.\"); return(1); } Console.WriteLine(\"Access Denied.\"); return(0); }",
            "B: int VerifyUser(char *password) { if (strcmp(password, \"68af404b513073584c4b6f22b6c63e6b\")) { printf(\"Incorrect Password!\\n\"); return(0); } printf(\"Welcome, User!\\n\"); return(1); }",
            "C: public boolean CheckAccess(String password) { final String KEY = System.getenv(\"APP_SECRET_KEY\"); return password.equals(KEY); }",
            "D: bool AuthenticateUser(string password) { const string hardcodedKey = \"68af404b513073584c4b6f22b6c63e6b\"; return password == hardcodedKey; }"
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Hard-codedKey"
    },
    {
        "id": "6df3cdb6-2751-4a64-8b74-e8595c0e9ffd",
        "source": "cs161_textbook",
        "question": "Imagine you are troubleshooting a DNS resolution process and must identify the correct sequence of responses based on the DNS hierarchy and query forwarding as described in the case. Which of the following sequences correctly reflects the DNS resolution process for the domain 'dept.example.com'?",
        "choices": [
            "A: Root server provides '.com' NS; '.com' server provides 'example.com' NS; 'example.com' server provides 'dept.example.com' IP.",
            "B: Root server provides 'example.com' NS; 'example.com' server provides 'dept.example.com' NS; 'dept.example.com' server provides its own IP.",
            "C: Root server provides '.edu' NS; '.edu' server provides 'example.com' NS; 'example.com' server provides 'dept.example.com' IP.",
            "D: Root server provides '.com' NS; '.com' server provides 'dept.example.com' IP; no further NS provided."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNS"
    },
    {
        "id": "51c2e727-40d0-4783-a620-a924367a6069",
        "source": "attck",
        "question": "A network security team is configuring their detection systems to identify unauthorized use of valid accounts via remote services. Based on best practices, which of the following detection methods would be most effective in identifying such activities?",
        "choices": [
            "A: Monitor for the creation of new services under network logon sessions by non-system users.",
            "B: Regularly scan for open ports across the network to detect unauthorized remote service configurations.",
            "C: Track the installation of new software across the network to intercept remote access tools.",
            "D: Inspect command lines for known substrings associated with tools used for remote access and lateral movement."
        ],
        "answer": "",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Logon Session Creation"
    },
    {
        "id": "a051df55-8b5f-4ba2-abb3-b33bfe754619",
        "source": "apple_platform_security",
        "question": "During the installation of a second operating system on a Mac with Apple silicon, which of the following actions are crucial to ensure a secure handoff of Ownership from the first to the second operating system?",
        "choices": [
            "A: The use of the Key encryption key (KEK) to protect the Owner Identity Key (OIK) with the selected user's password for the new operating system.",
            "B: Prompting the user to copy a user from the current volume to the second operating system during installation.",
            "C: Enforcing the inclusion of a Secure Enclave Nonce Hash (senh) in the LocalPolicy for the new operating system.",
            "D: Generating a hardware-specific Owner Policy Nonce (OPN) to prevent cross-volume policy manipulation."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "OwnershipHandoff"
    },
    {
        "id": "de04c560-e141-487c-abcb-22b7d14a0403",
        "source": "cs161_textbook",
        "question": "As a security analyst, you are assessing the risk posed by online guessing attacks to a company's user accounts. Based on the statistics provided in the study, you are aware that 1% of users are likely to have a password that is among the top 10 most common passwords and approximately 50% of users will have a password among the top \\(2^{20}\\) most common passwords. Considering the information and the nature of online guessing attacks, which of the following measures could potentially reduce the risk of successful attacks? Select all that apply.",
        "choices": [
            "A: Implementing a limit on the number of unsuccessful login attempts before locking the account.",
            "B: Advising users to create passwords containing a sequence of simple patterns, such as '123456'.",
            "C: Using a blacklist of common passwords that are not allowed to be used during account creation.",
            "D: Introducing a mandatory two-factor authentication for all user accounts."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "online guessing attacks"
    },
    {
        "id": "2a288907-b402-4631-96e6-e039ddea1507",
        "source": "owasp_mastg",
        "question": "In an Android mobile application, a developer has used an API from the Android Platform to integrate social media sharing features. The API requires the use of OAuth tokens for authentication. Which of the following considerations should be taken into account to maintain the security of the application?",
        "choices": [
            "A: Storing OAuth tokens in encrypted form within the application's local storage to prevent unauthorized access.",
            "B: Hard-coding OAuth tokens into the application's source code for ease of use and consistency.",
            "C: Transmitting OAuth tokens over unencrypted channels to ensure faster communication with the social media platform.",
            "D: Using Android's built-in AccountManager to handle OAuth tokens and credentials securely."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "OAuth Tokens"
    },
    {
        "id": "8a7f4b45-112c-4794-8a92-82b457cbd683",
        "source": "apple_platform_security",
        "question": "You are configuring a smart home environment using HomeKit-enabled devices and a HomeKit-compatible router. Which of the following settings and security measures should you apply to ensure optimal security and functionality for your HomeKit accessories and data?",
        "choices": [
            "A: Use the router's main Wi-Fi password for HomeKit accessories to simplify network management.",
            "B: Configure the HomeKit router using the router manufacturer’s app to validate user access and add it to the Home app.",
            "C: Store HomeKit data on the device using the Data Protection class Protected Until First User Authentication and encrypt backups with HomeKit identity keys and a random nonce.",
            "D: Set HomeKit accessories to 'Automatic' access restriction mode, which will allow them to communicate with only a pre-approved list of internet sites and local ports."
        ],
        "answer": "BCD",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "HomeKit"
    },
    {
        "id": "4ca8aaeb-4354-4343-9b06-9406e0e85118",
        "source": "windows_security",
        "question": "In a Windows environment, failure to implement the File System (Global Object Access Auditing) policy could lead to which of the following consequences?",
        "choices": [
            "A: Increased granularity in file system access control and auditing.",
            "B: Decreased visibility into unauthorized file system access attempts.",
            "C: Enhanced performance due to reduced overhead from auditing processes.",
            "D: Reduced complexity in managing file system permissions across the network."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "File System Access Auditing"
    },
    {
        "id": "a684a5f8-bc60-4d08-bbdf-a8fdd340fe61",
        "source": "windows_security",
        "question": "Why might a system administrator be unable to enable the System Guard Secure Launch feature on a Windows 10 device?",
        "choices": [
            "A: The device does not meet the baseline requirements for System Guard, Device Guard, Credential Guard, and Virtualization Based Security.",
            "B: The System Guard Secure Launch feature is exclusively available for Windows 11 and cannot be enabled on Windows 10 devices.",
            "C: The administrator has not configured the Mobile Device Management (MDM) settings to allow for Secure Launch activation.",
            "D: The Secure Launch feature is hardware-independent and does not require a supported processor."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Baseline Requirements"
    },
    {
        "id": "60631cf9-95c2-47c0-b0dc-1443524892a5",
        "source": "cs161_textbook",
        "question": "Why is it that CTR mode encryption and decryption can be parallelized while CBC mode encryption cannot? Select the reasons that apply.",
        "choices": [
            "A: CTR mode uses a nonce and counter for each block cipher operation, which do not depend on previous or subsequent blocks.",
            "B: CBC mode requires the previous ciphertext block to encrypt the current plaintext block, creating a sequential dependency.",
            "C: CTR mode requires sequential processing of blocks to ensure the integrity of the nonce and counter.",
            "D: CBC mode decryption is also not parallelizable because it depends on the plaintext of the previous block."
        ],
        "answer": "AB",
        "topics": [],
        "keyword": "EncryptionModes"
    },
    {
        "id": "f3d075bb-c0ec-4b0a-987a-3f44a3d0b106",
        "source": "apple_platform_security",
        "question": "A user is making a payment using Apple Pay. Select the statements that accurately describe the security mechanisms and steps involved in ensuring the authenticity and integrity of the transaction.",
        "choices": [
            "A: A cryptographic nonce is requested from Apple Pay servers and, alongside other transaction data, is utilized to compute a payment signature within the Secure Element.",
            "B: The payment signature is sent to the merchant's server for verification before the transaction is completed.",
            "C: Apple Pay servers play a role in verifying the authentication, integrity, and correctness of the transaction using the payment signature and nonce.",
            "D: The transaction data, including the nonce and payment signature, are stored on the user's device for future reference and validation of the transaction."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Apple Pay"
    },
    {
        "id": "88117990-6ba6-4386-865e-b4cacd4b2692",
        "source": "android_sec_doc",
        "question": "You are tasked with setting up a build environment for Trusty on an arm64 device. After installing the necessary tools and repositories, which of the following sets of steps would correctly compile the Trusty TEE image?",
        "choices": [
            "A: Create a directory named trusty, initialize the repo with the Trusty manifest from the AOSP, synchronize the repo, and use the provided build script for a generic arm64 image.",
            "B: Install the Trusty repositories directly without using Repo, build using the standard make command, and the lk.bin will be found in the root directory.",
            "C: Initialize the repo with the Trusty manifest from an unofficial source, perform a recursive clone, and use a makefile to build the generic arm64 image.",
            "D: Download the prebuilt lk.bin image directly from the AOSP without building, as building from source is not supported for arm64 devices."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "TEE"
    },
    {
        "id": "32112383-dc97-478c-b04c-3df08455507b",
        "source": "windows_security",
        "question": "In the context of Windows security event logs, which of the following actions would generate the event '4743(S) A computer account was deleted'?",
        "choices": [
            "A: A user account is removed from a security group.",
            "B: A computer object is deleted from the Active Directory.",
            "C: A computer account is created in the Active Directory.",
            "D: An administrator resets a computer account's password."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Event 4743(S)"
    },
    {
        "id": "a894c7d1-ea25-406f-a6c0-ec7488969eb9",
        "source": "cs161_textbook",
        "question": "Your team is debating the inclusion of multiple code hardening defenses in a legacy system written in C. You understand that while these defenses do not guarantee complete security, they offer a layer of protection. Evaluate the following arguments and select the ones that present valid points in favor of using code hardening defenses:",
        "choices": [
            "A: By applying code hardening defenses, the team can focus on feature development without worrying about any memory safety exploits.",
            "B: Even though code hardening defenses do not make the system invulnerable, they contribute to a defense-in-depth strategy that increases overall security.",
            "C: The use of code hardening defenses is only a temporary solution until the entire codebase can be rewritten in a memory-safe language.",
            "D: Implementing multiple code hardening defenses can force an attacker to find multiple vulnerabilities, making it more difficult to compromise the system."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "MemorySafety"
        ],
        "keyword": "Defense-in-Depth"
    },
    {
        "id": "e41b57c6-eba6-4a7d-ae9d-05238c751af6",
        "source": "attck",
        "question": "A cybersecurity analyst is monitoring a network for potential intrusions. They notice an unusual process that appears to be decrypting and decompressing data encoded with a custom algorithm. Which of the following techniques would be LEAST effective for detecting this malicious activity?",
        "choices": [
            "A: Monitoring for file modifications such as unexpected changes to files that may hide artifacts.",
            "B: Monitoring for process creation events that involve common archive file applications and extensions.",
            "C: Monitoring for script execution that is out of cycle from regular patching or administrative functions.",
            "D: Monitoring for the use of standard text editing tools to modify text-based configuration files."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Process Creation Monitoring"
    },
    {
        "id": "a860f5b8-a0cd-4b5c-b166-0943736080ef",
        "source": "cs161_textbook",
        "question": "A developer is working on a legacy application that must run on both 32-bit and 64-bit systems. Which of the following statements accurately reflects the implications of these system architectures on the application's memory address space?",
        "choices": [
            "A: On a 32-bit system, the application will have an address space of \\(2^{64}\\) bytes.",
            "B: On a 64-bit system, the address space will be significantly larger than that of a 32-bit system, accommodating \\(2^{64}\\) bytes.",
            "C: The 32-bit and 64-bit systems will provide the same address space, facilitating compatibility between the architectures.",
            "D: The application will not run on a 64-bit system due to the incompatibility in address space size."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "AddressSpace"
    },
    {
        "id": "00d8980f-9175-4392-8464-e070450e42ff",
        "source": "cs161_textbook",
        "question": "A company still uses a legacy network protocol designed decades ago when the assumption was that all network participants could be trusted. As a security analyst, which of the following would you advise as reasons to update their network protocol? (Select all that apply)",
        "choices": [
            "A: The increase in network traffic has made the old protocols inefficient in handling modern bandwidth requirements.",
            "B: The original assumption of trust is no longer valid as today's Internet includes malicious devices.",
            "C: New regulations require all companies to use the latest encryption standards, which the old protocol does not support.",
            "D: Legacy protocols are often open-source, making them more vulnerable to attackers who can study the source code."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "LegacyProtocol"
    },
    {
        "id": "f87694cc-8af0-4e45-af96-862ea23f5fff",
        "source": "apple_platform_security",
        "question": "When using Apple Pay with Face ID and Touch ID, certain actions are performed to enhance security during transactions. Select the statements that correctly describe these security measures:",
        "choices": [
            "A: Double-clicking the side button when using Face ID in shops captures user intent, which is linked to the Secure Enclave and resistant to forgery by malicious processes.",
            "B: For Touch ID, the intent to pay is confirmed when the Secure Enclave detects a match without the need for any additional user interaction.",
            "C: Apple Pay transactions require re-authentication if the user changes the payment method after Face ID authentication in shops.",
            "D: If an Apple Pay transaction is not completed within 60 seconds of double-clicking the side button, Face ID requires the user intent to be reconfirmed by triple-clicking the side button."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Apple Pay Security"
    },
    {
        "id": "71254b0b-c546-493d-ab90-b9f8cc9d164f",
        "source": "apple_platform_security",
        "question": "A macOS application developer is creating a device driver using DriverKit and an iOS application developer is adding recording features using ReplayKit. Which of the following statements correctly describe the security measures in place for these frameworks?",
        "choices": [
            "A: DriverKit allows drivers to run in user space instead of as kernel extensions, which improves system security and stability.",
            "B: ReplayKit requires user consent for recording the screen, microphone, and front-facing camera only once per app installation.",
            "C: DriverKit device drivers are automatically removed when the bundling app is uninstalled from macOS.",
            "D: ReplayKit recordings are stored in a directory accessible to the host app for easy integration and sharing."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "FrameworkSecurity"
    },
    {
        "id": "11541420-16d3-44ce-98e9-44a046d318ce",
        "source": "mit6.858",
        "question": "An organization is revising its access control policies to prevent unauthorized data access. Based on the lessons learned from past cybersecurity incidents, which TWO of the following access control models would likely strengthen the organization's data security?",
        "choices": [
            "A: Implementing a role-based access control (RBAC) system where permissions are associated with roles rather than individual users, reducing the risk of insider threats.",
            "B: Allowing administrators to reset passwords without requiring additional verification, ensuring quick recovery of user accounts in case of password loss.",
            "C: Instituting a mandatory access control (MAC) system which enforces access policies determined by a central authority, thus limiting data access based on clearance levels.",
            "D: Adopting a model where all users have access to all files by default and must opt-in to secure their files individually, simplifying user experience."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AccessControl"
    },
    {
        "id": "c45ec093-be55-4207-8b3e-03054a8ccc5c",
        "source": "apple_platform_security",
        "question": "A development team is working on an application for iOS 9 and macOS 10.11 platforms. They need to ensure their app's network connections are secure by default using App Transport Security (ATS) and that the app adheres to the latest IPv6 security recommendations. What measures must they implement to comply with ATS's default connection requirements and IPv6 security for Apple operating systems?",
        "choices": [
            "A: Support for TLS 1.2, ensuring forward secrecy, and using certificates signed with SHA256 or stronger with at least 2048-bit RSA key or 256-bit elliptic curve key.",
            "B: Allowing only ECDHE_ECDSA_AES and ECDHE_RSA_AES in CBC mode, and performing OCSP for all certificates regardless of the number of revocations.",
            "C: Use of temporary IPv6 addresses with a preferred lifetime of 48 hours for new connections and incorporating the network’s SSID into the address generation for Wi-Fi networks.",
            "D: Generating IPv6 addresses using cryptographically generated addresses as per RFC 3972, and ensuring that different interfaces on the same network have different addresses."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "ATS"
    },
    {
        "id": "ed76d844-e5ab-4036-b792-0cad86ea465f",
        "source": "cwe",
        "question": "Consider the following code snippet from a program written in C:\n\n\nchar *data;\nchar *temp;\ndata = (char *) malloc(100);\nfree(data);\ntemp = (char *) malloc(50);\nstrcpy(temp, \"Sample data\");\nprintf(\"%s\", data);\nfree(temp);\n\n\nWhich of the following lines of code is most susceptible to a use-after-free vulnerability?",
        "choices": [
            "A: strcpy(temp, \"Sample data\");",
            "B: printf(\"%s\", data);",
            "C: temp = (char *) malloc(50);",
            "D: free(temp);"
        ],
        "answer": "B",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "UseAfterFree"
    },
    {
        "id": "69fca540-6531-4597-9d4c-765d8a2a9f07",
        "source": "mozilla_security",
        "question": "Why would configuring 'Content-Security-Policy: frame-ancestors https://trusted.partner.com' alongside 'X-Frame-Options: DENY' not be an effective strategy for allowing only https://trusted.partner.com to frame your website?",
        "choices": [
            "A: Because 'X-Frame-Options: DENY' will override the 'Content-Security-Policy' and disallow framing from all sources, including https://trusted.partner.com.",
            "B: Because 'Content-Security-Policy' is not supported by all browsers and 'X-Frame-Options' should be used exclusively.",
            "C: Because 'X-Frame-Options' does not support allowing specific domains and will cause conflicts with the 'Content-Security-Policy'.",
            "D: Because specifying a specific domain in 'Content-Security-Policy' is not valid syntax and will be ignored by browsers."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Clickjacking Defense"
    },
    {
        "id": "0ac6a24d-1a21-4c95-b60c-817a35ab6a13",
        "source": "attck",
        "question": "An analyst is reviewing the behavior of a new piece of malware and observes that it employs obfuscation techniques to hinder analysis. Which of the following pairs of obfuscation techniques and descriptions could be consistent with such malware, based on known tactics?",
        "choices": [
            "A: The malware uses structured exception handling and return-oriented programming to obfuscate its code.",
            "B: The malware incorporates spaghetti code to obscure its execution flow.",
            "C: The malware encrypts its payload using a simple substitution cipher.",
            "D: The malware obfuscates strings using Base64 encoding and gzip compression."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Obfuscation Techniques"
    },
    {
        "id": "85bd0067-1e1f-4a00-a3dd-7e949c56ebe8",
        "source": "apple_platform_security",
        "question": "A user decides to disable wrist detection on their Apple Watch for personal convenience. What are the direct implications of this action?",
        "choices": [
            "A: Disabling wrist detection will prevent the Apple Watch from locking automatically when removed from the user's wrist.",
            "B: With wrist detection disabled, Apple Pay cannot be used until the user re-enables wrist detection.",
            "C: An option for locking the Apple Watch will be available in the Control Centre once wrist detection is disabled.",
            "D: The user's Apple ID and password will be required to unlock the Apple Watch each time wrist detection is disabled."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "WristDetection"
    },
    {
        "id": "ebca777b-0bd0-45db-bd5e-d941d978a531",
        "source": "owasp_wstg",
        "question": "You are tasked with securing the web application files on a Linux server. One of your objectives is to ensure that sensitive configuration files are not accessible by unauthorized users. Which of the following actions would be considered the best practice for setting file permissions to enhance security?",
        "choices": [
            "A: Set all files to have 777 permissions to simplify management.",
            "B: Assign world-readable permissions to sensitive configuration files to ensure service functionality.",
            "C: Apply the principle of least privilege by restricting file permissions to the minimum necessary for operation.",
            "D: Remove execute permissions from all files to prevent any code from running on the server."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Principle of Least Privilege"
    },
    {
        "id": "27da813c-70c2-4126-81d0-03f7c23881fa",
        "source": "android_sec_doc",
        "question": "An Android device configured with dm-verity encounters a run-time verification error on the system partition. The device is set to 'restart' mode. Which of the following is the most likely behavior exhibited by the device upon encountering this error?",
        "choices": [
            "A: The device will attempt to repair the corrupted partition using a backup hash tree.",
            "B: The device will continue operating with occasional prompts to the user to address the verification error.",
            "C: The device will immediately restart with a specific flag set indicating a verification error was encountered.",
            "D: The device will shut down completely until a manual restart is initiated by the user."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "dm-verity"
    },
    {
        "id": "2ce26b1c-7d8d-4aa1-af16-c5e6ab29e40b",
        "source": "cwe",
        "question": "As a software architect, you are tasked with designing the installation process for a new application. Your goal is to ensure that file permissions are securely configured to prevent unauthorized access or modification after installation. Which of the following strategies should be included in your design to achieve this?",
        "choices": [
            "A: Set installed file permissions to be modifiable by any user to maximize ease of use for administrative tasks.",
            "B: Restrict access and modification attributes for files to only those users who actually require such actions.",
            "C: Allow sensitive data within the installation files to be accessible without any trust boundaries.",
            "D: Design the system with compartmentalization, creating 'safe' areas where trust boundaries can be clearly defined and privilege separation is enforced."
        ],
        "answer": "BD",
        "topics": [
            "Vulnerability",
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "FilePermissions"
    },
    {
        "id": "3e3d7df5-d964-4bd0-9f77-b9650847e2fd",
        "source": "windows_security",
        "question": "In a Windows domain environment, if a group policy object (GPO) fails to apply successfully to a client machine, what could be a potential consequence for the system's security posture?",
        "choices": [
            "A: Increased protection against malware due to fallback on local policies",
            "B: No change in security posture, as GPOs are non-essential for client security",
            "C: Unenforced security policy leading to potential vulnerabilities",
            "D: Automatic updating of security policies from an alternative source"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Group Policy Object (GPO)"
    },
    {
        "id": "94b59f6f-57f5-4ea3-af4f-f4e58ad1cdef",
        "source": "windows_security",
        "question": "Why is it important that a Security Identifier (SID) not be reused for another user or group in Windows security contexts? (Select TWO.)",
        "choices": [
            "A: Reusing a SID could allow users to inherit access rights unintentionally.",
            "B: SIDs are linked to user passwords and reusing them could expose secure credentials.",
            "C: Non-reuse of SIDs ensures that event logs accurately reflect individual user actions.",
            "D: A reused SID could lead to system instability and frequent crashes."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Identifier (SID)"
    },
    {
        "id": "a09c67f4-cea8-4639-9d77-a4f414193533",
        "source": "apple_platform_security",
        "question": "In macOS, apps must obtain user consent before accessing certain files or features. Based on the provided text, which of the following statements are true regarding app permissions and user control in macOS?",
        "choices": [
            "A: Apps can access files in the user's Bin without prompting for access, even when Full Disk Access is enabled.",
            "B: Apps need explicit user consent to access files in the Documents, Downloads, and Desktop folders.",
            "C: Accessibility and automation capabilities can be used by apps without user permission to bypass other protections.",
            "D: For full storage device access, apps must be added explicitly in System Preferences in macOS 10.13 or later."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AppPermissions"
    },
    {
        "id": "bfde3b64-9ffd-4b6e-b39c-71fc772b4e5d",
        "source": "cwe",
        "question": "An organization's security audit of their operational technology (OT) systems revealed several critical security weaknesses. In the audit report, it was mentioned that the systems lacked proper authentication mechanisms, and some even used client-side authentication for critical functionality. What are the potential risks of these findings and what could be the consequences if these vulnerabilities are exploited?",
        "choices": [
            "A: Attackers could manipulate the OT systems to cause disruptions, leading to safety hazards in industries such as power and water.",
            "B: The lack of proper authentication might expose the system to malware infections, causing data breaches and loss of intellectual property.",
            "C: Unauthorized users could gain administrative access, potentially allowing them to send out fake alerts or messages.",
            "D: There is a risk of performance degradation due to the additional overhead of implementing stronger authentication measures."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "OT Security"
    },
    {
        "id": "d1265f2e-60df-4260-bdd7-93c7beb12efc",
        "source": "apple_platform_security",
        "question": "What are the primary purposes of the Secure Enclave's Memory Protection Engine and Boot Monitor in Apple devices' security architecture? Select all that apply.",
        "choices": [
            "A: The Memory Protection Engine encrypts Secure Enclave's memory blocks to protect against unauthorized access and verifies their integrity through CMAC tags.",
            "B: The Boot Monitor facilitates the interaction between the Application Processor and Secure Enclave, enabling seamless data exchange for normal device operation.",
            "C: The Memory Protection Engine's nonce system adds replay protection, ensuring security-critical data cannot be illicitly reused.",
            "D: The Boot Monitor ensures the integrity of the sepOS hash during system startup and contributes to the creation of operating-system-bound keys."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Memory Protection"
    },
    {
        "id": "9e6eabad-2a35-483a-97d5-58469bb4aace",
        "source": "owasp_wstg",
        "question": "An organization is considering the use of NoSQL databases for their new web application due to the advertised performance and scaling benefits. As a security consultant, you are tasked to explain the potential security trade-offs. Which of the following statements accurately describes a security trade-off when using NoSQL databases as opposed to traditional SQL databases?",
        "choices": [
            "A: NoSQL databases eliminate the risk of injection attacks completely due to their non-relational nature.",
            "B: NoSQL databases may be more vulnerable to injection attacks as they often execute within a procedural language and lack traditional SQL syntax, thus broadening potential attack vectors.",
            "C: NoSQL databases primarily use HTML special characters for their operations, making them inherently secure against injection attacks.",
            "D: NoSQL databases are less secure because they are unable to utilize XML, JSON, or LINQ for data manipulation, which are known to be secure data formats."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Security Trade-offs"
    },
    {
        "id": "edcddbbd-0985-44b4-a762-820d7d1d37c5",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security testing, which of the following actions should be prioritized when assessing an application designed for the Android platform?",
        "choices": [
            "A: Ensuring the application does not store sensitive information in clear text on the device.",
            "B: Verifying that the application is compatible with all desktop-based antivirus software.",
            "C: Assessing the application for the use of platform-independent mobile APIs.",
            "D: Confirming that the application's color scheme adheres to the platform's design guidelines."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Secure Data Storage"
    },
    {
        "id": "639425de-9638-4a42-82f1-fa56fb29128b",
        "source": "owasp_mastg",
        "question": "In the context of Android application security, an app developer must choose between using the Confirm Credential flow and Biometric Authentication flow to protect a critical function within the app. Which of the following statements is a potential weakness that should be considered when deciding on the authentication flow?",
        "choices": [
            "A: Confirm Credential flow may be less secure if the lock screen protection is weak, such as using simple predictive patterns.",
            "B: Biometric Authentication flow cannot be implemented on devices running Android 10 (API level 29) or higher.",
            "C: Biometric Authentication flow is less secure because it cannot utilize the AndroidKeystore for storing cryptographic materials.",
            "D: Confirm Credential flow requires a separate app-specific password in addition to the device's lock screen protection."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Confirm Credential flow"
    },
    {
        "id": "dc2205c9-362d-4636-8d5e-7e363305650e",
        "source": "attck",
        "question": "A network administrator is considering the implementation of a multi-hop proxy setup to manage command and control communications within their organization's network infrastructure. They're weighing the potential benefits and drawbacks of this approach. Considering cybersecurity best practices, which of the following statements present a valid advantage and disadvantage of employing a multi-hop proxy setup?",
        "choices": [
            "A: Advantage: It simplifies network traffic, making it easier to monitor and control.",
            "B: Disadvantage: It can increase the complexity of the network and make it harder to trace malicious traffic.",
            "C: Advantage: It can reduce the number of simultaneous outbound network connections and ride over existing trusted communications paths to avoid suspicion.",
            "D: Disadvantage: A multi-hop proxy can lead to a significant decrease in connection resiliency and an increase in connection loss."
        ],
        "answer": "BC",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "multi-hop proxy"
    },
    {
        "id": "38bd6938-5b55-487a-80a2-3d947c146965",
        "source": "windows_security",
        "question": "Why might an organization choose to avoid immediately implementing the 'Deny all' policy setting for the 'Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers'?",
        "choices": [
            "A: To ensure that all NTLM authentication requests are logged before denying them.",
            "B: Because it is identical in effect to the 'Not defined' setting, which allows all NTLM authentication.",
            "C: To avoid potential productivity losses from numerous failed NTLM authentication requests.",
            "D: To comply with audit requirements, as 'Deny all' does not log any NTLM authentication attempts."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "NTLM Traffic Restriction"
    },
    {
        "id": "2290153c-a8db-4850-abfa-5e0839fde675",
        "source": "cs161_textbook",
        "question": "Why is it important for the values R_B and R_S in a TLS handshake to be randomly generated for each connection?",
        "choices": [
            "A: To ensure faster handshake completion by reducing the computational overhead.",
            "B: To prevent the server from regenerating the same symmetric keys, which would allow replay attacks with old messages.",
            "C: To allow for backward compatibility with older versions of the TLS protocol.",
            "D: To enable the server to distinguish between multiple concurrent connections from the same client."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ReplayAttackPrevention"
    },
    {
        "id": "21db3c73-8ef3-41ee-b974-cb1545d1dfc8",
        "source": "attck",
        "question": "As part of a security audit, which of the following actions would not be considered an effective mitigation against adversaries that rely on user execution to compromise a system?",
        "choices": [
            "A: Implementing application control to prevent the running of executables disguised as other file types.",
            "B: Enabling features that allow executable files to run from the desktop without any restrictions.",
            "C: Using network intrusion prevention systems to block access to malicious downloads.",
            "D: Educating users on recognizing and reporting potential phishing and spearphishing attempts."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Mitigation Strategy"
    },
    {
        "id": "29c63c06-5d66-4ea4-995e-0688ec2b6f95",
        "source": "cwe",
        "question": "In a Java Server Page (JSP) application, a developer included a comment within the JSP code saying '<!-- FIXME: calling this with more than 30 args kills the JDBC server -->'. What is the potential security implication of this practice?",
        "choices": [
            "A: It provides documentation for future maintenance and has no security implications.",
            "B: It could lead to a Denial of Service (DoS) attack if an attacker discovers the comment and abuses the vulnerability.",
            "C: The comment will be pre-processed by the server and thus poses no risk of information exposure.",
            "D: Such comments increase the application's response time and may slow down the server."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CommentExposure"
    },
    {
        "id": "63452203-107c-43a4-a0ac-9fa90a26e079",
        "source": "windows_security",
        "question": "Why is it recommended to report a security event of the type 'The installation of this device is forbidden by system policy' if the 'Subject\\Security ID' does not correspond to the SYSTEM account?",
        "choices": [
            "A: Because the SYSTEM account is a placeholder for any unauthorized user",
            "B: Because SIDs that do not match the SYSTEM account may indicate an attempt by a non-system user to install a device, which could be a policy violation or a security issue",
            "C: Because SIDs are always supposed to match the SYSTEM account for all security events",
            "D: Because non-SYSTEM SIDs are indicative of a malfunctioning security event logging system"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "SID (Security Identifier)"
    },
    {
        "id": "ed005bfe-e198-41b0-9cee-de25b381d63f",
        "source": "windows_security",
        "question": "In a corporate environment, a security audit reveals that the 'Perform volume maintenance tasks' user right is assigned to several groups aside from the local Administrators. Which of the following actions align with the security best practices for managing this right on Windows servers?",
        "choices": [
            "A: Restrict the right to only the Backup Operators group for better separation of duties.",
            "B: Ensure that the right is assigned exclusively to the local Administrators group.",
            "C: Allow all users to hold this right to avoid potential operational disruptions.",
            "D: Assign the right to the Domain Admins group on all client computers for centralized management."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Perform volume maintenance tasks"
    },
    {
        "id": "6d475412-2961-40e2-82d0-b97e4700ccfc",
        "source": "cs161_textbook",
        "question": "Evaluate the one-time pad (OTP) encryption scheme. Consider the following properties and practical implications of using OTP in a scenario where Alice and Bob wish to communicate securely. Which of the following statements are true regarding OTP?",
        "choices": [
            "A: OTP requires a shared secret key of the same length as the message to be encrypted, which ensures perfect secrecy.",
            "B: If OTP is reused for multiple messages, it can lead to a compromise of the encrypted messages due to the XOR operation revealing the plaintexts.",
            "C: The IND-CPA security proof of OTP relies on the uniform distribution of the key, making each n-bit ciphertext string equally likely.",
            "D: The one-time pad's simplicity and ease of use make it the most practical encryption scheme for securing web communications."
        ],
        "answer": "ABC",
        "topics": [
            "Cryptography"
        ],
        "keyword": "One-Time Pad"
    },
    {
        "id": "d1c03b08-f8bb-471d-a018-1e4fef50dc0b",
        "source": "android_sec_doc",
        "question": "You are developing a trusted application on the Trusty IPC system and need to associate private data with a specific handle using the 'set_cookie()' method. Which of the following changes to the parameters of 'set_cookie()' would allow you to correctly associate user-space data with the handle?",
        "choices": [
            "A: Passing a NULL pointer as the 'cookie' parameter to represent arbitrary user-space data.",
            "B: Passing the handle's value directly to another trusted application for comparison against the 'INVALID_IPC_HANDLE'.",
            "C: Using a negative integer to represent the 'handle' parameter for immediate identification as invalid or unset.",
            "D: Passing a pointer to the user-space data as the 'cookie' parameter to link it with the handle."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Trusty IPC"
    },
    {
        "id": "2ae220d9-94f7-4c90-9ce9-b004d35c232b",
        "source": "attck",
        "question": "You are a security consultant tasked with enhancing the defenses of a company's network. Adversaries have previously exploited the network to dump credentials using various sub-techniques. Which of the following mitigation strategies would you recommend to most effectively prevent credential dumping attacks that target the Local Security Authority Subsystem Service (LSASS) memory?",
        "choices": [
            "A: Enable Protected Process Light for LSA on Windows 8.1 and Windows Server 2012 R2 machines.",
            "B: Restrict access to '/etc/passwd' and '/etc/shadow' files on all Linux servers.",
            "C: Deploy an advanced threat protection solution that can prevent zero-day exploits on all endpoints.",
            "D: Implement a software restriction policy to disallow execution of known credential dumping tools."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Protected Process Light for LSA"
    },
    {
        "id": "38a24d56-4498-40f1-8a1a-0857180854fa",
        "source": "cs161_textbook",
        "question": "An attacker is attempting to exploit a buffer overflow vulnerability in a program to execute a return-to-libc attack. The system on which the program is running employs Address Space Layout Randomization (ASLR) as part of its security measures. Which of the following statements accurately describe why ASLR could make this attack more challenging? (Select all that apply)",
        "choices": [
            "A: ASLR randomizes the addresses where system libraries are loaded, making it difficult to predict the address of libc functions.",
            "B: ASLR encrypts the contents of the stack, making injected shellcode unreadable to the attacker.",
            "C: ASLR changes the starting address of the heap and stack at each program run, complicating the placement of shellcode.",
            "D: ASLR increases the size of the stack, thereby reducing the chances of a successful buffer overflow."
        ],
        "answer": "AC",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "ASLR"
    },
    {
        "id": "ccb0c36d-8aa0-436a-8c29-e355ee84ef75",
        "source": "attck",
        "question": "In reviewing the design of a cloud service's permission structure, you observe that serverless functions have been granted the 'IAM:PassRole' permission in AWS. What could be a potential security implication of this configuration?",
        "choices": [
            "A: It would allow serverless functions to improve performance by adjusting resource allocation automatically.",
            "B: It could enable adversaries to add additional cloud roles to serverless functions, increasing their privileges.",
            "C: It would restrict serverless functions from accessing necessary resources, leading to service disruption.",
            "D: It could optimize cost by automatically scaling down unused serverless resources."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "IAM:PassRole Permission"
    },
    {
        "id": "41bd101c-80a7-45af-99a5-90a6bc83db4f",
        "source": "android_sec_doc",
        "question": "An Android developer argues that prompting users for permission at the start of each session, rather than at install time, would enhance user security by ensuring they are aware of the permissions an app requires each time it is used. What is the strongest counterargument to this claim based on the Android security model?",
        "choices": [
            "A: Frequent permission prompts can lead to 'click fatigue,' where users may habitually approve all dialogs without reading, thus diminishing the effectiveness of the prompt.",
            "B: Users are unable to manage permissions after app installation, making post-install prompts the only way to control app access to protected APIs.",
            "C: Android's permission model prevents third-party applications from ever accessing certain protected features, so additional prompts are unnecessary.",
            "D: All permissions are permanently granted upon installation, and the user has no option to revoke them later, making additional prompts irrelevant."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Permission model"
    },
    {
        "id": "0e5de29b-9d0e-47dc-80e6-9ef68e329099",
        "source": "cs161_textbook",
        "question": "In the context of ARP's operational purpose and security, which of the following design proposals should be challenged? (Select two)",
        "choices": [
            "A: Implementing a monitoring system like arpwatch to detect abnormal ARP traffic patterns.",
            "B: Using switches in the network to limit the broadcast domain and reduce the risk of ARP spoofing.",
            "C: Deploying a DNS security extension such as DNSSEC to prevent ARP spoofing attacks.",
            "D: Enforcing static ARP entries on critical servers to prevent them from accepting spoofed ARP responses."
        ],
        "answer": "CD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "ARP Security"
    },
    {
        "id": "3a26c0ee-6ddb-4900-a7b4-eea97826bf64",
        "source": "apple_platform_security",
        "question": "Consider the secure boot process and memory safety mechanisms of Apple devices. Select the statements that correctly describe the roles of different components and the implementation of memory safety measures in these processes.",
        "choices": [
            "A: The Secure Enclave performs its own secure boot, ensuring it only boots sepOS that is verified and signed by Apple.",
            "B: The LocalPolicy file on a Mac with Apple silicon describes the user's chosen system boot and runtime security policies, and it's signed centrally by an Apple server.",
            "C: In iOS 14 and iPadOS 14, the modified C compiler toolchain used to build the iBoot bootloader helps prevent buffer overflows by ensuring pointers carry bounds information.",
            "D: The Boot ROM code for iOS and iPadOS devices contains the Apple Root CA public key, which is used to verify the LLB before allowing it to load."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Boot Process"
    },
    {
        "id": "c60dde0b-fbcf-4b4c-b98b-05688c6af02d",
        "source": "cs161_textbook",
        "question": "Consider you are tasked with designing a secure communication protocol based on the discrete logarithm problem. Select the statements that accurately reflect the properties and challenges of implementing such a protocol:",
        "choices": [
            "A: The discrete logarithm problem is considered computationally easy, making it a poor choice for secure protocols.",
            "B: A one-way function like that used in the discrete logarithm problem is analogous to mixing colors, which suggests that reversing the process is practically impossible.",
            "C: Efficient algorithms are known to solve for 'x' in the equation \\(f(x) = g^x \\pmod{p}\\), which compromises the security of the discrete logarithm problem.",
            "D: The hardness of the discrete logarithm problem underpins the security of the Diffie-Hellman key exchange protocol."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DiscreteLogarithm"
    },
    {
        "id": "4032e4d4-c876-47a5-9b78-ee2049bc871e",
        "source": "apple_platform_security",
        "question": "You are configuring an enterprise BYOD program that will include iOS devices. You need to ensure secure data syncing between the devices and the enterprise servers while considering the user experience and privacy. According to iOS and iPadOS's pairing model, under what conditions will services that require pairing be able to start on the devices?",
        "choices": [
            "A: Services requiring pairing can be started as long as the device is connected to a trusted host, regardless of whether the device is unlocked.",
            "B: Services requiring pairing cannot start until the device has been unlocked by the user at least once.",
            "C: Services requiring pairing will not start unless the device has been recently unlocked, implying a time-based condition.",
            "D: Services requiring pairing may start automatically upon connection to a host without any user intervention."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "pairing"
    },
    {
        "id": "fca502ab-a566-4f7a-89b7-d45e951502e0",
        "source": "windows_security",
        "question": "In the context of Windows security, enabling the 'Audit Process Termination' policy can have several implications for system monitoring and performance. Which of the following are potential advantages and disadvantages of enabling this policy?",
        "choices": [
            "A: It can help in forensic analysis by providing evidence of process termination events.",
            "B: It can potentially lead to performance degradation due to the logging of numerous events.",
            "C: It ensures that terminated processes are automatically restarted.",
            "D: It can prevent users from terminating any processes without administrative privileges."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Audit Process Termination"
    },
    {
        "id": "0e616afd-3284-4d08-af2f-14a638db1336",
        "source": "owasp_mastg",
        "question": "You are tasked with enhancing the security of a mobile application by making reverse engineering more difficult. To achieve this, you decide to implement obfuscation techniques. Which of the following techniques would be most effective for obfuscating the string literals that contain sensitive information such as API keys and database credentials?",
        "choices": [
            "A: Name Obfuscation",
            "B: Instruction Substitution",
            "C: String Encryption",
            "D: Control Flow Flattening"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Obfuscation"
    },
    {
        "id": "dac4ab1b-de47-4192-838e-7bcff76c6d19",
        "source": "attck",
        "question": "An organization's cybersecurity team has implemented multiple security measures to prevent masquerading attacks where attackers may disguise malicious artifacts as legitimate files. Which of the following measures would be most effective in identifying and preventing the execution of potentially malicious files that employ masquerading techniques?",
        "choices": [
            "A: Implement strict network access controls to restrict data flow.",
            "B: Require binaries to be signed with a trusted certificate.",
            "C: Increase the verbosity of system logging and monitoring.",
            "D: Provide cybersecurity awareness training focusing on phishing emails."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Code Signing"
    },
    {
        "id": "6da9d669-5654-4d82-9b42-15d8e18d3701",
        "source": "android_sec_doc",
        "question": "In the context of the Android Fingerprint HIDL, suppose an alternative design was proposed where the raw fingerprint data and derivatives are processed outside the Trusted Execution Environment (TEE) and then sent back to the TEE for final verification. What would be the potential drawbacks of this design change?",
        "choices": [
            "A: This approach could enhance the performance of fingerprint matching due to reduced processing within the TEE.",
            "B: It would increase the risk of fingerprint data being intercepted or tampered with, as it would be processed in a less secure environment.",
            "C: The change could simplify the development of vendor-specific libraries by reducing dependency on the TEE.",
            "D: It would allow for a more flexible SELinux policy configuration since the data would be processed outside of the TEE."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "TEE"
    },
    {
        "id": "996638ad-eeef-48ee-81bc-ca03616b344f",
        "source": "owasp_mastg",
        "question": "Consider a mobile application that uses a token-based authentication system. The application passes a token with client-side claims, including 'isAdmin', in each HTTP request to authenticate users. Which of the following measures could effectively prevent an unauthorized user from tampering with this token to gain administrative privileges?",
        "choices": [
            "A: Storing the 'isAdmin' flag in a server-side session state.",
            "B: Adding cryptographic signatures to the token.",
            "C: Using a random session ID that does not contain any user data.",
            "D: Enforcing additional authentication factors on the client side."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Cryptographic Signatures"
    },
    {
        "id": "cc5410ee-4b25-4205-a81b-73f8dc93c05f",
        "source": "windows_security",
        "question": "An IT consultant advises a client that enabling Windows Hello for Business is unnecessary since the client already uses complex passwords. As a security expert, which of the following reasons would you provide to counter this claim? (Select TWO.)",
        "choices": [
            "A: Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices.",
            "B: Complex passwords prevent all forms of unauthorized access, making additional security measures redundant.",
            "C: Windows Hello for Business can increase user productivity by reducing password reset requests.",
            "D: Passwords are sufficient for data encryption, and no further authentication methods are needed."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Windows Hello for Business"
    },
    {
        "id": "e23d21db-5f7e-4bfe-b668-cf03722a22c6",
        "source": "apple_platform_security",
        "question": "Considering the security features of iOS and iPadOS for BYOD programmes, such as user enrolment and the pairing model, what are the potential benefits and limitations of these measures in ensuring both corporate data security and user privacy?",
        "choices": [
            "A: Benefits include a balance between user privacy and data security; limitations include the potential for increased user oversight.",
            "B: Benefits include remote wipe capabilities for personal devices; limitations include a complex setup process for user enrolment.",
            "C: Benefits include the enforcement of configuration profiles without user interaction; limitations include potential resistance from employees.",
            "D: Benefits include a trust relationship established through public key exchange; limitations include the necessity of device unlocking by the user for certain services to start."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "BYOD-Security"
    },
    {
        "id": "7923eb03-1ffa-49b0-b452-54a4fd2d78ea",
        "source": "cwe",
        "question": "You are designing a web application that customizes error messages. To prevent potential cross-site scripting (XSS) attacks through these custom error pages, which of the following strategies should be implemented? Select all that apply.",
        "choices": [
            "A: Stripping all HTML tags from user inputs before displaying them on error pages.",
            "B: Setting the session cookie to be HttpOnly to protect against XSS attacks.",
            "C: Validating and encoding all parts of the HTTP request, including headers and cookies.",
            "D: Using client-side JavaScript to sanitize input on the error page before rendering it."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "XSS"
    },
    {
        "id": "9fb580d7-9d6d-41c1-a2aa-fa02accd11b0",
        "source": "attck",
        "question": "An organization has discovered that an adversary has been using their cloud resources to mine cryptocurrency in a service region that the organization does not actively use. Which of the following actions could effectively mitigate this issue without unnecessarily impacting the organization's legitimate operations?",
        "choices": [
            "A: Implement strict access controls on all instances, regardless of the region, to prevent unauthorized use.",
            "B: Mandate the use of only those regions that support the most advanced detection services for all future deployments.",
            "C: Deactivate unused cloud regions if the cloud service provider allows this configuration to prevent misuse.",
            "D: Increase surveillance of physical data centers corresponding to unused regions to prevent unauthorized access."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Resource Hijacking"
    },
    {
        "id": "92453f4a-d1a4-4d72-94d0-bede5ea7acd4",
        "source": "owasp_wstg",
        "question": "You are examining a web application for security vulnerabilities and observe that when invalid input is provided, the application returns detailed stack traces that include information about the underlying framework and version numbers. What security risks does this behavior most accurately represent?",
        "choices": [
            "A: It aids in creating a more user-friendly experience by providing detailed errors for troubleshooting.",
            "B: It allows attackers to understand the APIs and frameworks being used, potentially facilitating targeted attacks.",
            "C: It ensures that developers have easier access to debug information during production.",
            "D: It enhances system performance by preventing unnecessary logging of generic error messages."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Error Handling"
    },
    {
        "id": "9c6104db-42c2-4f77-9a3b-e8473c0a998b",
        "source": "cwe",
        "question": "A development team is assessing programming languages for their new software project. To mitigate the risk of memory management vulnerabilities such as use-after-free, which language feature should they prioritize during their selection process?",
        "choices": [
            "A: Languages that offer manual memory management to give programmers full control over memory allocation and deallocation.",
            "B: Languages that provide automatic memory management to avoid manual errors in memory allocation and deallocation.",
            "C: Languages that support multiple inheritance to enhance object-oriented design and reusability.",
            "D: Languages that offer extensive standard libraries to reduce the need for custom code."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "MemoryManagement"
    },
    {
        "id": "3dd06430-92b0-4b73-825a-c70c743050c1",
        "source": "attck",
        "question": "An adversary has engaged in financial theft by compromising a company's accounts and conducting unauthorized transactions. Beyond the immediate monetary loss, why might an adversary engage in financial theft according to the ATT&CK framework?",
        "choices": [
            "A: To create a distraction that diverts attention from other goals such as data destruction or business disruption.",
            "B: To enhance the company's public image by demonstrating the need for improved cybersecurity.",
            "C: To provide a public service by revealing vulnerabilities in the company's financial infrastructure.",
            "D: To assist law enforcement in testing the company’s incident response procedures."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Impact Type: Availability"
    },
    {
        "id": "5fdb6e82-4a63-4ad1-9df1-60e8b9bccbb0",
        "source": "cwe",
        "question": "A web application allows administrators to trigger backup operations of a database by invoking a batch file via a command constructed with user-provided input. The following code snippet demonstrates the vulnerability:\n\njava\nString backupType = request.getParameter(\"backupType\");\nRuntime.getRuntime().exec(\"cmd /C start backup.bat \" + backupType);\n\n\nWhich of the following changes would effectively mitigate the risk of command injection in the above code? Select all that apply.",
        "choices": [
            "A: Validate the `backupType` parameter against a set list of permitted backup operations before using it in the command.",
            "B: Use parameterized queries when constructing the command to separate the code from the data.",
            "C: Configure the server to run the backup operation with the least privileges required.",
            "D: Encrypt the `backupType` parameter to prevent tampering before appending it to the command."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategy"
    },
    {
        "id": "fd2f46bb-f69a-4e5d-bc26-d62c67b00c29",
        "source": "apple_platform_security",
        "question": "In the context of macOS security improvements, which of the following practices have been implemented to enhance system security and stability?",
        "choices": [
            "A: Introduction of User-Approved Kernel Extension Loading in macOS 10.13 to require user consent for loading new kernel extensions.",
            "B: Execution of Option ROMs at the maximum CPU privilege level in macOS 10.15 to ensure compatibility with third-party hardware.",
            "C: Sandboxing of Option ROMs in macOS 10.15 to run them at a lower CPU privilege level and restrict their capabilities.",
            "D: Allowing all previously approved kernel extensions to be automatically reloaded without user or administrator approval in macOS 10.13 or later."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "macOS"
    },
    {
        "id": "4dffab17-7b53-4bd7-b61d-259c0ac1f8e1",
        "source": "apple_platform_security",
        "question": "An organization is planning to use Apple Configurator for Mac to manage a fleet of devices. As an IT administrator, you are tasked with understanding the security implications and capabilities of using Apple Configurator. Which of the following statements are accurate concerning the security features and processes associated with Apple Configurator and the related technologies mentioned in the text?",
        "choices": [
            "A: Apple Configurator for Mac can revive or restore Mac computers with Apple silicon or those with the T2 Security Chip by downloading the necessary files from Apple servers.",
            "B: The UID used in the tangling process can be read by firmware or software and is related to the device's UDID.",
            "C: Apple Configurator can add devices to Apple School Manager or Apple Business Manager even if the devices were not purchased directly from Apple or an authorised reseller.",
            "D: XProtect is a technology in iOS that facilitates the sandboxing of applications to prevent malware infection."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AppleConfigurator"
    },
    {
        "id": "4bb7c6cc-ae21-4c44-9269-0f31f207254b",
        "source": "attck",
        "question": "A company has recently been targeted by content injection attacks where adversaries manipulated online network traffic to inject malicious content. The company is reviewing its mitigation strategies and considering the implementation of SSL/TLS inspection to prevent similar future attacks. Which of the following is a valid counterargument to the exclusive reliance on SSL/TLS inspection as a mitigation strategy?",
        "choices": [
            "A: SSL/TLS inspection does not prevent adversaries from exploiting physical access to the network.",
            "B: SSL/TLS inspection may not detect all types of malicious payloads and obfuscated content.",
            "C: SSL/TLS inspection can cause significant network latency and performance degradation.",
            "D: SSL/TLS inspection can be bypassed by adversaries using port knocking techniques."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "SSL/TLS Inspection"
    },
    {
        "id": "ec99f5aa-7ff4-4416-8c6b-324b8b03a733",
        "source": "cwe",
        "question": "Consider a scenario where an online shopping platform's server code contains a while-loop that creates a new user session for each iteration based on incoming requests without an upper limit. If an attacker sends a high volume of requests to trigger this loop, which of the following outcomes are likely?",
        "choices": [
            "A: The server may run out of memory, leading to a denial of service.",
            "B: The loop may improve system performance by efficiently handling multiple requests.",
            "C: Too many user sessions may lead to file descriptor exhaustion, causing service disruption.",
            "D: The attacker's IP address will be automatically blacklisted, preventing the attack."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ResourceConsumption"
    },
    {
        "id": "8014a5fd-6810-4bf8-94d3-47b45734c22e",
        "source": "android_sec_doc",
        "question": "An Android device running version 5.0 is being encrypted for the first time. What occurs during this encryption process?",
        "choices": [
            "A: A 256-bit master key is created and hashed with the user's password and stored salt.",
            "B: The system uses `vold.decrypt = \"trigger_restart_min_framework\"` to bring up a minimal framework to show encryption progress.",
            "C: The `vold` service uses the `YAFFS` filesystem to encrypt the user data partition.",
            "D: The encryption algorithm used is 128-bit AES with Electronic Codebook (ECB) and ESSIV:SHA512."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "full-disk encryption"
    },
    {
        "id": "1029347f-7ce8-473b-97b7-b45020caf68c",
        "source": "attck",
        "question": "An organization is facing a sophisticated cyber attack where the adversary is employing data destruction techniques that include overwriting files with randomly generated data and politically oriented images to make them irrecoverable. As a cybersecurity consultant, you are tasked with recommending strategies to mitigate the impact of such attacks and to detect any ongoing data destruction activities. Which of the following would be effective in mitigating the impact and detecting the activities of this data destruction campaign?",
        "choices": [
            "A: Implement regular data backups that are stored off-system and protected from adversary access.",
            "B: Monitor for an unusually high quantity of data deletion or modification events in user directories and system files.",
            "C: Increase the complexity of file system permissions to prevent unauthorized deletion or modification of files.",
            "D: Disable command-line tools such as `del` and `rm` to prevent adversaries from deleting files."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Data Destruction Mitigation"
    },
    {
        "id": "f7483ada-2916-443d-901d-f498adcf737d",
        "source": "android_sec_doc",
        "question": "Which of the following options does NOT directly contribute to strengthening the security of the Android kernel?",
        "choices": [
            "A: Implementing a user-based permissions model",
            "B: Enabling storage encryption on the device",
            "C: Removing unnecessary parts of the kernel",
            "D: Applying access control policies with SELinux"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Kernel Security"
    },
    {
        "id": "c90e1f2d-32bd-4859-8765-bb748454808b",
        "source": "windows_security",
        "question": "An administrator reviews the system logs and notices that a particular Windows Firewall rule was not applied as expected. Which of the following security events might the administrator look for in the Windows Event Viewer to identify this issue, and what could be potential reasons for this occurrence?",
        "choices": [
            "A: Event 4957(F) - The rule might be corrupted or contain properties that the firewall cannot process.",
            "B: Event 4011(B) - The rule was applied to a different network profile than the one currently active.",
            "C: Event 2002(E) - The firewall service is not running, hence rules cannot be applied.",
            "D: Event 7016(C) - There is a conflict with another rule that has higher priority."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Windows Firewall"
    },
    {
        "id": "bb5ac0b2-b3d2-4024-a045-403fc90cd9cc",
        "source": "owasp_mastg",
        "question": "You are developing a mobile health application that will handle sensitive user data, including identification and health information. According to European privacy legislation, what should you primarily consider to ensure user privacy protection?",
        "choices": [
            "A: Implementing Privacy-by-Design and the Principle of Least Privilege.",
            "B: Only collecting user data that is publicly available to avoid privacy breaches.",
            "C: Avoiding data encryption to ensure data is always available for user requests.",
            "D: Focusing exclusively on the classic triad of security protection goals: confidentiality, integrity, and availability."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Privacy-by-Design"
    },
    {
        "id": "a26c27f2-33a6-43d6-b3a2-b12443d05ee3",
        "source": "attck",
        "question": "A security analyst observes an unusual spike in outbound network traffic on a corporate network. This traffic is characterized by a constant stream of data packets being sent to an external IP address that is not recognized as part of the company's regular traffic patterns. Upon further investigation, the analyst discovers that a process associated with a recent collection of sensitive documents is responsible for this traffic. What detection strategy should the analyst employ to identify the potential automated exfiltration of data?",
        "choices": [
            "A: Monitor for changes in file access patterns, particularly for sensitive documents, to identify automated processing after collection.",
            "B: Implement script execution monitoring to identify suspicious scripts running out of cycle from patching or other administrator functions.",
            "C: Review executed commands and arguments that may indicate data exfiltration through automated processing after collection.",
            "D: Analyze email traffic logs for phishing attempts that could initiate the exfiltration process."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Automated Exfiltration"
    },
    {
        "id": "131911cc-2e67-43d8-b3ec-0dc333b7038b",
        "source": "attck",
        "question": "A cybersecurity team has recently identified a suspicious activity pattern indicating an adversary is potentially staging an attack. Given the following actions, identify which would NOT typically be considered as adversaries staging capabilities:",
        "choices": [
            "A: Staging web resources for spearphishing attacks.",
            "B: Installing software updates to improve security on their own infrastructure.",
            "C: Uploading malicious tools to a compromised server.",
            "D: Setting up phishing sites for drive-by compromise."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Staging Capabilities"
    },
    {
        "id": "dd43f00b-919e-4629-8702-339e2097cafd",
        "source": "owasp_mastg",
        "question": "In a mobile application security testing process, the testing team is engaged in analyzing the app's environment and architecture, gathering information to create a contextual understanding of the app. Which phase of the security testing does this activity most accurately describe?",
        "choices": [
            "A: Exploitation",
            "B: Intelligence Gathering",
            "C: Reporting",
            "D: Mapping the Application"
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Penetration Testing Phases"
    },
    {
        "id": "1635d76c-d487-4c43-8c8e-739fef98cd72",
        "source": "cs161_textbook",
        "question": "A web application uses GET requests with query parameters to perform actions that change the server's state, such as updating user preferences. What could be the security implications of this approach?",
        "choices": [
            "A: Sensitive data such as preferences may get exposed in server logs.",
            "B: GET requests can't have a body, which reduces the amount of data that can be sent.",
            "C: GET requests to update preferences might be less efficient than using POST requests.",
            "D: The approach violates the principle that GET requests should not change server state and may lead to unintended side effects."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SecurityImplications"
    },
    {
        "id": "6c12ff70-c078-4105-ae61-d64b18152fea",
        "source": "apple_platform_security",
        "question": "Bob is using Handoff to work seamlessly between his iPad and Mac. He is also concerned about the security of the data being transferred during the Handoff process. Identify the statements that accurately describe the security and functionality of Handoff as it pertains to Bob's concerns:",
        "choices": [
            "A: Bob's devices use Bluetooth Low Energy (BLE) 4.2 pairing out-of-band using APNs to establish a secure connection for Handoff, with individual messages encrypted similarly to iMessage.",
            "B: Bob's devices transfer activity payloads using Handoff without any form of encryption, relying on the inherent security of the BLE connection.",
            "C: When Bob handoffs user activity from a native app to a website, the system requires the app to demonstrate control over the web domains it wants to resume to prevent fraudulent claims.",
            "D: If Bob's receiving device does not have the native app installed for Handoff, the system will not provide any fallback URL; the feature simply fails to execute."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Handoff"
    },
    {
        "id": "c55a6ee8-5ce8-4f1a-bff3-992c2dd30d89",
        "source": "apple_platform_security",
        "question": "An IT security manager is evaluating the security settings for a fleet of Apple devices within the organization, which includes iOS, iPadOS, and macOS devices. The manager aims to enhance the security against brute-force attacks. Which of the following settings should the manager consider implementing? (Select all that apply)",
        "choices": [
            "A: Enable the Erase Data option after 10 consecutive incorrect passcode attempts on iOS and iPadOS devices.",
            "B: Set a policy to allow no more than 5 password attempts at the Login Window on macOS devices.",
            "C: Disable the Data Protection feature on iOS devices to prevent encryption key exposure.",
            "D: Implement escalating time delays after invalid passcode entries on iOS, iPadOS, and macOS devices."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "BruteForceProtection"
    },
    {
        "id": "a762a0e4-cc31-4f47-88e6-2314ad867e1a",
        "source": "apple_platform_security",
        "question": "Which of the following statements are true regarding Single sign-on (SSO) support across Apple's iOS, iPadOS, and macOS platforms?",
        "choices": [
            "A: SSO on iOS and iPadOS can be used for secure Safari sessions and is based on the Heimdal project.",
            "B: macOS does not support Kerberos-based authentication for services and requires a proprietary protocol for SSO.",
            "C: Both iOS, iPadOS and macOS use SPNEGO tokens and the HTTP Negotiate protocol to work with Kerberos-based authentication gateways.",
            "D: SSO on Apple platforms only supports certificate-based authentication and does not integrate with Kerberos-based networks."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "SSO"
    },
    {
        "id": "c5b74dba-8274-44b1-b642-d7f3847611f2",
        "source": "windows_security",
        "question": "In reviewing the security logs of a Windows system, you come across several entries pertaining to the use of user rights. Match the event IDs with their correct descriptions based on standard Windows audit policies.",
        "choices": [
            "A: Event ID 576: Privileges were used on an already open handle to a protected object.",
            "B: Event ID 577: A user attempted to perform a privileged system service operation.",
            "C: Event ID 578: Specified privileges were added to a user's access token upon login.",
            "D: Event ID 577: Specified privileges were added to a user's access token upon login."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Log Events"
    },
    {
        "id": "0ea86fdb-a3e1-48b6-850b-2526c1eda150",
        "source": "attck",
        "question": "An organization's internal review has identified that their information repositories, including Confluence and SharePoint, contain sensitive data such as network diagrams and source code snippets. As a security analyst, which of the following measures should be prioritized to mitigate the risk of adversaries accessing this sensitive information? Select two.",
        "choices": [
            "A: Implement a periodic review of accounts and privileges for critical and sensitive repositories.",
            "B: Restrict physical access to server rooms where information repositories are hosted.",
            "C: Enforce the principle of least-privilege and access control mechanisms.",
            "D: Mandate the use of strong, complex passwords for all user accounts, regardless of their access level."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Least-Privilege"
    },
    {
        "id": "e77d25b3-692f-484f-b0ec-43466e098af2",
        "source": "windows_security",
        "question": "In the context of Windows security event monitoring, a baseline subscription for event logs is designed to provide a comprehensive view of system activities that could indicate security threats. Which of the following events would be most valuable to include in a baseline subscription to maximize its effectiveness for detecting potential intrusions or system misuse?",
        "choices": [
            "A: Security event log Process Create events.",
            "B: Event log service start and stop events unrelated to Windows Event Log service.",
            "C: Sign-in success for services for built-in accounts, such as LocalSystem, LocalNetwork.",
            "D: User profile events indicating use of a temporary profile or inability to create a user profile."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Event Log Subscription"
    },
    {
        "id": "a5e47333-0764-4720-ad0b-5ca0a6f14afe",
        "source": "apple_platform_security",
        "question": "Your organization adheres to strict security policies and is considering the deployment of Apple devices. In a meeting with the IT security team, you discuss how the security technology and features of Apple platforms can be integrated with your existing policies to achieve enhanced security. Which aspects of Apple platform security should you consider aligning with your organization's security policies?",
        "choices": [
            "A: Secure boot and ongoing operation of Apple operating systems",
            "B: Open-source cryptographic engines for custom security solutions",
            "C: Integration of third-party silicon to supplement Apple-designed chips",
            "D: Encouraging users to enable security features manually for a personalized setup"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security Policy Alignment"
    },
    {
        "id": "d04060e2-c776-4cab-8678-5d4a0f36ecb9",
        "source": "mozilla_security",
        "question": "A developer is configuring a Content-Security-Policy header for a new web application. The application does not require any plugins like Flash or Silverlight, and it does not have any JSONP endpoints. The developer wants to ensure that resources are loaded over HTTPS and that inline scripts are disabled. Which CSP directive would best fit these requirements?",
        "choices": [
            "A: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'",
            "B: default-src https:; img-src https:; script-src https:; style-src https:; object-src 'self'",
            "C: default-src https: 'unsafe-inline'; script-src 'self'; img-src 'self'; object-src 'self'",
            "D: default-src 'self'; script-src 'self'; object-src 'self'; base-uri 'self'"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Content-Security-Policy"
    },
    {
        "id": "648a1490-2851-4e8f-bcb0-80c840a3e53f",
        "source": "android_sec_doc",
        "question": "An Android application is attempting to begin a cryptographic operation using a key with specific authorizations. The key has Tag::PURPOSE set to KeyPurpose::SIGN and contains a Tag::ORIGINATION_EXPIRE_DATETIME. The current date and time are later than the value of Tag::ORIGINATION_EXPIRE_DATETIME. What will be the result of calling the `begin` method for a cryptographic operation with this key?",
        "choices": [
            "A: The method will return ErrorCode::UNSUPPORTED_PURPOSE because the Tag::PURPOSE does not match the operation.",
            "B: The method will return ErrorCode::KEY_EXPIRED because the current date and time are later than the Tag::ORIGINATION_EXPIRE_DATETIME.",
            "C: The method will begin the operation successfully as Tag::ORIGINATION_EXPIRE_DATETIME is not enforced for KeyPurpose::SIGN.",
            "D: The method will return ErrorCode::KEY_RATE_LIMIT_EXCEEDED as the date and time check indicates excessive use of the key."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Keymaster"
    },
    {
        "id": "6854dc46-a644-4948-ab52-870c6926b5df",
        "source": "owasp_wstg",
        "question": "A web application has implemented a self-service password reset feature that sends a password reset link to the user's registered email address. To ensure this feature is secure against potential account compromise, which of the following measures should be applied? (Select TWO.)",
        "choices": [
            "A: The reset link should expire after a single use or within a short time frame.",
            "B: The application should display the user's password in plain text in the reset email for verification purposes.",
            "C: The user should be required to answer multiple security questions accurately before a reset link is sent.",
            "D: The reset link should lead the user to a page where they can view the last five passwords and choose a new one."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Password Reset Security"
    },
    {
        "id": "b4237c97-fd91-4955-a182-572f04ef0b73",
        "source": "cs161_textbook",
        "question": "Consider the following code snippet from a network service program written in C:\n\n    void network_service() {\n        unsigned int size;\n        char *buffer;\n\n        size = receive_size_from_client();\n        if (size > 1024) {\n            reject_request();\n            return;\n        }\n        buffer = (char *)malloc(size + 1);\n        receive_data_from_client(buffer, size);\n        buffer[size] = '\\0';\n        // ... process the buffer ...\n    }\n\nWhich of the following statements are true regarding potential vulnerabilities in this code?",
        "choices": [
            "A: The conditional check ensures that the size variable cannot cause a buffer overflow when writing to the buffer.",
            "B: An integer overflow could occur if the size provided by the client is close to the maximum value representable by an unsigned int, leading to a smaller than expected allocation.",
            "C: The use of malloc to allocate memory for the buffer is safe as it adds 1 to the size, ensuring there is space for the null terminator.",
            "D: The code is secure against memory safety vulnerabilities because it checks the size of the input before processing."
        ],
        "answer": "BC",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "Integer Overflow"
    },
    {
        "id": "f543bef0-88ad-458f-8ca4-72b082c068e0",
        "source": "owasp_mastg",
        "question": "When implementing cryptographic functions in an iOS application, a developer must choose secure algorithms to ensure data integrity and confidentiality. Given the following scenarios, select the most secure implementations using Apple's cryptographic libraries:",
        "choices": [
            "A: Using MD5 for hashing sensitive data before storage.",
            "B: Employing AES-GCM for authenticated encryption of data in transit.",
            "C: Implementing Curve25519 for key agreement in a messaging application.",
            "D: Utilizing SHA1 for generating digital signatures."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Apple CryptoKit"
    },
    {
        "id": "3fc32e2f-feaa-4429-ad89-1945f6c80da5",
        "source": "cs161_textbook",
        "question": "Consider a web application where a user can search for articles, sort the results, submit new articles, and update their profile settings. Select the scenarios where a POST request would be more appropriate than a GET request:",
        "choices": [
            "A: Submitting a user's comment to an article.",
            "B: Requesting a list of articles sorted by date.",
            "C: Updating the email address associated with the user's profile.",
            "D: Searching for articles that contain the word 'security'."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP"
    },
    {
        "id": "62d85d4e-63d5-480e-a7eb-85252919e0a7",
        "source": "windows_security",
        "question": "A security administrator needs to convert an Enhanced Mitigation Experience Toolkit (EMET) XML settings file into Windows 10 mitigation policies. They intend to apply these settings to the system. Which of the following actions should the administrator take to achieve this using PowerShell cmdlets?",
        "choices": [
            "A: Run ConvertTo-ProcessMitigationPolicy with the EMET XML file and then use Set-ProcessMitigation to apply the settings from the generated file.",
            "B: Use the UpdateProcThreadAttribute function to directly apply EMET XML settings to Windows 10.",
            "C: Employ the Get-ProcessMitigation cmdlet to import EMET XML settings and automatically convert them to Windows 10 policies.",
            "D: Invoke the SetProcessMitigationPolicy function to parse and apply EMET XML settings to Windows 10."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ConvertTo-ProcessMitigationPolicy"
    },
    {
        "id": "2a973503-706f-480e-8c2b-0951deffe733",
        "source": "attck",
        "question": "An IT security analyst is reviewing reported incidents and has identified a pattern of compromised systems within the organization. Upon further investigation, it is found that the systems were compromised via drive-by attacks. Which of the following methods could have been used by the adversaries to deliver exploit code to the users' browsers? (Select TWO.)",
        "choices": [
            "A: Injecting malicious JavaScript into digital image metadata hosted on a compromised website.",
            "B: Modifying script files served from a publicly writeable cloud storage bucket to a legitimate website.",
            "C: Serving malicious ads through legitimate ad providers.",
            "D: Exploiting vulnerabilities in a server's database engine from a remote location without user interaction."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Drive-by Compromise"
    },
    {
        "id": "3125078d-9971-4bda-8e46-2f55a4c4668a",
        "source": "cs161_textbook",
        "question": "Consider the following pseudo x86 assembly code sequence:\n\nmov eax, 5\npush eax\npop ebx\n\nAfter the execution of this code sequence, what statements are correct regarding the stack and the registers?",
        "choices": [
            "A: The value 5 is removed from the stack and the esp register is incremented.",
            "B: The esp register points to the bottom of the stack, and the value below esp is undefined.",
            "C: The value 5 is still accessible in the stack because it is not wiped from memory after the pop instruction.",
            "D: The value in the ebx register is undefined because the pop instruction does not copy values into registers."
        ],
        "answer": "AB",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "Stack"
    },
    {
        "id": "0c9d06eb-cdb8-4066-a35a-0d05bde189a5",
        "source": "cwe",
        "question": "You are reviewing the security design of an upcoming System-on-Chip (SoC) product that features a secure boot process. The design includes a mechanism that uses hardware fuses for in-field patching of ROM code vulnerabilities. What is a potential limitation of this approach that you should consider in your analysis?",
        "choices": [
            "A: The hardware fuses may introduce additional vulnerabilities during the manufacturing process that can be exploited once the product is deployed.",
            "B: Patches applied through hardware fuses might have restrictions in terms of size and the number of patches that can be supported.",
            "C: The use of hardware fuses for patching could significantly increase the boot time of the SoC, leading to performance degradation.",
            "D: Implementing hardware fuses can cause compatibility issues with certain types of memory used in the SoC, limiting the device's market applicability."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Hardware-Fuses-Limitation"
    },
    {
        "id": "ffe96b08-6e55-4564-8eda-d1fa4e62ce79",
        "source": "attck",
        "question": "A cybersecurity analyst is evaluating the effectiveness of implementing network intrusion prevention systems to mitigate the risk of adversaries using data encoding for command and control activities. Which of the following statements accurately reflects the potential impact of this mitigation technique?",
        "choices": [
            "A: Network intrusion prevention systems may utilize signatures to identify traffic for specific malware, but adversaries can change C2 signatures over time to avoid detection.",
            "B: The implementation of network intrusion prevention systems will completely eliminate the risk posed by data encoding in command and control activities.",
            "C: Using network intrusion prevention systems is unnecessary if the organization employs application whitelisting as it will block any encoded traffic by default.",
            "D: Network intrusion prevention systems will increase the risk of false positives, making it more difficult to detect legitimate traffic than encoded C2 traffic."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Intrusion Prevention Systems"
    },
    {
        "id": "35282d04-f5b4-4ef4-810f-c1b45dd6b784",
        "source": "apple_platform_security",
        "question": "A cybersecurity architect is evaluating the security design of a new computing device's peripheral processors. Based on best practices for secure firmware management, which of the following measures should the architect recommend to enhance the security of the device's peripheral processors?",
        "choices": [
            "A: Peripheral processors should download and verify firmware from the primary CPU on startup.",
            "B: Peripheral processors should allow debug interfaces to remain enabled for maintenance purposes.",
            "C: Peripheral processors should implement a secure boot chain to verify firmware upon device start.",
            "D: Peripheral processors should accept firmware updates that are not cryptographically signed."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Firmware"
    },
    {
        "id": "0b7d0f1b-532d-4248-bbce-126f2f6b0049",
        "source": "attck",
        "question": "An organization is concerned about adversaries using removable media to conduct command and control operations between an Internet-connected system and an air-gapped system within their network. As a cybersecurity consultant, which of the following mitigations would you recommend to reduce the risk of such an attack? (Select two)",
        "choices": [
            "A: Disable Autorun features on all systems within the organization.",
            "B: Increase the frequency of full system antivirus scans to detect malicious files.",
            "C: Restrict the use of removable media through organizational policy if not required for operations.",
            "D: Implement full-disk encryption on all removable media used within the organization."
        ],
        "answer": "AC",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Command and Control"
    },
    {
        "id": "26f1233f-6f46-4a8b-98ba-c1116634fd97",
        "source": "apple_platform_security",
        "question": "Which of the following methods are not employed by Apple Wallet to protect user privacy and security?",
        "choices": [
            "A: User activity related to key usage in Apple Wallet is shared with Apple and stored on their servers.",
            "B: Access keys are securely stored inside the Secure Element of supported devices.",
            "C: During access key provisioning, a secure channel is established between the reader and the Secure Element.",
            "D: For privacy, Apple supplies partners with anonymised device identifiers that are different for every partner."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Privacy"
    },
    {
        "id": "f061c39e-a595-4742-aabf-2267d0741000",
        "source": "windows_security",
        "question": "A company is planning to deploy Windows Hello for Business utilizing a hybrid key trust model. As a security administrator, you are tasked with configuring and validating the Public Key Infrastructure to support this deployment. Which of the following Windows versions would you ensure compatibility with?",
        "choices": [
            "A: Windows 11, Windows 10, Windows Server 2022, Windows Server 2019, and Windows Server 2016",
            "B: Windows 8.1, Windows 10, Windows Server 2012, and Windows Server 2016",
            "C: Windows 10, Windows Server 2008, and Windows Server 2012 R2",
            "D: Windows 7, Windows 8, Windows Server 2008 R2, and Windows Server 2012"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Public Key Infrastructure"
    },
    {
        "id": "7c46ed77-1416-43fb-a433-c9506cc6bcc2",
        "source": "cwe",
        "question": "In the context of software design, it is considered a poor practice to use the same control element across multiple architectural layers due to the potential introduction of vulnerabilities. Based on this principle, which of the following scenarios would NOT indicate the use of the same invokable control element in multiple architectural layers?",
        "choices": [
            "A: A web application uses a single authentication function that is called both by the presentation layer when users log in and by the data access layer to verify user permissions for database operations.",
            "B: A service-oriented architecture deploys a user input validation module that is exclusively used within the presentation layer to sanitize incoming data before it is processed by business logic.",
            "C: An enterprise application framework utilizes the same logging mechanism for recording errors in the business logic layer and in the data access layer.",
            "D: An embedded system firmware uses a common interrupt handler to manage both user interface events and internal hardware events."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Architectural"
    },
    {
        "id": "045b9ca3-4c09-41af-b8a7-16f88edfc59e",
        "source": "owasp_wstg",
        "question": "A web application developer is reviewing their codebase to mitigate potential DOM-based XSS vulnerabilities. Which of the following measures should the developer implement to effectively prevent DOM-based XSS attacks?",
        "choices": [
            "A: Store all user-generated content on the server-side in a database without any sanitation.",
            "B: Use document.write() to dynamically generate content based on URL parameters without encoding.",
            "C: Apply context-sensitive encoding and use safe JavaScript APIs that treat user input as data, not code.",
            "D: Disable JavaScript entirely on the website to prevent the possibility of script execution."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DOM-based XSS Prevention"
    },
    {
        "id": "2a4d9aa2-2a8e-499b-848b-bf2a53faef93",
        "source": "attck",
        "question": "An organization's security policy is under review, and the use of system management tools like Windows Management Instrumentation (WMI) and PowerShell is being evaluated. What is a security concern associated with allowing unrestricted use of such tools within the organization's network?",
        "choices": [
            "A: They can be repurposed by adversaries to gather and stage data for exfiltration.",
            "B: They exclusively increase the computational overhead on system resources.",
            "C: Their use can only be associated with benign administrative tasks and poses no security risk.",
            "D: They are outdated tools that do not support modern security protocols."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "System Management Tools"
    },
    {
        "id": "9c537a97-d14f-4457-af1b-c5e9de749380",
        "source": "apple_platform_security",
        "question": "A cybersecurity analyst is tasked with evaluating the security features of various Apple devices to determine if they can support the necessary Bluetooth security measures. Given that the organization uses devices no older than iPhone 6 and Mac Late 2015 models, which of the following statements are accurate regarding the security features these devices can support?",
        "choices": [
            "A: All devices support Secure Simple Pairing with protection against passive eavesdropping using Elliptic Curve Diffie-Hellman Exchange (ECDHE).",
            "B: Only devices with Bluetooth 4.2 or later can use FIPS-approved algorithms for authentication.",
            "C: Devices running iOS 9 or later, including iPhone 6, can perform AES-CCM cryptography in the Controller.",
            "D: Numeric comparison or passkey entry for protection against man-in-the-middle attacks is exclusive to Bluetooth Classic."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Bluetooth"
    },
    {
        "id": "ca6ae402-157d-435a-bb7d-0092bdf2cd3d",
        "source": "attck",
        "question": "An organization is developing a new intrusion detection system (IDS) to identify potential malware communication. The security team wants to ensure that the IDS can detect obfuscated and encrypted network traffic associated with known malware. Which of the following obfuscation and encryption techniques should the IDS be capable of identifying, based on recent malware behaviors?",
        "choices": [
            "A: Detection of custom base64 alphabet decoding as used by CARROTBALL.",
            "B: Detection of simple XOR with a rotating key encryption as seen in CozyCar.",
            "C: Identification of obfuscation through the use of spaghetti code and a custom XOR algorithm by FinFisher.",
            "D: Recognition of malware using the ROT13 cipher for string obfuscation."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Base64 decoding"
    },
    {
        "id": "6fb2ffd5-2d07-40f3-b32e-982d6ee3f6b3",
        "source": "apple_platform_security",
        "question": "A developer is creating an augmented reality application using ARKit for iOS and iPadOS. The application requires access to the device's cameras and location data to enhance the AR experience. Select the statements that correctly reflect security and privacy considerations that must be taken into account according to Apple's guidelines.",
        "choices": [
            "A: Third-party apps must request and obtain user consent before accessing the camera for AR features.",
            "B: Location data included in photos and videos can be disabled by the user at any time from the device settings.",
            "C: ARKit can use face-tracking information without user consent as it doesn't directly access the camera.",
            "D: Apps can access the camera without any indication to the user that the camera is in use."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "ARKit"
    },
    {
        "id": "60af27f7-e341-4f96-9f7c-6f0f36e19579",
        "source": "apple_platform_security",
        "question": "Apple Wallet's Express Travel feature allows users to access public transport and make payments without requiring authentication such as Face ID, Touch ID, or a passcode. What are the implications of this feature in terms of user convenience and security?",
        "choices": [
            "A: Express Travel enhances user convenience by allowing fast transactions but may expose transaction history to unauthorized card readers with Express Mode enabled.",
            "B: The feature increases security because it requires two-factor authentication for every transaction.",
            "C: Users can disable Express Travel to require Face ID, Touch ID, or a passcode for added security.",
            "D: Express Travel requires users to manually input their payment information each time, thus reducing the risk of unauthorized access."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Express Travel"
    },
    {
        "id": "69e8c7fb-cfd3-49b1-9d09-569652ac363b",
        "source": "apple_platform_security",
        "question": "A user is preparing to switch to a new iPhone and plans to restore from an iCloud Backup. Which of the following data will be included in the iCloud Backup, and which security features apply to the recovery of Messages in iCloud?",
        "choices": [
            "A: Photos and videos will be included in the iCloud Backup if iCloud Photos is turned on.",
            "B: The local device keychain is backed up in iCloud, encrypted with a key derived from the device's Secure Enclave UID root cryptographic key.",
            "C: When iCloud Backup is turned on, Messages in iCloud is end-to-end encrypted and includes a copy of the encryption key in the backup.",
            "D: Device settings are not included in the iCloud Backup as they are considered non-essential."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "iCloud"
    },
    {
        "id": "549d03e0-6fa0-4ad4-a691-0c1aacc4268b",
        "source": "apple_platform_security",
        "question": "In the context of protecting intellectual property within documents, which of the following strategies are commonly employed to enforce copyright and prevent unauthorized use?",
        "choices": [
            "A: Embedding metadata within documents that includes ownership information.",
            "B: Placing documents in a public directory to ensure transparency and traceability.",
            "C: Applying legal disclaimers and usage terms within the document itself.",
            "D: Conducting regular audits of document access logs to identify unauthorized access."
        ],
        "answer": "",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Intellectual Property Protection"
    },
    {
        "id": "123c52f1-ef4e-4168-b626-c5842bb9bf98",
        "source": "cs161_textbook",
        "question": "A developer is implementing input sanitization to prevent XSS attacks on a web application. Examine the following code snippets and select the measures that would effectively prevent XSS attacks. Assume all other security measures are constant and not shown in the examples.",
        "choices": [
            "A: Using a regex pattern to remove instances of `<script>` and `</script>` from user input.",
            "B: Encoding special characters such as `<` and `>` into their respective HTML entities like `&lt;` and `&gt;`.",
            "C: Implementing a whitelist of allowed HTML tags and attributes, and stripping out all others from user input.",
            "D: Applying a library that provides standardized sanitizations known to be robust against various XSS attack vectors."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "XSS"
    },
    {
        "id": "6ca3a918-0944-4256-a23b-96e4181fbc9b",
        "source": "owasp_mastg",
        "question": "A software development team is transitioning to DevSecOps practices to enhance their project's security posture. As part of this transition, they are considering automation strategies for infrastructure, deployment, and security activities. Which of the following statements is a valid reason for implementing Infrastructure as Code (IaC) as part of their DevSecOps practices?",
        "choices": [
            "A: IaC allows the manual provisioning of computing resources, which increases the reliability and repeatability of the deployment process.",
            "B: IaC is based on using tools and automation to speed up the provisioning process, making it more reliable and repeatable.",
            "C: IaC benefits include reduced collaboration between development and operations teams due to the increased complexity of the environment.",
            "D: IaC commonly involves the use of GUI-based tools instead of APIs, as it is more suitable for projects without Cloud-based resources."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Infrastructure as Code"
    },
    {
        "id": "d6074f53-3db1-4c47-a7ee-21f3cde5e6ba",
        "source": "windows_security",
        "question": "A Windows system administrator needs to enhance the security of enterprise web applications by ensuring that communications with certain domain names are only trusted if they are signed by specific certificates. Which of the following actions would best achieve this goal and what is a potential limitation of this approach?",
        "choices": [
            "A: Implementing enterprise certificate pinning to associate a root issuing certificate authority with a domain name, which might limit the flexibility to change certificate authorities in the future.",
            "B: Enabling automatic root certificate updates in Windows to ensure the system trusts the most recent certificates, potentially leading to trusting new, unwanted certificates.",
            "C: Disabling all root certificates in the system to prevent any domain from being trusted, ensuring maximum security at the expense of disrupting all secure communications.",
            "D: Only allowing self-signed certificates for all enterprise web applications, which would increase the administrative overhead for managing trust relationships."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Enterprise Certificate Pinning"
    },
    {
        "id": "3419bb22-648e-4ee5-99af-3e3889b98fa9",
        "source": "apple_platform_security",
        "question": "When using Apple Wallet and Apple Pay, which of the following statements correctly describe the security measures and processes for balance transfers, device management, and provisioning of travel or eMoney cards?",
        "choices": [
            "A: When transferring the balance from a physical card to Apple Wallet, the user may need to provide personal information for proof of card possession, and the card issuer has cryptographic keys to authenticate this information.",
            "B: Travel card users automatically have Express Travel enabled, which requires Face ID, Touch ID, or a passcode for each transaction.",
            "C: If a user's device is lost or stolen, the user can only suspend or remove eMoney cards by erasing the device remotely with Find My or by entering a mobile device management (MDM) remote wipe command.",
            "D: To add a US state ID or driving license to Apple Wallet, users are required to perform a series of facial and head movements, take a selfie, and authenticate with Face ID or Touch ID to ensure the ID is added by its rightful owner."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "digital_wallet_security"
    },
    {
        "id": "3425a7f3-0c3e-4e8f-a668-7706ae306250",
        "source": "attck",
        "question": "As a penetration tester, you are analyzing a piece of malware that you suspect is designed to gather system information from compromised hosts. Which of the following actions would you most likely expect the malware to perform based on common tactics observed in the wild? (Select TWO.)",
        "choices": [
            "A: Collect the system's BIOS version and CPUID.",
            "B: Encrypt all user files and demand a ransom to decrypt them.",
            "C: Retrieve the system's hostname and operating system version.",
            "D: Increase the CPU clock speed to overload the system."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Malware Information Gathering"
    },
    {
        "id": "edae556d-32a9-4c74-a6f4-c00b1d510f9b",
        "source": "android_sec_doc",
        "question": "If a third-party Android application needs to access the camera on a user's device, what must occur for the application to legitimately gain this access, and why is this procedure crucial for user security?",
        "choices": [
            "A: The application must be signed by the developer, as this ensures the application's integrity and non-repudiation.",
            "B: The user must explicitly grant access through Android OS Permissions, which are essential for protecting user privacy.",
            "C: The application needs to pass the Mozilla CA Inclusion Process to be trusted system-wide.",
            "D: The installer must prompt the user for access to browser history, to prevent unauthorized data access."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Android OS Permissions"
    },
    {
        "id": "c431eb4c-c92d-4f6c-9805-759179e27363",
        "source": "owasp_mastg",
        "question": "In the context of securing a mobile application, why is it NOT recommended to use inter-process communication (IPC) facilities to share sensitive data between apps?",
        "choices": [
            "A: IPC facilities are deprecated and no longer supported in modern mobile operating systems.",
            "B: IPC can unintentionally expose sensitive data or functionality to other apps on the same device.",
            "C: Mobile devices do not support IPC, relying instead on cloud services for inter-app communication.",
            "D: IPC increases the complexity of the app codebase, making it difficult to maintain and audit for security."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Inter-Process Communication (IPC)"
    },
    {
        "id": "f6b50586-49eb-4aa0-9ab1-f992349f44e3",
        "source": "mozilla_security",
        "question": "What are the implications of enabling HTTP Strict Transport Security (HSTS) on a website? Choose two correct statements:",
        "choices": [
            "A: HSTS upgrades all requests to HTTPS, even if the original scheme was HTTP.",
            "B: HSTS allows users to bypass TLS and certificate-related error pages.",
            "C: HSTS restricts the ability for users to bypass certificate-related error pages.",
            "D: HSTS increases the load times of pages because it encrypts all communication."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTPS upgrade"
    },
    {
        "id": "cdbe5f7a-ae68-4a40-a7ec-b73cae2a718c",
        "source": "mit6.858",
        "question": "You are a web developer tasked with enhancing the security of a web application. You need to ensure that your application adheres to the Same-Origin Policy (SOP) to prevent potential security breaches. Given your understanding of SOP, which of the following scenarios correctly reflect the policy's implementation and exceptions?",
        "choices": [
            "A: The application uses XMLHttpRequest to fetch data from an API endpoint that resides on the same domain as the web page's origin.",
            "B: The application incorporates an image from a third-party server using an <IMG> tag with the SRC attribute pointing to the third-party URL, and the browser enforces SOP on the retrieved pixels but not on the request itself.",
            "C: The application allows embedding an iframe from a different origin, and the script within the iframe can freely access the parent document's DOM.",
            "D: The application contains a link to an external site, and when a user clicks the link, the browser navigates to the new page without sending any cookies that belong to the destination site."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Same-Origin Policy"
    },
    {
        "id": "766a753e-f63f-4605-9d81-71db020fb6a3",
        "source": "android_sec_doc",
        "question": "In the context of the APK Signature Scheme v4, you are evaluating the hashing parameters to be used. Select the most appropriate combination of hashing algorithm and block size, and identify the best counterargument to the claim that 'any hashing algorithm and block size can be used with v4 signatures'.",
        "choices": [
            "A: SHA256 with a block size of 4096; Counterargument: The scheme only supports SHA256 with a block size of 4096.",
            "B: SHA512 with a block size of 2048; Counterargument: The scheme supports multiple block sizes, but only SHA256 is supported as the hashing algorithm.",
            "C: MD5 with a block size of 1024; Counterargument: The scheme is flexible with hashing algorithms but requires a specific block size.",
            "D: SHA1 with a block size of 512; Counterargument: The scheme allows any block size as long as the hashing algorithm is SHA256."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity"
        ],
        "keyword": "hash_algorithm"
    },
    {
        "id": "9d357fc9-cf23-4087-9b2e-bc0508c95229",
        "source": "cs161_textbook",
        "question": "An adversary is attempting to use an optical character recognition (OCR) algorithm to bypass a CAPTCHA system that presents distorted letters and words. Which of the following statements provide plausible explanations for why this strategy may not be successful?",
        "choices": [
            "A: The CAPTCHA system includes background noise and distortion that confuse the OCR algorithm, making character recognition unreliable.",
            "B: The OCR algorithm can easily interpret distorted characters as it is designed specifically to handle various font styles and sizes.",
            "C: CAPTCHAs with low contrast and merged-together letters may impede the OCR's ability to distinguish between individual characters.",
            "D: OCR algorithms are highly advanced and can interpret any text image regardless of distortion, rendering the CAPTCHA system ineffective."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OCR"
    },
    {
        "id": "81713fe6-5936-4f4a-abe1-9733f5a0f450",
        "source": "attck",
        "question": "An adversary is conducting reconnaissance on a corporate network and decides to discover local device drivers on a victim host to gain insights for further exploitation. As a security analyst, which strategy would be LEAST effective in detecting this reconnaissance activity?",
        "choices": [
            "A: Monitoring for the execution of system commands known to enumerate device drivers such as `lsmod` and `driverquery.exe`.",
            "B: Monitoring API function calls that may be used to gather information about device drivers, such as `EnumDeviceDrivers()`.",
            "C: Monitoring for unexpected access to Registry keys that store information about device drivers and their configurations.",
            "D: Monitoring for high network traffic volumes as an indicator of device driver enumeration."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "device driver discovery"
    },
    {
        "id": "7f3cf121-79ed-4f29-9193-e7d8bf70bc2d",
        "source": "cwe",
        "question": "A developer is implementing a feature requiring elevated privileges by calling a privileged API. The developer must follow best practices to avoid security vulnerabilities. Which of the following actions should the developer take? (Select all that apply)",
        "choices": [
            "A: Validate all data, context, and state assumptions that the privileged API expects before making the call.",
            "B: Ensure that the API call is made from a state that is inconsistent with the expected execution flow to avoid predictability.",
            "C: Make the API call and then immediately shed any elevated privileges once the API call is complete.",
            "D: Avoid calling the privileged API and instead implement the required privileged operations within the caller's code."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PrivilegedAPI"
    },
    {
        "id": "dbc4c595-f5a9-4597-a0b5-a21cad308171",
        "source": "owasp_mastg",
        "question": "Consider the following code snippet from a mobile application that uses a local SQLite database to authenticate users. Identify the security issue(s) present in the code and select the best practice(s) that should be employed to mitigate the identified issue(s):\n\njava\nSQLiteDatabase db;\n\nString sql = \"SELECT * FROM users WHERE username = '\" + username + \"' AND password = '\" + password + \"'\";\n\nCursor c = db.rawQuery( sql, null );\n\nreturn c.getCount() != 0;\n",
        "choices": [
            "A: The code snippet is vulnerable to SQL injection and should use prepared statements with variable binding to mitigate the issue.",
            "B: The code is secure as is, since mobile applications do not often expose services on the network.",
            "C: The code snippet should employ XML parsing with rejection of external entity resolution to mitigate potential XML injection attacks.",
            "D: The code should be refactored to use a custom URL scheme to secure the transmission of username and password."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SQL injection"
    },
    {
        "id": "57cd7b7e-122a-4fba-959a-9e848de2be3e",
        "source": "windows_security",
        "question": "In the context of authentication factors, 'something you have' can be represented by various methods. Which of the following does NOT typically fall under the 'something you have' category?",
        "choices": [
            "A: A USB hardware token that generates one-time passwords",
            "B: A mobile app that receives push notifications for authentication",
            "C: A smart card that stores a user's certificates for identification",
            "D: A user's unique fingerprint used for biometric authentication"
        ],
        "answer": "D",
        "topics": [],
        "keyword": "Authentication Factors"
    },
    {
        "id": "312c5563-0d4e-47fe-9941-9323c2c14b04",
        "source": "cwe",
        "question": "A hardware engineer suggests that to prevent untrusted agents from exploiting aliased memory regions, it is sufficient to implement a single memory protection unit (MPU) with a default deny policy for all addresses beyond the explicitly allowed ranges. Why might this strategy not be sufficient for addressing the vulnerability described in CWE 1257?",
        "choices": [
            "A: A default deny policy does not prevent an untrusted agent from accessing aliased memory regions if the address decoder ignores higher order address bits.",
            "B: A single MPU cannot provide adequate protection if memory aliases are created intentionally by a malicious agent altering the memory region sizes.",
            "C: Implementing a default deny policy could lead to performance degradation due to the overhead of processing access requests for each address.",
            "D: The default deny policy could be circumvented if the MPU itself is faulty or corrupted, allowing unrestricted access to all memory regions."
        ],
        "answer": "AB",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "AccessControl"
    },
    {
        "id": "071900a9-8775-41b8-9934-42ad477d239e",
        "source": "attck",
        "question": "A cybersecurity team plans to mitigate the risk of adversaries using `wmic.exe` for malicious purposes by blocking its execution on all endpoints. What could be the potential impact of this action?",
        "choices": [
            "A: It would enhance system performance by reducing the number of background processes.",
            "B: It would prevent the use of `wmic.exe` by both adversaries and legitimate administrative tools, possibly affecting system management.",
            "C: It would encrypt the data on endpoints, making it inaccessible to unauthorized access.",
            "D: It would automatically detect and remove any adversaries present in the network."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Execution Prevention"
    },
    {
        "id": "aea4694b-6564-441f-b5a0-d6341b4fe9f3",
        "source": "owasp_mastg",
        "question": "Which of the following strategies is least effective as an Android anti-reversing defense and is generally not recommended?",
        "choices": [
            "A: Employing obfuscation techniques to make the code harder to understand.",
            "B: Using only well-tested, public cryptographic algorithms instead of custom ones.",
            "C: Adding multiple fake code paths to mislead decompilers and analysts.",
            "D: Relying solely on client-side validation for input data to ensure integrity."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Client-Side Validation"
    },
    {
        "id": "cc483822-364a-40cc-ac72-2f524e0ca27a",
        "source": "d3fend",
        "question": "An organization wants to avoid direct attacks on its production systems but still wishes to engage with attackers to learn their methods. Which technique would be least effective in fulfilling this requirement?",
        "choices": [
            "A: Decoy User Credential",
            "B: Integrated Honeynet",
            "C: Decoy Persona",
            "D: Decoy Public Release"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Integrated Honeynet"
    },
    {
        "id": "31e2b5b9-f5cc-411b-91ba-03918199ebd5",
        "source": "owasp_wstg",
        "question": "Consider the following code snippet for a web application using a Microsoft Access database:\n\nsql\nDim query As String\nquery = \"SELECT * FROM users WHERE username = '\" + inputUsername + \"' AND password = '\" + inputPassword + \"'\"\n\n\nWhich of the following statements correctly identifies a security issue with this code?",
        "choices": [
            "A: The code is secure because it uses string concatenation to construct the SQL query, which is a recommended practice for Microsoft Access databases.",
            "B: Using dynamic SQL constructed from user input without proper sanitization exposes the application to SQL injection attacks.",
            "C: The code is secure as Microsoft Access automatically provides protection against SQL injection through its built-in security features.",
            "D: The use of 'SELECT *' in the SQL query is the primary security issue as it may lead to an SQL injection attack."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "SQL injection"
    },
    {
        "id": "26617100-9a26-4966-8db5-337dd19d0d3a",
        "source": "windows_security",
        "question": "In the process of deploying Windows Hello for Business with a hybrid key trust model, you discover that one of the servers in your organization is running an incompatible version of Windows Server. Based on best practices for this deployment, which of the following versions of Windows Server would you identify as incompatible?",
        "choices": [
            "A: Windows Server 2012",
            "B: Windows Server 2016",
            "C: Windows Server 2019",
            "D: Windows Server 2022"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Windows Server Compatibility"
    },
    {
        "id": "8441b7cb-fa07-4828-8b3c-aa7745bbb1e3",
        "source": "cwe",
        "question": "Consider the following code snippets. Which of these contains an instance of excessively deep nesting that could contribute to code maintainability issues?",
        "choices": [
            "A: for (int i = 0; i < 10; i++) { for (int j = 0; j < 10; j++) { if (j % 2 == 0) { for (int k = 0; k < 5; k++) { // Process data } } } }",
            "B: if (user.isAuthenticated()) { if (user.hasRole('admin')) { if (user.isAccountActive()) { // Grant access } } }",
            "C: while (!queue.isEmpty()) { Data data = queue.poll(); if (data.isValid()) { process(data); } }",
            "D: switch (userInput) { case 'A': processA(); break; case 'B': processB(); break; case 'C': processC(); break; default: handleDefault(); }"
        ],
        "answer": "AB",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Nesting"
    },
    {
        "id": "e3a9b9f9-e6e9-4d41-b269-e91906239b4a",
        "source": "cwe",
        "question": "An application's file handling design is under review for potential security improvements. The current implementation allows users to upload and access files through the application. Considering the risks associated with Windows shortcut (.LNK) files, which design change would most effectively mitigate potential vulnerabilities?",
        "choices": [
            "A: Implementing strict input validation to ensure that uploaded .LNK files do not point to unauthorized locations.",
            "B: Disabling all shortcut file handling within the application, preventing .LNK files from being opened or followed.",
            "C: Allowing .LNK files to be uploaded but only storing them as blobs in the database without opening or accessing their targets.",
            "D: Converting uploaded .LNK files to a different format before storing them to prevent any direct interaction with the shortcut targets."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "DesignMitigation"
    },
    {
        "id": "7aa3af1e-9718-4c7f-be5d-e03e4566776f",
        "source": "cwe",
        "question": "A hardware engineering team is tasked with designing a security-sensitive module for a new system. They are aware of the risks posed by single-event upsets (SEUs) to the system's operation, especially when the system is deployed in environments with high levels of cosmic radiation. Which of the following design strategies should the team consider implementing to mitigate the risk of SEUs compromising the security guarantees of the module?",
        "choices": [
            "A: Incorporate parity bits for each word in SRAM to allow error detection and correction.",
            "B: Implement triple-modular redundancy around security-sensitive modules.",
            "C: Replace SRAMs storing security-critical data with non-volatile memory types to prevent bit flips.",
            "D: Utilize Error-Correcting Codes (ECC) and Address Interleaving for SRAMs storing security-critical data."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SEU_Mitigation"
    },
    {
        "id": "dbd8d0fe-94b7-49bf-8395-080af11b4e8f",
        "source": "owasp_mastg",
        "question": "An iOS developer is considering whether to implement their own encryption mechanism for a new app to enhance data security. Which of the following are valid reasons for the developer to rely on iOS's built-in encryption and data protection features instead of creating a custom encryption solution?",
        "choices": [
            "A: iOS's built-in encryption is tied to a unique identifier (UID) fused into the Application Processor, making it resistant to tampering.",
            "B: Custom encryption solutions can directly access the AES 256-bit key fused into the device's hardware, offering a higher security level.",
            "C: Data protection classes in iOS allow for granular control over data access based on the user's passcode and device's UID.",
            "D: Implementing a custom encryption solution allows the developer to bypass the iOS sandboxing restrictions for greater flexibility."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "iOS Built-in Encryption"
    },
    {
        "id": "b2fc2024-2768-46ef-952d-abe2dc742f2e",
        "source": "attck",
        "question": "A cybersecurity analyst is evaluating an organization's threat landscape and notes that adversaries may acquire capabilities through various means. Which of the following methods might an adversary use to obtain capabilities, and what challenge does it pose for the organization's detection efforts?",
        "choices": [
            "A: Adversaries may purchase malware from criminal marketplaces, which can be difficult to detect due to the transaction occurring outside the organization's visibility.",
            "B: Adversaries may exclusively develop in-house capabilities, easily detected through standard code auditing practices.",
            "C: Adversaries might use only open-source tools with default configurations, simplifying the detection process through network traffic analysis.",
            "D: Adversaries may steal SSL/TLS certificates from other entities, complicating detection as the activity often occurs beyond the organization's monitoring scope."
        ],
        "answer": "AD",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Certificate Registration"
    },
    {
        "id": "5baf815b-151e-4cb0-8eac-fbfd6749f783",
        "source": "mozilla_security",
        "question": "An organization is reviewing its web security measures to enhance the protection of its web applications. Which of the following actions is least likely to improve their web security posture?",
        "choices": [
            "A: Implementing a strict Content Security Policy (CSP)",
            "B: Enforcing HTTP Strict Transport Security (HSTS) across all web applications",
            "C: Adding a contribute.json file to their website repository",
            "D: Regularly updating their web server software to patch security vulnerabilities"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Contribute.json Standard"
    },
    {
        "id": "00a0d75e-f53b-4756-9a62-efee807e6a51",
        "source": "android_sec_doc",
        "question": "If a Trusty application developer encounters an `ERR_NOT_ENOUGH_BUFFER` error code when invoking the `send_msg()` method, what is the most likely cause of this error?",
        "choices": [
            "A: The peer application has not freed enough space in its receive queue.",
            "B: The message ID provided was incorrect.",
            "C: The `handle` parameter does not represent a valid channel.",
            "D: The developer used the wrong `iovec_t` structures in the message."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "ERR_NOT_ENOUGH_BUFFER"
    },
    {
        "id": "9bf00f7b-5f82-4131-b76f-88064c9e5459",
        "source": "attck",
        "question": "A penetration tester observes that a particular type of malware is actively searching for and exfiltrating text and document files from an infected host. Which of the following statements is least accurate about the malware's capabilities?",
        "choices": [
            "A: The malware could potentially be a version of Kimsuky, which targets documents for exfiltration.",
            "B: The malware resembles Goopy's capabilities, which include document exfiltration from infected systems.",
            "C: The observed behavior could be attributed to FrameworkPOS, which specializes in collecting credit card information.",
            "D: The malware's operations are similar to Mis-Type, which is known to collect and exfiltrate data from hosts."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Malware capabilities"
    },
    {
        "id": "1f17d5a3-fae0-4ebb-b060-d86016ca5fb8",
        "source": "cs161_textbook",
        "question": "Alice is designing a digital signature system and needs to ensure that it has all the necessary properties to be secure and functional. Which of the following design elements should she include in her digital signature scheme?",
        "choices": [
            "A: A public verification key that everyone can use to encrypt messages, and a private signing key for decrypting received messages.",
            "B: A randomized algorithm for key generation that provides a unique public and private key pair each time it is invoked.",
            "C: A signing algorithm that allows anyone to generate a signature with a public key for any given message.",
            "D: A verification algorithm that checks whether a signature on a message is valid using the corresponding public key."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DigitalSignatureDesign"
    },
    {
        "id": "0ea4045e-30a8-4325-b4c8-593c63c952b5",
        "source": "cwe",
        "question": "In the context of network switches, a common vulnerability arises when ARP mapping tables overflow during spoofing attacks, causing the switch to behave like a hub and broadcast traffic that could be intercepted by an eavesdropper. Which of the following design changes would not prevent this vulnerability?",
        "choices": [
            "A: Limiting the number of ARP entries that can be recorded for each switch interface.",
            "B: Increasing the size of the ARP table to accommodate more entries.",
            "C: Enabling automatic switch shutdown when a spoofing attack is detected.",
            "D: Designing the switch to broadcast all traffic as a default behavior in case of table overflow."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ARPOverflow"
    },
    {
        "id": "f7b84c8f-98bc-42a1-a7ea-9bc484fbb125",
        "source": "mit6.858",
        "question": "In the context of using symbolic execution for bug-finding as described in the lecture, which two components are integral to the symbolic execution process used by EXE to analyze a program?",
        "choices": [
            "A: A constraint solver like STP that determines if a given path condition is satisfiable, indicating potential flaws.",
            "B: A black-box testing framework that can interact with compiled binaries without needing access to the source code.",
            "C: A scheduler process that determines the order of execution for different branches based on path conditions.",
            "D: A random input generator that produces syntactically correct inputs with random content where freedom is allowed."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "symbolic-execution"
    },
    {
        "id": "a23e09cb-2feb-48d0-acaa-cf7dcc31c47e",
        "source": "android_sec_doc",
        "question": "In an Android environment, a security engineer plans to use a cryptographic key associated with a `Tag::BOOT_PATCHLEVEL` of 20180605. Assuming the device has not received any security updates since June 5, 2018, what would be the outcome if the engineer tries to use this key after the system's boot image security patch level has been updated to 20190101?",
        "choices": [
            "A: The key would be usable without any issues as long as the patch level is higher than the one specified in the tag.",
            "B: The key usage would fail, triggering a `ErrorCode::KEY_REQUIRES_UPGRADE` response.",
            "C: The engineer would need to downgrade the system's patch level to match the key's tag to use the key.",
            "D: The key's `Tag::BOOT_PATCHLEVEL` automatically updates to match the system's new patch level."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "BOOT_PATCHLEVEL"
    },
    {
        "id": "ba63b521-6546-4a99-a384-495dd3556868",
        "source": "attck",
        "question": "An incident responder is analyzing a system that they suspect has been compromised by a sophisticated threat actor. They notice several command executions that are indicative of network reconnaissance activity. Which of the following commands might the responder identify as being used by the threat actor to gather information about network connections on the compromised system?",
        "choices": [
            "A: netstat -an",
            "B: ifconfig /all",
            "C: net session",
            "D: arp -a"
        ],
        "answer": "ACD",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "network reconnaissance"
    },
    {
        "id": "41a4378d-1b1c-452b-a629-e268afedab45",
        "source": "android_sec_doc",
        "question": "An Android security specialist wants to ensure that a cryptographic key used for encryption does not expire based on a specific date and time. Which of the following Android Keymaster tags would not be suitable for achieving this requirement?",
        "choices": [
            "A: Tag::MAX_USES_PER_BOOT",
            "B: Tag::ORIGINATION_EXPIRE_DATETIME",
            "C: Tag::NONCE",
            "D: Tag::NO_AUTH_REQUIRED"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Key Expiration"
    },
    {
        "id": "d1a365ec-d19a-4c3d-b281-4d205106b69e",
        "source": "windows_security",
        "question": "When setting up a new Windows installation for a corporate environment, which authentication method aligns with the latest security guidelines and provides two-factor authentication?",
        "choices": [
            "A: Magnetic stripe cards as a form of physical identification",
            "B: Windows Hello for Business or FIDO2 security keys",
            "C: Software tokens generated by a mobile application",
            "D: RFID badges for proximity-based access control"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "FIDO2"
    },
    {
        "id": "8a50471a-9200-4a0c-88f8-2ddec1b3e653",
        "source": "apple_platform_security",
        "question": "As an IT administrator at an educational institution, you are evaluating the security features of iCloud and iCloud Keychain for use in the institution's mobile device management (MDM) system. Considering the security mechanisms in place, select the advantages and potential concerns that need to be addressed:",
        "choices": [
            "A: Enabling Advanced Data Protection for iCloud increases the number of data categories protected by end-to-end encryption, enhancing the privacy of stored data.",
            "B: Managed Apple IDs can be audited by designated inspectors, which could raise privacy concerns among students using personal devices.",
            "C: iCloud Keychain's Secure Recovery feature may pose a risk of key exposure during the recovery process.",
            "D: iCloud's default setting may allow Apple to assist with data recovery, potentially introducing a vulnerability if data centre security is compromised."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "iCloudSecurity"
    },
    {
        "id": "991f8ded-c5cd-423b-aa8d-ff53c9bf9f55",
        "source": "owasp_mastg",
        "question": "During a man-in-the-middle attack simulation, you successfully intercept the traffic between a mobile device and a web server. However, all traffic appears to be encrypted. What information can you still potentially gather despite the encryption?",
        "choices": [
            "A: You can extract clear text data such as usernames and passwords because MITM attacks decrypt traffic on-the-fly.",
            "B: You can obtain valuable information about the hosts involved, the protocols used, and the ports the app is communicating with.",
            "C: You can retrieve the contents of encrypted messages because the MITM position allows you to bypass TLS encryption.",
            "D: You can modify the data in transit to inject malicious payloads into the encrypted traffic without detection."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TLS Encryption"
    },
    {
        "id": "825c5936-6312-43a7-93fb-9494011c1394",
        "source": "android_sec_doc",
        "question": "An Android device is experiencing performance issues due to a high number of attributes assigned to a type in the sepolicy. As an Android security specialist, you recognize this could be a result of policy cache misses. What actions were taken in Android 8.0 to address similar performance regressions?",
        "choices": [
            "A: The number of attributes assigned to a type was increased to improve cache hits.",
            "B: Attributes added by the policy compiler were removed, and unused attributes were eliminated.",
            "C: Binary form of `file_contexts` was reintroduced to reduce compilation overhead.",
            "D: Versioned attributes were introduced to reduce the number of attributes assigned to each type."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "policy cache miss"
    },
    {
        "id": "d715208c-a46f-4ea2-9fcd-ec756c26e99b",
        "source": "attck",
        "question": "In a networked environment, what detection method can a security administrator employ to identify unauthorized changes indicative of a Pre-OS Boot compromise?",
        "choices": [
            "A: Monitoring for irregularities in API calls related to Pre-OS Boot mechanisms.",
            "B: Performing regular port scans to detect open ports that may indicate a Pre-OS Boot compromise.",
            "C: Checking the network's edge devices for firmware updates as a sign of Pre-OS Boot threats.",
            "D: Analyzing CPU usage patterns for anomalies that could signal a Pre-OS Boot attack."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Pre-OS Boot"
    },
    {
        "id": "a1d254bd-fad1-4da4-a8d2-e38036d3babf",
        "source": "windows_security",
        "question": "As an IT Professional, you are reviewing the security policies of your organization's Windows-based systems. You need to make a decision regarding the 'Increase scheduling priority' policy setting. Considering best practices, which of the following outcomes are possible if you allow certain users to increase scheduling priority? (Select two)",
        "choices": [
            "A: It may lead to potential system instability if misused by over-prioritizing certain processes.",
            "B: It will encrypt the data on the disk to prevent unauthorized access when the system is off.",
            "C: Users can perform a Denial of Service (DoS) attack by creating high-priority tasks.",
            "D: It will disable the system's ability to receive updates from the Windows Update service."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Scheduling Priority"
    },
    {
        "id": "cc1a6a63-b48f-414b-92f9-be598dddaf7e",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing logs and notices multiple instances of file transfers from an external IP to several internal machines within the company's network. Following an investigation, it is determined that an adversary has gained access and is attempting to transfer additional tools into the environment. Given the methods listed below, which are the MOST likely techniques the adversary is using to transfer these tools? (Choose two)",
        "choices": [
            "A: Using social engineering to persuade employees to download tools via email attachments.",
            "B: Employing system utilities like `copy`, `scp`, `wget`, or PowerShell commands to download tools.",
            "C: Exploiting vulnerabilities in the network infrastructure to create unauthorized VPN tunnels for file transfer.",
            "D: Abusing web services or syncing services like Dropbox or OneDrive to transfer files."
        ],
        "answer": "BD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Ingress Tool Transfer"
    },
    {
        "id": "c7457c95-b25c-4d55-9c9c-f70fb4ec1e6c",
        "source": "attck",
        "question": "Which of the following malware does NOT have the capability to download and execute remote files as part of its functionality?",
        "choices": [
            "A: POSHSPY",
            "B: Peppy",
            "C: RemoteCMD",
            "D: PipeMon"
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Remote File Execution"
    },
    {
        "id": "25b9db98-bc7f-480c-af15-5174f5e4d084",
        "source": "android_sec_doc",
        "question": "An Android device displays a warning screen during the boot process. The screen is color-coded ORANGE and informs the user about the unlocked state of the device. What should be the expected user experience according to the Android security guidelines?",
        "choices": [
            "A: The warning screen should automatically dismiss after 10 seconds, and pressing the power button will prevent the device from booting.",
            "B: The warning screen should remain indefinitely until the user presses the power button, and the device will boot immediately after it is dismissed.",
            "C: The warning screen should stay for 30 seconds and then the device should power off automatically if no interaction occurs.",
            "D: The warning screen will dismiss after 10 seconds, and pressing the power button toggles between pausing and continuing the boot process."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Verified Boot"
    },
    {
        "id": "4d22ea1b-47f5-4a68-ab28-789b1c098aaa",
        "source": "attck",
        "question": "A cybersecurity consultant is reviewing an organization's security policy against potential IPC abuses as described in the ATT&CK framework. Which of the following mitigation strategies would be LEAST effective in preventing an adversary from abusing IPC mechanisms for arbitrary code execution?",
        "choices": [
            "A: Enabling Hardened Runtime capabilities in application development.",
            "B: Applying behavior prevention mechanisms on endpoints to prevent DDE attacks.",
            "C: Increasing the complexity of user passwords.",
            "D: Disabling or removing features that allow automatic DDE/OLE execution."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "PenTest"
        ],
        "keyword": "IPC Mitigations"
    },
    {
        "id": "bc0798bf-20e4-4e51-84b9-83afb887212a",
        "source": "owasp_wstg",
        "question": "In order to mitigate the risk of forged requests in a web application, which of the following remediation measures would be considered the most effective?",
        "choices": [
            "A: Implementing strict session management controls.",
            "B: Utilizing client-side input validation exclusively.",
            "C: Enforcing multi-factor authentication on all user accounts.",
            "D: Conducting thorough server-side validation of all incoming requests."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Server-Side Validation"
    },
    {
        "id": "3049bbe5-6098-4edd-a427-36844924f2c5",
        "source": "apple_platform_security",
        "question": "You are configuring a Mac with an Apple T2 Security Chip and you have to set the security policies using the Startup Security Utility. Which of the following statements are true regarding the security settings and policies that can be configured in this scenario?",
        "choices": [
            "A: The Medium Security boot policy relies on a global signature from Apple and does not prevent rollback attacks.",
            "B: The Full Security boot policy is personalized with a unique ID (ECID), tying macOS to the specific Mac's T2 chip to prevent rollback attacks.",
            "C: No Security setting allows users to disable secure boot evaluation on the Intel processor, enabling them to boot any preferred software.",
            "D: The Media boot policy restricts booting from devices not directly connected to the T2 chip even if secure boot is disabled."
        ],
        "answer": "ABCD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecureBoot"
    },
    {
        "id": "8d15521b-5e1b-452a-9a81-336f56ab5bd5",
        "source": "owasp_wstg",
        "question": "You are analyzing a web application for security vulnerabilities and come across a feature that allows users to post content to a public forum. You suspect that this feature could be exploited to perform an incubated attack. Considering the nature of incubated vulnerabilities, which two factors would you prioritize in your assessment to determine the potential for such an attack to be successful?",
        "choices": [
            "A: Ensuring that the forum's content posting feature sanitizes user input to prevent stored injections.",
            "B: Confirming that the application has a recall mechanism that retrieves and displays user-generated content.",
            "C: Verifying that the server hosting the application is configured to deny installation of new Java packages.",
            "D: Checking whether the application's session management is robust against side-channel attacks."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "incubated vulnerability"
    },
    {
        "id": "1d71672f-55f5-4956-b5de-35008bc85e3b",
        "source": "attck",
        "question": "Which of the following system requirements does NOT facilitate the execution of malware from removable media?",
        "choices": [
            "A: Removable media is allowed within the network.",
            "B: Autorun is enabled on systems within the network.",
            "C: All executable files are required to be digitally signed.",
            "D: A vulnerability is present that allows for code execution."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Digital Signature Security"
    },
    {
        "id": "2c007ab1-0153-4b6a-903c-f7b2f7b44dee",
        "source": "attck",
        "question": "In a network security review meeting, a discussion arises about the best practices to prevent adversaries from impairing defense mechanisms. Which of the following mitigation techniques is LEAST effective in preventing the disabling or interference with security/logging services?",
        "choices": [
            "A: Regularly updating antivirus signatures and heuristic detection rules.",
            "B: Restricting file and directory permissions to prevent unauthorized modification.",
            "C: Implementing strict user account control and role-based permissions.",
            "D: Ensuring that logging services are running on non-standard ports."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Security Mitigations"
    },
    {
        "id": "fbd83bbf-df9d-4c96-a2de-9bc2c0831722",
        "source": "apple_platform_security",
        "question": "An educational institution is considering the use of Shared iPads and is evaluating the implications for student data. Select the accurate statements regarding the handling of user data in various sign-in and sign-out scenarios for Shared iPads.",
        "choices": [
            "A: User data for each individual is stored in a separate APFS volume, which is protected by the user's credential and is not deleted upon signing out unless it's a temporary session.",
            "B: When a user signs out of a temporary session, the APFS volume is unmounted but retained for future use until the user signs back in.",
            "C: Data and settings for users signing in to Shared iPad are restored and synced from iCloud, except for users in temporary sessions.",
            "D: Temporary sessions have the ability to sync data with iCloud continuously and rely on background syncing mechanisms for data preservation after sign-out."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SharediPad"
    },
    {
        "id": "08ef0aaa-515a-40e5-9425-7f95e00706ad",
        "source": "apple_platform_security",
        "question": "Consider a user who decides to enable Advanced Data Protection for their iCloud account and later opts to disable it. Select the correct statements that explain the processes involved during these actions.",
        "choices": [
            "A: Upon enabling Advanced Data Protection, the device initiates the removal of available-after-authentication service keys from Apple data centres, which is then followed by a key rotation operation.",
            "B: The user's choice to enable or disable Advanced Data Protection is stored and synchronized across their devices using iCloud Keychain device metadata.",
            "C: When Advanced Data Protection is turned off, the device uploads original and new service keys for services that are end-to-end encrypted under standard data protection.",
            "D: If the user disables Advanced Data Protection, all previously encrypted data becomes accessible after authentication, and Apple can assist in data recovery for the account."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Advanced Data Protection"
    },
    {
        "id": "501f67b3-6656-42ea-96a4-bfadffbed533",
        "source": "attck",
        "question": "An organization has identified a potential vulnerability to forced authentication attacks via SMB and WebDAV protocols. As a security consultant, you are tasked with recommending mitigation strategies. Which combination of strategies would provide effective protection while minimizing impact on legitimate network use?",
        "choices": [
            "A: Block all SMB and WebDAV traffic both within and exiting the network and require two-factor authentication for all users.",
            "B: Filter or block WebDAV protocol traffic from exiting the network and use strong passwords to increase the difficulty of cracking obtained credential hashes.",
            "C: Restrict SMB and WebDAV traffic to allowlisted external systems only and implement strict account lockout policies after two failed authentication attempts.",
            "D: Eliminate the use of SMB and WebDAV protocols entirely and transition to a proprietary protocol for internal and external resource sharing."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Credential Hashes"
    },
    {
        "id": "017b8ac8-3f4d-42d9-b4b6-3356f2c3ca42",
        "source": "apple_platform_security",
        "question": "What could be the potential consequences if an app's network connection does not support TLS 1.2, lacks forward secrecy, or has invalid certificates, according to the App Transport Security requirements for apps compiled for iOS 9 or later and macOS 10.11 or later?",
        "choices": [
            "A: The connection will still be established, but with a warning to the user.",
            "B: The connection will fail, and the app may override App Transport Security to establish it.",
            "C: The connection will be established, but with degraded encryption standards.",
            "D: The app will be forced to use IPv6 for establishing a secure connection."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "AppTransportSecurity"
    },
    {
        "id": "540afbd2-f362-4157-8770-71e34542958c",
        "source": "cwe",
        "question": "Review the following code snippets and select the one that does NOT demonstrate a potential vulnerability due to improper handling of resource closure:",
        "choices": [
            "A: FILE *file_ptr = fopen(\"data.txt\", \"r\"); if (file_ptr) { /* Read data */ fclose(file_ptr); fclose(file_ptr); }",
            "B: int *buffer = (int *)malloc(256 * sizeof(int)); if (buffer) { /* Use buffer */ free(buffer); }",
            "C: int sock = socket(AF_INET, SOCK_STREAM, 0); if (sock != -1) { /* Use sock */ close(sock); close(sock); }",
            "D: char *str = new char[100]; if (str) { /* Use str */ delete [] str; }"
        ],
        "answer": "B",
        "topics": [
            "MemorySafety",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Resource_Management"
    },
    {
        "id": "a8c1c9e5-214b-44d7-950d-c1b8bc404e5f",
        "source": "cwe",
        "question": "Considering the vulnerability exploited through the use of 'tempdir/../securedir/sensitivefile', which of the following measures would not effectively prevent this type of path equivalence exploitation?",
        "choices": [
            "A: Implementing strict input validation to disallow '../' sequences in file paths.",
            "B: Using a whitelist approach for allowed file paths.",
            "C: Storing files in the database and using indirect references for access.",
            "D: Adding a 'Disallow: /../' line in the robots.txt file."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Prevention"
    },
    {
        "id": "d4d8d29c-48f2-45ea-8bba-cd2b54caca84",
        "source": "windows_security",
        "question": "In a Windows server environment, what would be the consequence of disabling the 'Microsoft network server: Attempt S4U2Self to obtain claim information' security policy setting in terms of user claims and access to files with claim-based access control policy?",
        "choices": [
            "A: Disabling the setting would improve server performance since it would reduce the number of network requests to domain controllers.",
            "B: Disabling the setting would have no effect on access to files with claim-based access control policy, as user claims would still be processed by default mechanisms.",
            "C: Disabling the setting would prevent the server from obtaining a claims-enabled access token for client principals, potentially restricting access to files requiring user claims.",
            "D: Disabling the setting would enhance security by preventing unauthorized users from accessing files, even if the files have claim-based access control policy."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Claim-Based Access Control"
    },
    {
        "id": "f8fccbdf-dda6-4658-aa46-8d0a93a07505",
        "source": "attck",
        "question": "In the context of the ATT&CK framework, when an adversary employs alternate authentication material such as Kerberos tickets or application access tokens to access different parts of the network, which of the following tactics are they most likely utilizing?",
        "choices": [
            "A: Initial Access and Execution",
            "B: Defense Evasion and Lateral Movement",
            "C: Discovery and Privilege Escalation",
            "D: Exfiltration and Impact"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "ATT&CK Tactics"
    },
    {
        "id": "d5a7116b-bbd9-49dd-bfa2-d285007da122",
        "source": "apple_platform_security",
        "question": "An organization is deploying a fleet of iOS devices and wants to ensure that the privacy and security of Bluetooth-based communications are maintained. Which of the following features should the organization make sure are utilized on the iOS devices to enhance privacy and security?",
        "choices": [
            "A: Enabling address randomization for BLE devices to prevent tracking over time.",
            "B: Disabling cross-transport key derivation to restrict key usage to the originating transport.",
            "C: Implementing MAC address randomization for Ultra Wideband technology.",
            "D: Using a static Bluetooth device address to ensure device connectivity."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "BLE Privacy"
    },
    {
        "id": "e70a4db5-5f34-42aa-9aaa-236a9f989201",
        "source": "attck",
        "question": "An organization is reviewing its cybersecurity detection methods to identify any unauthorized hardware devices that may have been connected to its network. Which of the following data sources and components would be LEAST effective for detecting the presence of such devices?",
        "choices": [
            "A: Monitoring newly constructed drives or related events associated with connecting hardware to systems.",
            "B: Scanning for malware signatures in files stored on the network to find traces of unauthorized hardware.",
            "C: Utilizing configuration management databases to identify computer systems or network devices that should not be on the network.",
            "D: Observing network traffic flow to monitor for traffic originating from unknown hardware devices."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Configuration Management Database"
    },
    {
        "id": "6951d3e5-a532-499a-a195-3e30b2ba0450",
        "source": "owasp_wstg",
        "question": "A penetration tester is assessing the security of a web server. They encounter a scenario where the server executes files with unexpected extensions, potentially revealing server-side technologies. Given the importance of proper file extension handling to prevent confidential information leakage, which of the following actions should the tester prioritize to evaluate server security?",
        "choices": [
            "A: Brute force sensitive file extensions that might contain raw data, such as scripts or credentials.",
            "B: Restrict the upload of any files to the server, regardless of their content type.",
            "C: Assume that all '.pl' files are associated with Perl scripts and do not require further testing.",
            "D: Validate that no system framework bypasses exist for the rules that have been set."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "File Extension Handling"
    },
    {
        "id": "c738b7fb-c232-4813-b98c-59ab97fe1c23",
        "source": "owasp_mastg",
        "question": "A mobile platform provider is considering adopting a recognized security standard for mobile app security. From the following options, select the benefits that such a standard could potentially bring to the mobile app ecosystem. Choose all that apply.",
        "choices": [
            "A: Enhanced consistency in security assessments across different applications.",
            "B: Increased time spent on app development due to complex compliance requirements.",
            "C: Improved market transparency for consumer and commercial mobile app security.",
            "D: Decreased need for developers to implement any form of security controls."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Security Standard Adoption"
    },
    {
        "id": "c218e17b-e064-49a5-a562-a23c9fd70cb2",
        "source": "owasp_mastg",
        "question": "A mobile banking app uses SMS-based one-time passwords (SMS-OTP) as part of its 2FA process. However, customers have reported incidents of unauthorized access. What could be the most likely vulnerability exploited by attackers in this scenario?",
        "choices": [
            "A: The app is not including instructions in the SMS message for users who did not request the code.",
            "B: The app is sending OTPs through push notifications rather than SMS.",
            "C: Attackers are intercepting SMS messages through vulnerabilities in the telecommunications network.",
            "D: The OTPs provided by the app are using low entropy and are easy to guess."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SMS-OTP Vulnerability"
    },
    {
        "id": "679e4e78-f97f-4261-be7e-43bc29382619",
        "source": "attck",
        "question": "An adversary is planning to perform an Ingress Tool Transfer to a victim network. What could be the reasons for choosing `certutil` and `curl` as the preferred utilities for this operation? (Choose two)",
        "choices": [
            "A: `certutil` and `curl` are less likely to trigger antivirus software compared to downloading files directly from the internet.",
            "B: `certutil` and `curl` are typically not found on victim systems, thus their presence can alert defenders to unauthorized activities.",
            "C: These utilities can be used to obfuscate the transfer process, making it harder for defenders to detect the malicious activity.",
            "D: These utilities are often restricted by firewall rules, making them an unlikely choice for transferring tools into a compromised environment."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "certutil"
    },
    {
        "id": "0822b969-958f-4ecd-9e32-327985cb5581",
        "source": "apple_platform_security",
        "question": "On a Mac with Apple silicon, you attempt to execute an x86_64 application that has gone through Rosetta's translation process. Which factors will macOS consider to verify the security and integrity of the application before allowing it to execute?",
        "choices": [
            "A: The code directory hash of the original x86_64 image matches the one encoded into the Rosetta AOT translation artefact's signature.",
            "B: The AOT artefact's code directory hash is present in the static trust cache.",
            "C: The application has a valid signature from the device-specific Secure Enclave signing procedure.",
            "D: The identity properties of the original x86_64 image are returned when the kernel queries for the application's entitlements."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "macOS Security"
    },
    {
        "id": "fb9dd846-166b-4080-a6f1-c83fa550b78e",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing network traffic to identify potential command and control (C2) channels used by adversaries. The analyst wants to implement a detection method that focuses on analyzing packet contents to identify mismatches between the expected protocol behavior and the port being used. What are the potential advantages and disadvantages of this approach?",
        "choices": [
            "A: Advantage: It can identify traffic for specific adversary malware. Disadvantage: It may result in a high number of false positives due to legitimate use of non-standard ports.",
            "B: Advantage: It ensures no non-standard port traffic is allowed in the network. Disadvantage: It may block legitimate traffic leading to business disruptions.",
            "C: Advantage: It does not require any additional resources. Disadvantage: It cannot detect sophisticated attacks that use standard port-protocol pairings.",
            "D: Advantage: It can detect communications that do not follow expected protocol behavior. Disadvantage: It may not detect all C2 communications, as some may occur over standard ports."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "50ec97b8-fba3-4a42-bd94-1098eb8ade56",
        "source": "cs161_textbook",
        "question": "Consider an x86 system which uses little-endian format for memory storage. If you are given the task of writing a multi-byte value to memory and later reading it back, which of the following considerations should you keep in mind to ensure correct handling of the values?",
        "choices": [
            "A: Always store the most significant byte of the word at the lowest memory address to maintain the correct sequence when reading the value back.",
            "B: Remember that the least significant byte of the word is stored at the lowest memory address, which is crucial when reading or writing values to memory.",
            "C: Ignore the little-endian format when working with memory diagrams, as the diagrams will automatically adjust the byte order.",
            "D: Be aware that using word-sized units on memory diagrams can help abstract away the little-endian byte order, although the actual storage is little-endian."
        ],
        "answer": "BD",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "little-endian"
    },
    {
        "id": "5340b62a-c7fc-4862-9599-16aef8033d15",
        "source": "apple_platform_security",
        "question": "An Apple user has forgotten their iCloud security code and is attempting to recover their keychain. They have successfully authenticated with their iCloud account and responded to an SMS sent to their registered phone number. Considering the security features and recovery process of iCloud Keychain as described, which of the following statements are true about the subsequent steps and security implications?",
        "choices": [
            "A: The user must enter their iCloud security code, and the HSM cluster verifies it using the Secure Remote Password (SRP) protocol.",
            "B: If a user fails to authenticate after 10 attempts, the HSM cluster permanently deletes the escrow record.",
            "C: Upon exceeding the maximum number of attempts, the user can immediately reset their iCloud security code via email.",
            "D: The administrative access cards for the HSM firmware have been destroyed to prevent unauthorized firmware changes."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "iCloud Keychain Recovery"
    },
    {
        "id": "2bcc4631-1278-4a5f-ade2-e8a5e0f8ce0e",
        "source": "attck",
        "question": "A Windows domain environment is looking to mitigate the risk of adversaries abusing BITS for malicious purposes such as persistent code execution and data exfiltration. Which of the following mitigation strategies would be LEAST effective in this scenario?",
        "choices": [
            "A: Modifying host firewall rules to permit only legitimate BITS traffic.",
            "B: Reducing the default BITS job lifetime through Group Policy settings.",
            "C: Limiting access to the BITS interface to specific user accounts or groups.",
            "D: Installing antivirus software on all endpoints within the domain."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "BITS Mitigation"
    },
    {
        "id": "de41ccd8-b9e3-445f-88fc-e2b0e613105a",
        "source": "owasp_mastg",
        "question": "A development team is tasked with enhancing the security of their mobile application by implementing file integrity checks. The application stores sensitive data on public storage and uses shared preferences extensively. The team is considering different methods for ensuring the integrity of these data stores. Evaluate the proposed methods and select those that would be most suitable for the application's requirements.",
        "choices": [
            "A: Implementing CRC checks on the bytecode of the application to prevent tampering with the code.",
            "B: Creating HMACs for key-value pairs stored in `SharedPreferences` to detect unauthorized modifications.",
            "C: Signing the byte array of files stored on SD card using a self-signed certificate to ensure integrity.",
            "D: Relying solely on Android's built-in file permissions to protect the integrity of files on public storage."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "CRC checks"
    },
    {
        "id": "fd1a2601-c6a5-4b3c-9f3a-0ef03d09b470",
        "source": "cwe",
        "question": "A security team implements a path traversal attack prevention mechanism that strips out all occurrences of '..\\' from the user input before using it to access the file system. An audit is conducted to assess the robustness of this mechanism. Which of the following points should be raised as a potential weakness during the audit?",
        "choices": [
            "A: The mechanism does not account for alternative encodings of the '..\\' sequences that could be used to bypass the filter.",
            "B: The mechanism does not convert lowercase letters to uppercase, which might result in inconsistent path resolutions.",
            "C: The mechanism fails to strip out all numeric characters, potentially allowing access to files named with digits.",
            "D: The mechanism correctly neutralizes all '..\\' sequences, making it impossible to traverse directories."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "AuditWeakness"
    },
    {
        "id": "4b44b715-57d1-4f0d-bb07-c6a35247b081",
        "source": "windows_security",
        "question": "In the context of Windows Hello for Business, what are the security benefits of implementing a PIN reset feature for users who have forgotten their authentication PIN?",
        "choices": [
            "A: It reduces the risk of unauthorized access by ensuring only the rightful user can reset their PIN.",
            "B: It simplifies the login process by allowing users to bypass the PIN entry after resetting it.",
            "C: It encrypts the user's data on the device, preventing access until the PIN is reset.",
            "D: It increases the PIN complexity requirements automatically upon each reset."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "PIN reset feature"
    },
    {
        "id": "65640306-d2dd-4bcf-b200-70e0d3e15bf3",
        "source": "cwe",
        "question": "In a web application, an authorization check is performed using a value stored in a browser cookie. If the authorization logic is not correctly implemented, what potential security issues could arise from this situation?",
        "choices": [
            "A: Attackers could perform a denial of service attack by flooding the server with invalid cookie values.",
            "B: Attackers could bypass access restrictions by modifying the cookie value to gain unauthorized access to sensitive information.",
            "C: Attackers could cause an arbitrary code execution by injecting malicious code into the cookie.",
            "D: Attackers could exploit the weak authorization to escalate privileges and perform actions beyond their allowed scope."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Security_Impact"
    },
    {
        "id": "5f9bc5fc-89b6-41bb-946d-fee2abb908bf",
        "source": "cs161_textbook",
        "question": "Which statement best describes the purpose of public-key padding modes like OAEP in RSA encryption?",
        "choices": [
            "A: To extend the message to a fixed length similar to block cipher padding.",
            "B: To provide an additional layer of security by hashing the message before encryption.",
            "C: To introduce randomness into the encryption process so that the ciphertext output appears random.",
            "D: To allow for the encryption of multiple messages with the same key without increasing the risk of information leakage."
        ],
        "answer": "C",
        "topics": [
            "Cryptography"
        ],
        "keyword": "Padding"
    },
    {
        "id": "fffea5ee-2add-4699-85c9-a704226fb28f",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the behavior of a newly discovered malware strain that has infected a corporate network. The malware is designed to search through the file system looking for financial documents and exfiltrate them. During the investigation, the analyst observes that the malware performs a recursive directory listing to find files with specific file extensions such as .xls, .docx, and .pdf, and copies them to a hidden folder before exfiltration. Based on this behavior, which file discovery method is the malware most likely using, and what could be the advantage of this approach?",
        "choices": [
            "A: Enumerating drive information to identify all available drives before searching for files, which may allow for a thorough search of all storage locations.",
            "B: Using a malicious DLL to search for files with specific keywords, which could potentially bypass some antivirus heuristic detections.",
            "C: Gathering a recursive directory listing to find files and directories of interest, which allows for a systematic search of the file system.",
            "D: Conducting word searches within documents on the host, which can be a more targeted approach but may require more processing time and resources."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Recursive Directory Listing"
    },
    {
        "id": "cfa2b854-0da2-4a4b-b32e-d6bd356c903f",
        "source": "attck",
        "question": "An organization is trying to enhance its detection capabilities to identify adversary development of cyber attack tools and infrastructure. Which of the following strategies could aid in tracking adversary capabilities being developed in-house and used during targeting?",
        "choices": [
            "A: Monitoring Internet scan response content for evidence of certificates and malware associated with adversaries.",
            "B: Implementing strict code review policies for all internally developed software within the organization.",
            "C: Analyzing malware for unique adversary features such as compiler used, debugging artifacts, or code similarities.",
            "D: Deploying additional firewalls and intrusion detection systems at the organization's network perimeter."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Internet Scan Response Content"
    },
    {
        "id": "b0a3c93f-700c-4ffb-a589-2ac0918d07c2",
        "source": "owasp_mastg",
        "question": "Why should an Android application developer NOT store cryptographic keys using predictable obfuscation functions or key derivation functions based on stable attributes?",
        "choices": [
            "A: Because it enhances the security of the keys by making them difficult to guess.",
            "B: Because it can lead to performance issues due to the complexity of the obfuscation algorithms.",
            "C: Because these methods provide strong security as they are based on stable and reliable attributes of the system.",
            "D: Because such practices are predictable and can be reverse-engineered, potentially exposing the keys to unauthorized access."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Key Derivation Function"
    },
    {
        "id": "a2f827ad-e4ed-42c5-86b3-c1a9737263e9",
        "source": "attck",
        "question": "Which of the following techniques would an adversary MOST likely use to dynamically establish connections to command and control infrastructure and evade common detections?",
        "choices": [
            "A: Initiating multiple SSL/TLS handshakes to random IP addresses to obfuscate the destination of the actual command and control server.",
            "B: Using malware that shares a common algorithm with the infrastructure to adjust parameters such as domain name, IP address, or port number for command and control.",
            "C: Deploying a static list of fallback IP addresses in malware to ensure continued communication with the command and control server.",
            "D: Registering all potential domain names in advance to ensure that malware can always resolve to a command and control server."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Dynamic Resolution"
    },
    {
        "id": "c91daf7e-5ced-4a89-968d-79564310034b",
        "source": "windows_security",
        "question": "A system administrator receives a notification indicating a security policy has been applied to a set of Windows clients in the network. They want to verify this application was successful. Which security event ID should they look for in the Windows Event Viewer to confirm successful application of the security policy in the group policy objects?",
        "choices": [
            "A: 6144",
            "B: 4046",
            "C: 5027",
            "D: 1280"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Event ID"
    },
    {
        "id": "b2fc7ddf-d036-42ab-b999-60c97d42f03a",
        "source": "owasp_mastg",
        "question": "In a security audit of an iOS mobile application, you discover that sensitive data is being stored insecurely on the device. Which of the following strategies would not be effective in mitigating the risks associated with this vulnerability?",
        "choices": [
            "A: Encrypting the data at rest using strong, industry-standard algorithms.",
            "B: Utilizing the iOS Keychain to store sensitive data with hardware-backed security features.",
            "C: Storing all sensitive data in a remote database and accessing it through secure API calls.",
            "D: Increasing the length of the user session timeout to minimize the frequency of data access."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Sensitive Data Storage"
    },
    {
        "id": "2308b0d7-03e5-4f1c-a151-41bc3f7de2e2",
        "source": "android_sec_doc",
        "question": "In the context of Android keymaster module operations with AES keys, why would the argument 'PaddingMode::NONE is suitable for all block modes including GCM, CTR, ECB, and CBC' be considered incorrect?",
        "choices": [
            "A: Because `PaddingMode::NONE` is only suitable for `BlockMode::GCM` and `BlockMode::CTR`, and for `BlockMode::ECB` or `BlockMode::CBC`, the padding mode may be `PaddingMode::NONE` or `PaddingMode::PKCS7`.",
            "B: Because `PaddingMode::NONE` is incompatible with all block modes and will always result in `ErrorCode::INCOMPATIBLE_PADDING_MODE`.",
            "C: Because `PaddingMode::PKCS7` is the only authorized padding mode for all AES key operations, regardless of the block mode.",
            "D: Because `PaddingMode::NONE` is required for all block modes to ensure the highest level of encryption security."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PaddingMode"
    },
    {
        "id": "55804eb8-0da6-4b0a-9eab-a66e3cbeb157",
        "source": "attck",
        "question": "An organization has discovered that an adversary has modified their authentication process, potentially allowing unauthorized access without valid accounts. As a cybersecurity consultant, which of the following would be the most effective mitigation strategies to recommend? (Select TWO.)",
        "choices": [
            "A: Implementing a robust multi-factor authentication system to reduce the risk associated with compromised credentials.",
            "B: Decreasing the complexity requirements for user passwords to improve the speed of password recovery processes.",
            "C: Ensuring only valid password filters are registered and enabling Protected Process Light (PPL) for LSA.",
            "D: Allowing reversible password encryption to enhance the organization's ability to recover encrypted passwords."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "2456b235-1fea-4bd1-a56a-1b546725c287",
        "source": "attck",
        "question": "An organization is evaluating their detection strategies to identify potential abuse of system services. Which of the following actions would NOT improve the organization's ability to detect adversaries executing commands or programs through system services?",
        "choices": [
            "A: Monitoring for command line invocations of service modification tools that deviate from normal usage patterns.",
            "B: Disabling logging on endpoints to reduce the overhead caused by excessive data collection.",
            "C: Tracking newly created processes that may be leveraging system services for execution.",
            "D: Observing for the construction of new services or daemons that could indicate malicious activity."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Detection Strategies"
    },
    {
        "id": "a6ab20d9-6a0a-473c-870b-5faabbf2eb88",
        "source": "cwe",
        "question": "In the context of addressing a vulnerability related to IOCTL operations using METHOD_NEITHER, which of the following statements accurately reflects a trade-off when choosing an alternative I/O control method?",
        "choices": [
            "A: METHOD_BUFFERED can control the buffer size effectively but may introduce additional overhead due to copying data between user and kernel space.",
            "B: Avoiding validation altogether can save development time but may increase the risk of privilege escalation attacks.",
            "C: Enforcing strict access control might limit the attack surface but could also restrict legitimate use of the IOCTL by other system components.",
            "D: Implementing extensive user input sanitization can prevent buffer overflows but may not be necessary for trusted user environments."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Trade-off"
    },
    {
        "id": "d9b24291-2563-4b6f-8e0d-3965ea255910",
        "source": "attck",
        "question": "A malware sample is programmed to avoid execution if the system is located in a former Soviet country. Which of the following checks would the malware most likely perform to make this determination before executing its payload?",
        "choices": [
            "A: Inspecting the list of installed software for applications predominantly used in former Soviet countries.",
            "B: Reviewing the system's network configuration for use of internet service providers specific to former Soviet countries.",
            "C: Calling the Windows API function `GetLocaleInfoW` to check for locale settings associated with former Soviet countries.",
            "D: Scanning for the presence of Cyrillic characters in system file names as an indicator of a former Soviet country locale."
        ],
        "answer": "C",
        "topics": [
            "PenTest",
            "ApplicationSecurity"
        ],
        "keyword": "Windows API `GetLocaleInfoW`"
    },
    {
        "id": "9bd70193-62c6-4b2c-ac51-88c7fe35e184",
        "source": "owasp_mastg",
        "question": "When attempting to secure a connection to a wireless network on a Linux-based system, a security analyst needs to run the wpa_supplicant command to use WPA/WPA2 for authentication. Which of the following commands should the analyst execute to correctly start the wpa_supplicant daemon, assuming the wireless interface is wlan0 and the configuration file is located at /etc/wpa_supplicant/wpa_supplicant.conf?",
        "choices": [
            "A: wpa_supplicant -d -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf",
            "B: wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf",
            "C: wpa_supplicant -i wlan0 -D wext -c /etc/wpa_supplicant/wpa_supplicant.conf",
            "D: wpa_supplicant -B -D nl80211,wext -i wlan0 -c /etc/wpa_supplicant.conf"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "wpa_supplicant"
    },
    {
        "id": "3c7acdb8-a771-4bfd-9726-cd601bacc873",
        "source": "cwe",
        "question": "Why should critical data elements such as passwords within a software system be declared private instead of public?",
        "choices": [
            "A: Private data elements can be more easily accessed and modified by other parts of the program, thereby simplifying development.",
            "B: Declaring data elements as private helps to protect the data from unauthorized access and accidental modification.",
            "C: Public data elements enhance the flexibility of the code by allowing for easier integration with third-party services.",
            "D: Making data elements public is a requirement for achieving high performance in multi-threaded environments."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DataEncapsulation"
    },
    {
        "id": "59ab406e-5f9f-40f0-aef5-9fcc74d4d4f7",
        "source": "apple_platform_security",
        "question": "An engineer is tasked with ensuring the security of a home entertainment system using HomeKit with Apple TV. They must ensure that third-party remote accessories can securely communicate with Apple TV and that user profiles are managed correctly in accordance with Apple's privacy standards. Which of the following statements are true regarding the security measures implemented by Apple TV in this context?",
        "choices": [
            "A: Apple TV uses a per-session HKDF-SHA512 derived key-pair negotiated over the HomeKit session to encrypt the local network connection with the TV remote.",
            "B: User profiles and settings on Apple TV are shared to the owner’s iCloud account without encryption, allowing for easy access and management.",
            "C: Siri-capable TV remotes send audio data to Apple TV only when the user activates the microphone using the dedicated Siri button.",
            "D: When a user's iTunes account setting is turned off on Apple TV, all account and data related to that user remain on the Apple TV for future access."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HomeKit"
    },
    {
        "id": "d635df5d-31b1-4cec-b285-e7be8b36403b",
        "source": "mit6.858",
        "question": "When designing the interface between an isolated library sandbox and the main application, such as a web browser, which of the following considerations are crucial to prevent security breaches?",
        "choices": [
            "A: Ensuring that pointers in one memory are meaningful in another memory without explicit memory copying.",
            "B: Validating data coming from the library to prevent compromised libraries from returning unexpected error codes or flags.",
            "C: Allowing libraries to call any function in the application as long as it is part of the original API design.",
            "D: Restricting arguments to callback functions to prevent compromised libraries from passing arbitrary pointers."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "interface_security"
    },
    {
        "id": "21c388dd-5877-46a8-a61b-7eeb0c041e65",
        "source": "cs161_textbook",
        "question": "If an anomaly-based detection system is experiencing a high rate of false positives, flagging benign activities as suspicious, which of the following could be a contributing factor?",
        "choices": [
            "A: The system has been trained on a highly diverse dataset of normal behavior patterns, including some anomalies.",
            "B: The system's definition of normal behavior is too broad, allowing many types of attacks to go undetected.",
            "C: The system has been calibrated to be highly sensitive to deviations from the normal, to the point of overfitting to the training data.",
            "D: There is an extensive list of known attack signatures that the system checks each activity against."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "False Positives"
    },
    {
        "id": "e629e09c-5c6f-4d4a-a9ff-5c57f2ddd3e9",
        "source": "attck",
        "question": "An organization is enhancing its monitoring strategy to detect adversarial data archival activities. They propose to solely monitor for the creation of files with extensions commonly associated with compressed or encrypted file types. Which of the following is the most effective counterargument against relying exclusively on this monitoring strategy?",
        "choices": [
            "A: Monitoring only file extensions may not detect custom archival methods that do not use standard file extensions.",
            "B: This strategy will increase the data size being monitored, making it easier to detect exfiltration.",
            "C: Focusing on file extensions will help in identifying all the encrypted data before exfiltration.",
            "D: File extension monitoring is the most comprehensive method for detecting data archival and should be prioritized."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Monitoring strategy"
    },
    {
        "id": "884f2395-9462-4091-ab4d-a979d1f12a01",
        "source": "owasp_mastg",
        "question": "An attacker is attempting to perform a return-to-libc attack on an iOS application to execute malicious code. Which iOS security features are designed to mitigate this type of attack, and how do they function to prevent the attacker's success?",
        "choices": [
            "A: FairPlay Code Encryption decrypts code only on devices associated with the attacker's account, limiting the attack surface.",
            "B: ASLR randomizes the memory location of program files and libraries, making it difficult for the attacker to predict specific memory addresses.",
            "C: The XN mechanism marks certain memory segments as non-executable, preventing execution of injected machine code.",
            "D: Sandboxing restricts app processes to their own directories, which allows execution of unauthorized dynamic code."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "MemorySafety"
        ],
        "keyword": "Return-to-libc Attack"
    },
    {
        "id": "6f4bec5f-34fe-4745-852b-7d648102721e",
        "source": "cwe",
        "question": "A developer is configuring the initialization of network resources for a product that will be deployed across various environments. Which of the following practices should the developer implement to ensure the product runs reliably and securely?",
        "choices": [
            "A: Use a configuration file or environment variables to specify network resource identifiers.",
            "B: Embed the network resource identifiers directly within the code to guarantee consistency across deployments.",
            "C: Retrieve the network resource identifiers from a secure, centralized configuration service at runtime.",
            "D: Hard-code the network resource identifiers as fallback defaults in case external configurations fail."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Configuration"
    },
    {
        "id": "7c6de9ab-aa86-412e-91ff-3ce5d6601694",
        "source": "mit6.858",
        "question": "How does the unique device identifier (ECID) contribute to the security of the mobile device's boot process?",
        "choices": [
            "A: It ensures that each device has a unique boot sequence, making it difficult for an adversary to predict the boot process and inject malicious code.",
            "B: It allows Apple's servers to sign upgrades specifically for a device's ECID, preventing adversaries from installing an out-of-date OS kernel.",
            "C: It creates a unique encryption key for each device's storage, which is used to encrypt the Boot ROM and iBoot loader.",
            "D: It enables the boot sequence to verify that the signature of the iBoot and OS kernel corresponds to the specific device, thwarting downgrade attacks."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "ECID"
    },
    {
        "id": "fd8738c8-f3e4-4666-b98d-896754054bc1",
        "source": "cwe",
        "question": "In a recent security audit of an application, it was discovered that the PRNG used for cryptographic operations occasionally fails in a weak way, leading to predictable outcomes. What could be the cause of this issue, and how should it be addressed?",
        "choices": [
            "A: The PRNG might not be re-seeding itself with high-quality entropy sources; consider implementing a PRNG that re-seeds with hardware devices.",
            "B: The PRNG may not conform to recognized standards; ensure it meets FIPS 140-2 standards, specifically the guidelines in Annex C.",
            "C: The PRNG could be using a weak algorithm; replace it with a more secure one that provides a consistent level of protection.",
            "D: The application might not require high entropy; verify if low entropy PRNG is acceptable for its security needs."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Entropy"
    },
    {
        "id": "4c2c6b36-8a33-47ca-886b-10f8fcd116ff",
        "source": "attck",
        "question": "To mitigate the risk of adversaries discovering cloud infrastructure, an organization is reviewing its user account management practices. Which of the following strategies should the organization consider implementing?",
        "choices": [
            "A: Reduce the number of users with administrative privileges and perform periodic entitlement reviews on IAM users, roles, and policies.",
            "B: Increase the number of users within the organization with an IAM role that has administrative privileges for improved incident response times.",
            "C: Grant all users access to discover cloud infrastructure to decentralize the risk of a single point of compromise.",
            "D: Implement a permanent privileged role assignment for all users to streamline access to cloud infrastructure."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "User Account Management"
    },
    {
        "id": "99531e57-3de6-4cf8-87f1-535228c0939d",
        "source": "attck",
        "question": "A penetration tester is evaluating a system that has been compromised. Which of the following findings would suggest that the adversary used a technique similar to the one identified in ATT&CK ID T1112?",
        "choices": [
            "A: The tester discovers several Registry keys with names prepended by a null character.",
            "B: The tester finds that the system's antivirus software has been uninstalled.",
            "C: The tester notices that the firewall settings have been set to allow all incoming connections.",
            "D: The tester observes that user account control (UAC) settings have been set to their lowest level."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Registry Key Persistence"
    },
    {
        "id": "a70a4813-25a6-4122-b347-50ee1b4cabc7",
        "source": "apple_platform_security",
        "question": "When evaluating the privacy and security features of Apple's Find My service, which of the following statements accurately reflect the mechanisms that contribute to preserving user privacy while maintaining location accuracy for missing devices? (Select all that apply.)",
        "choices": [
            "A: The encryption of location information by finder devices using the public key Pi ensures that Apple cannot access the decrypted location data.",
            "B: The traffic sent to Apple contains no authentication information, which prevents Apple from knowing the identity of the finder or the owner of the found device.",
            "C: The use of a single, persistent Bluetooth public key for location broadcasting allows finder devices to detect and report the location of a missing device without compromising privacy.",
            "D: The periodic replacement of the public key Pi and the use of a server index based on the SHA256 hash of Pi prevent persistent tracking of the device and enhance privacy."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "PrivacyProtection"
    },
    {
        "id": "5b245412-af4b-4202-b87c-5f46603d33f0",
        "source": "owasp_mastg",
        "question": "An iOS application has been designed to allow users to scan QR codes to access event information. During the security assessment, you notice that the app requests permission to access the user's photo library. Which of the following reasons could justify the app's request for this permission?",
        "choices": [
            "A: The app needs to store scanned QR code images in the user's photo library for future reference.",
            "B: Access to the photo library is a default requirement for all apps that utilize the camera.",
            "C: The app offers a feature to upload a QR code image from the photo library for scanning.",
            "D: The app requires access to the photo library to save event information as images."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "iOS app permissions"
    },
    {
        "id": "c21562e1-47e9-4eb7-9e77-f8b2fa65daa6",
        "source": "owasp_wstg",
        "question": "In the context of server-side web applications, why is proper input validation critical in preventing code injection attacks?",
        "choices": [
            "A: Input validation ensures that only numerical data is accepted, which inherently prevents code execution.",
            "B: It enables the application to distinguish between code and data by enforcing input constraints, thus preventing malicious input from being executed as code.",
            "C: Validation of input is important primarily for user experience, not security, and has no effect on code injection risks.",
            "D: Input validation eliminates the need for other security measures like firewalls and intrusion detection systems."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Input Validation"
    },
    {
        "id": "968c0cc1-2180-462f-a281-a93687c57d35",
        "source": "cs161_textbook",
        "question": "A company is designing a new local area network (LAN) for its office building. The network engineer has to ensure the correct addressing at various layers of the OSI model to facilitate both intra-office and internet communications. Given the following scenarios, select the appropriate addressing methods that should be used:",
        "choices": [
            "A: For a printer that needs to be uniquely identified within the office network for document printing jobs, a MAC address should be assigned.",
            "B: For a server that needs to be accessible globally from the internet, a 16-bit port number should be assigned.",
            "C: For an internal web application that requires distinguishing between multiple simultaneous user sessions from the same device, a 32-bit IP address should be assigned.",
            "D: For a departmental file sharing service that operates within the office LAN, a MAC address should be used to uniquely identify each client machine."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Addressing"
    },
    {
        "id": "483f12bd-952c-440b-adda-513b2823031e",
        "source": "apple_platform_security",
        "question": "An IT security manager is considering the implications of enabling or disabling FileVault on Mac computers with Apple silicon in the organization. They are discussing with the team what the outcomes would be in terms of security for internal storage devices based on their operational mode. Which of the following statements accurately describe the security implications of FileVault's status?",
        "choices": [
            "A: With FileVault turned on, the volume encryption key is wrapped with the class key and protected by the user's password and the hardware UID.",
            "B: When FileVault is turned off, the volume encryption key is left unprotected and sensitive data is at risk if the storage device is compromised.",
            "C: If FileVault is enabled after the initial setup, an anti-replay mechanism prevents the old key from decrypting the volume, enhancing security.",
            "D: Disabling FileVault renders the internal storage data permanently inaccessible as the Secure Enclave erases all cryptographic keys."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "FileVault"
    },
    {
        "id": "9fc20d03-8a7e-4fe1-9a55-8f3190455863",
        "source": "cwe",
        "question": "A software developer is reviewing the code for an application that processes user-uploaded files. One module of the application is responsible for opening files and directories. The developer is concerned about potential security risks related to the handling of Windows shortcuts (.LNK files). Which of the following scenarios poses a security risk that needs mitigation?",
        "choices": [
            "A: The application opens .LNK files and follows their target path without verifying the legitimacy or safety of the target location.",
            "B: The application uses a whitelist of approved file extensions and rejects .LNK files from being processed.",
            "C: The application checks the file extension and only processes .LNK files if they point to a target within the application's predefined directory.",
            "D: The application parses .LNK files and extracts metadata for logging purposes but does not follow the target path."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "ShortcutVulnerability"
    },
    {
        "id": "f02f8076-638f-4e90-add3-cd99d0ec9677",
        "source": "windows_security",
        "question": "An IT security analyst is reviewing the Security event log on a Windows 10 computer and comes across an event with ID 6419 indicating a request to disable a device. Which of the following pieces of information can the analyst expect to find in the event details to further investigate the request? (Select TWO.)",
        "choices": [
            "A: The account name of the user whose device is being disabled",
            "B: The hexadecimal value of the Logon ID correlating with the user's current session",
            "C: The result of the attempt to disable the device",
            "D: The hardware serial number of the device being disabled"
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Windows Security Event Log"
    },
    {
        "id": "9674bd39-7c70-4e7e-bb76-b41c26459888",
        "source": "owasp_wstg",
        "question": "When comparing penetration testing methodologies, what could be a significant advantage of using the Penetration Testing Execution Standard (PTES) over the Open Source Security Testing Methodology Manual (OSSTMM) for an organization that wants a structured approach to testing that includes post-exploitation activities and detailed reporting?",
        "choices": [
            "A: PTES provides a structured 7-phase approach including post-exploitation and reporting, which is ideal for organizations seeking comprehensive guidelines.",
            "B: OSSTMM includes post-testing activities, but it mainly focuses on operational security, which may not be as structured as what PTES offers.",
            "C: PTES lacks guidance on post-exploitation activities, making OSSTMM the better choice for structured testing and reporting.",
            "D: OSSTMM’s focus on physical and human security testing makes it more comprehensive than PTES for structured penetration testing."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "PTES"
    },
    {
        "id": "f598749d-e147-44c3-b6ec-65e59143cb0f",
        "source": "attck",
        "question": "A company has identified a potential data leak incident in which sensitive information was moved to a USB drive. As a security analyst, you are tasked with recommending measures to mitigate such incidents in the future. Which of the following measures would be effective in preventing data exfiltration via physical media? (Select TWO.)",
        "choices": [
            "A: Implement device control to monitor and restrict USB device usage on the network.",
            "B: Increase the complexity of file access permissions on the company's cloud storage.",
            "C: Disable Autorun features and remove unnecessary physical media features or programs.",
            "D: Deploy a network intrusion detection system to monitor for external IP address communications."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Data Loss Prevention"
    },
    {
        "id": "f73b1250-d13d-4215-a58d-b31bd93a6543",
        "source": "cwe",
        "question": "In a transaction system where a Security Identifier is supposed to qualify transactions, failure to include this identifier could lead to various security issues. What are the possible immediate and broader implications of a transaction being sent without the necessary Security Identifier?",
        "choices": [
            "A: The immediate implication is that the destination agent might execute the transaction as if it came from a trusted source, potentially leading to unauthorized access.",
            "B: The immediate implication is that the destination agent might drop the transaction, resulting in a Denial-of-Service (DoS) condition.",
            "C: The broader implication could be a systemic weakening of security protocols, leading to an increased risk of privilege escalation across the system.",
            "D: The broader implication could be that the transaction system's integrity remains intact, as other security measures compensate for the missing identifier."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityConsequences"
    },
    {
        "id": "54bc5eb4-b247-4cab-97f6-73c09bf1808d",
        "source": "windows_security",
        "question": "A company is planning to deploy Windows Hello for Business using a hybrid key trust model. They currently have a Windows Server-based PKI in place. As the security administrator, you are tasked with configuring domain controllers to facilitate secure authentication. Which of the following steps are necessary to ensure the domain controllers are prepared for Windows Hello for Business authentication?",
        "choices": [
            "A: Install a certification authority on a domain controller and configure it for basic certification authority.",
            "B: Publish a certificate revocation list to a location accessible to Microsoft Entra joined devices.",
            "C: Ensure the KDC Authentication OID is included in the domain controller certificate for hybrid joined devices.",
            "D: Configure Active Directory user accounts for public key mapping using Microsoft Entra Connect Sync."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Public Key Infrastructure (PKI)"
    },
    {
        "id": "4d86c3b8-64c9-48e5-b650-c4dfc9acd7b7",
        "source": "apple_platform_security",
        "question": "As an IT security consultant, you are reviewing the security features of Apple's financial services for a client. Based on your knowledge of Apple Cash and Tap to Pay on iPhone services, which of the following statements correctly describe their security measures?",
        "choices": [
            "A: Apple Cash uses a Secure Element to store transaction data, which is used for troubleshooting, fraud prevention, and regulatory purposes.",
            "B: Tap to Pay on iPhone does not store transaction information that can be tied back to the payer, and the payment card information (PAN) is not accessible to the merchant.",
            "C: When using Apple Cash in iMessage, transactions are initiated without the need for two-factor authentication on the iCloud account.",
            "D: To enable Apple Cash for family members under the age of 18, no identity verification is needed for the family organiser with Apple Cash."
        ],
        "answer": "AB",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Apple Cash Security"
    },
    {
        "id": "bde747d4-9c70-48bc-a3bd-3423c97693fe",
        "source": "cwe",
        "question": "A software development team is considering the implementation of a security mechanism to protect sensitive data in their new application. They have proposed two different approaches. Evaluate the potential security implications of each approach based on the principles of 'Economy of Mechanism':\n\nApproach 1: Implementing an elaborate encryption scheme with multiple layers of dynamically changing keys and proprietary algorithms to deter reverse engineering.\n\nApproach 2: Utilizing a well-known, standard encryption protocol with a strong track record of security and a straightforward implementation.",
        "choices": [
            "A: Approach 1 may be more secure due to its complexity and proprietary nature, making it harder for attackers to understand and exploit.",
            "B: Approach 2 is likely to be more secure, as its simplicity makes it easier to implement correctly and reduces the risk of configuration errors.",
            "C: Approach 1 could result in partial implementations and compatibility problems due to its complexity, leading to potential security vulnerabilities.",
            "D: Approach 2 may introduce vulnerabilities because standard protocols are well-understood by attackers and more likely to be targeted."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Complexity"
    },
    {
        "id": "1265496f-54b3-471d-baf8-e9d8bd603c06",
        "source": "windows_security",
        "question": "Which of the following policies is least likely to enhance the security of a Windows application?",
        "choices": [
            "A: Regularly updating the application to patch identified vulnerabilities.",
            "B: Restricting the application's network permissions to only what is necessary for its operation.",
            "C: Storing sensitive user data in plaintext within the application to simplify data retrieval.",
            "D: Utilizing secure coding practices to minimize the risk of introducing security flaws."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Plaintext Data Storage"
    },
    {
        "id": "89d7714d-bae4-4d77-8eb0-41f571e94c9e",
        "source": "d3fend",
        "question": "A software development company wants to protect its application from being exploited through buffer overflow attacks. Which of the following hardening techniques would directly mitigate this specific vulnerability?",
        "choices": [
            "A: Message Encryption",
            "B: Stack Frame Canary Validation",
            "C: Certificate Pinning",
            "D: User Account Permissions"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "MemorySafety",
            "PenTest"
        ],
        "keyword": "Buffer Overflow"
    },
    {
        "id": "9fa7566c-64ac-4eb5-84d2-49ad7c74b903",
        "source": "attck",
        "question": "An adversary, with Administrator privileges over a network, has registered a rogue Domain Controller through the DCShadow method. What is the most likely immediate outcome of this action?",
        "choices": [
            "A: The rogue Domain Controller will automatically be isolated by the Active Directory schema due to unrecognized server objects.",
            "B: The adversary will be able to replicate unauthorized changes into the Active Directory infrastructure, such as altering credentials and keys.",
            "C: All Active Directory replication will cease until the rogue Domain Controller is authenticated by a legitimate Domain Controller.",
            "D: The rogue Domain Controller will trigger an automatic full schema audit by the Active Directory system."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "DCShadow"
    },
    {
        "id": "017b71e5-a989-455c-befa-96ee53dda7ab",
        "source": "owasp_mastg",
        "question": "In which of the following scenarios would using a system-wide proxy in the network settings of a mobile device NOT be a suitable method for intercepting the mobile application's network traffic?",
        "choices": [
            "A: The mobile app uses standard HTTP APIs or popular libraries like okhttp.",
            "B: The mobile application is developed with a platform like Xamarin that ignores system proxy settings.",
            "C: The mobile application has built-in mechanisms to verify if a system proxy is in use and refuses to send requests through it.",
            "D: The mobile application only communicates with backend services using HTTP and HTTPS protocols."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "System Proxy Settings"
    },
    {
        "id": "948842cd-b8b0-4278-984b-c8f3f9a1cfaf",
        "source": "mozilla_security",
        "question": "A web developer suggests using robots.txt to prevent sensitive sections of the website from being discovered by attackers. What is the most effective counterargument to this suggestion?",
        "choices": [
            "A: Robots.txt is primarily used for SEO purposes, not for security measures.",
            "B: Attackers do not use automated crawlers and hence robots.txt would be ineffective.",
            "C: Robots.txt is publicly accessible and can actually aid attackers in discovering sensitive directories.",
            "D: Sensitive sections are protected by authentication, making the use of robots.txt redundant."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Sensitive Directory Disclosure"
    },
    {
        "id": "7e6a32b7-6914-415d-91c3-7990bddc12d1",
        "source": "android_sec_doc",
        "question": "A developer is adding a new system process that relies on an existing Android Open Source Project (AOSP) Hardware Abstraction Layer (HAL). To ensure proper operation and maintain compatibility with potential framework-only updates, where should the policy for this new system component be placed and why?",
        "choices": [
            "A: The policy should be placed in `system/sepolicy/public` to allow interaction across the `system/vendor` interface and to be updated with framework-only OTA updates.",
            "B: The policy should be placed in `system/sepolicy/private` because it is interacting through an interface already established by AOSP and needs to be isolated from framework-only OTA updates.",
            "C: The policy should be placed in `device/manufacturer/device-name/sepolicy` to keep the system policy unaware of vendor-specific details.",
            "D: The policy should be placed in `system/sepolicy/public` and remove existing AOSP policy to ensure compatibility with the new system component."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "0b13218e-02ae-4bd4-bd5e-bfe64e61a266",
        "source": "owasp_mastg",
        "question": "In a security review of an iOS mobile application, you identify a function that transmits sensitive data to a remote server. Which of the following implementations would be considered a vulnerability that needs to be addressed?",
        "choices": [
            "A: The application uses SSL pinning to ensure it communicates only with the intended server.",
            "B: Sensitive data is transmitted over an encrypted channel using HTTPS with a valid certificate.",
            "C: Sensitive data is transmitted over HTTP in a GET request with parameters visible in the URL.",
            "D: The application uses certificate transparency logs to verify the authenticity of the server's certificate."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Data Transmission Vulnerability"
    },
    {
        "id": "c21b724f-45a7-48de-b338-ba1882b7e19c",
        "source": "windows_security",
        "question": "A security analyst is reviewing a Windows security event log entry for event 4670(S), which indicates that permissions on an object were changed. What information can be deduced from this event, and what information is NOT directly provided by the event?",
        "choices": [
            "A: The security analyst can deduce the type of object whose permissions were changed and the new permissions set; however, the SACL changes are not logged by the event.",
            "B: The security analyst can identify the user who changed the permissions and the exact time of the change; however, the previous owner of the object is not provided by the event.",
            "C: The security analyst can ascertain the process through which the permissions were changed and the old permissions; however, the reason for the permission change is not logged by the event.",
            "D: The security analyst can determine the previous and new security descriptors in SDDL format; however, the specific files accessed as a result of the permission change are not provided by the event."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Descriptor Definition Language (SDDL)"
    },
    {
        "id": "b1c57d01-b009-458c-9e0d-84aef19aa760",
        "source": "attck",
        "question": "A cybersecurity team is reviewing their mitigation strategies against Access Token Manipulation attacks. Which of the following mitigation strategies would NOT be effective against the described threat?",
        "choices": [
            "A: Restricting the ability of users to create tokens through Group Policy settings.",
            "B: Enabling detailed command-line logging to detect usage of the `runas` command.",
            "C: Utilizing heuristic detection methods to identify unusual process behaviors.",
            "D: Increasing the frequency of privileged account password rotations."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Mitigation Strategy"
    },
    {
        "id": "58fa94fb-ce05-4ea1-975f-e9e2ecbc7e98",
        "source": "attck",
        "question": "A penetration tester is analyzing a malware sample that is suspected of capturing screenshots on infected machines. The malware sample in question is found to be using Windows GDI+ library functions to achieve its goal. Which of the following malware families is the tester likely analyzing based on the behavior observed?",
        "choices": [
            "A: MacSpy, which uses Apple's Core Graphic APIs",
            "B: MuddyWater, which uses its own screenshot mechanism",
            "C: Woody RAT, which uses Windows GDI+ for screen capture",
            "D: MacMa, which relies on `CGWindowListCreateImageFromArray`"
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Windows GDI+"
    },
    {
        "id": "76d17c2e-bbae-4508-8e0b-665a38fc965a",
        "source": "attck",
        "question": "An adversary planning to compromise a company’s infrastructure is likely to leverage open technical databases in the reconnaissance phase. Which of the following reasons best explains why an adversary would search WHOIS databases specifically?",
        "choices": [
            "A: To identify vulnerable web applications based on outdated software versions.",
            "B: To gather information on domain registration and associated entities for the company.",
            "C: To analyze the company's code repositories for exposed sensitive data.",
            "D: To map the internal network topology of the company."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "WHOIS"
    },
    {
        "id": "4f923c67-7efe-4710-9ce6-8e92af98e293",
        "source": "owasp_wstg",
        "question": "In a scenario where a security testing team identifies high-risk vulnerabilities in a web application shortly before its scheduled release, which measures should be prioritarily considered to handle the situation appropriately?",
        "choices": [
            "A: Proceed with the application deployment and address the vulnerabilities in a post-release patch if they are exploited.",
            "B: Discuss with information security officers to analyze the potential risks and decide whether to accept the risks or require immediate remediation.",
            "C: Ignore the findings since last-minute changes could introduce new bugs and delay the release schedule.",
            "D: Automatically accept all risks associated with the vulnerabilities as part of the standard risk management procedure."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Risk Management"
    },
    {
        "id": "f300e054-f7ab-4873-8232-1dba3078e664",
        "source": "cwe",
        "question": "Which of the following code snippets is most likely to introduce the vulnerability of inserting sensitive information into sent data?",
        "choices": [
            "A: HttpResponse response = new HttpResponse(); response.setContent(\"Error: Invalid user input\");",
            "B: throw new RuntimeException(\"Database connection failed. User 'admin' with password '12345' cannot connect.\");",
            "C: User user = userService.authenticateUser(username, password); if(user == null) { throw new AuthenticationException(\"User authentication failed.\"); }",
            "D: log.error(\"Attempt to access unauthorized resource by user \" + user.getUsername());"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SensitiveDataLeak"
    },
    {
        "id": "10f5a4e3-3be0-4416-ab95-b46e3f31907c",
        "source": "mozilla_security",
        "question": "A web application developer is implementing cookie-based session management. Which of the following cookie attributes should the developer set to enhance security, and why?",
        "choices": [
            "A: Set the Secure flag to ensure the cookie is only sent over HTTPS, preventing exposure on unencrypted channels.",
            "B: Omit the Secure flag to allow cookies to be sent over both HTTP and HTTPS, increasing the availability of the website.",
            "C: Set the HttpOnly flag to allow the cookie to be accessed by client-side scripts, thus enhancing the user experience.",
            "D: Use Same-site=None to strictly enforce that cookies are only sent with same-site requests, improving isolation."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Secure flag"
    },
    {
        "id": "80236cbe-8fac-426c-9544-1a03ba1ed2c6",
        "source": "attck",
        "question": "A security team is configuring detection mechanisms for their SharePoint and Confluence platforms to identify potential malicious activity. What kind of detection mechanism would be most effective in identifying an adversary leveraging these platforms to mine valuable information?",
        "choices": [
            "A: Set up alerts for excessive printing activities from network-connected printers.",
            "B: Monitor and alert on privileged user access to information repositories and users retrieving a large number of documents.",
            "C: Install antivirus software on all endpoints to prevent malware from compromising information repositories.",
            "D: Enable full disk encryption on all devices to protect the information at rest."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Monitoring Information Repositories"
    },
    {
        "id": "f33bcf29-a1ee-4cd5-82bf-ac002975b211",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security testing, you suspect that some processes may be using the WiFi interface, which could interfere with your testing activities. To ensure a proper testing environment, you decide to use a command-line tool to check and terminate any such processes. Which command would you use to achieve this?",
        "choices": [
            "A: $ sudo ifconfig wlan0 down",
            "B: $ airmon-ng check kill",
            "C: $ netstat -tulnap | grep ':80'",
            "D: $ iwconfig wlan0 --release"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "airmon-ng"
    },
    {
        "id": "84bdc80d-820e-47a2-aad4-1a06531f6310",
        "source": "owasp_wstg",
        "question": "A security consultant is reviewing the Content Security Policy of a web application and comes across the following CSP header configuration:\n\nHTTP\nContent-Security-Policy: script-src 'nonce-r4nd0m'; object-src 'none'; base-uri 'none';\n\n\nWhich of the following statements accurately reflects a potential vulnerability in this CSP configuration?",
        "choices": [
            "A: The CSP does not restrict the sources for CSS, which could expose the application to style-based injection attacks.",
            "B: The use of the 'nonce-r4nd0m' value for script-src eliminates the risk of Cross-Site Scripting (XSS) attacks completely.",
            "C: The object-src directive set to 'none' unnecessarily restricts the loading of objects, leading to reduced functionality.",
            "D: Setting the base-uri directive to 'none' prevents the application from defining a base URI, which could lead to HTML base tag injection attacks."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSP Directive"
    },
    {
        "id": "7c74ff1d-9c67-4607-bd0e-8d6b63ca45fb",
        "source": "cwe",
        "question": "You are responsible for overseeing the installation of a new software system in your organization. To safeguard against the risk of trapdoors, which of the following steps should you take to ensure the integrity of the software?",
        "choices": [
            "A: Conduct a thorough code review focusing on authentication and network communication segments.",
            "B: Check for digital signatures and compare hash values of the software with known trusted sources.",
            "C: Install the software in a sandbox environment to monitor its behavior for a set period.",
            "D: Limit the permissions of the software to read-only access to reduce the risk of unauthorized changes."
        ],
        "answer": "B",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Trapdoor"
    },
    {
        "id": "39d14c7a-364d-4d41-b07b-5867ef55d56d",
        "source": "owasp_wstg",
        "question": "A security audit has revealed that a web application creates new user accounts with a default password pattern 'Welcome1234', which increments numerically for each new user (e.g., 'Welcome1235' for the next user). What is the primary security concern with this practice?",
        "choices": [
            "A: The numerical incrementation makes the password more secure by adding complexity.",
            "B: Using 'Welcome' as the password prefix is a secure practice as it is friendly and welcoming to new users.",
            "C: Passwords that follow an easily discernible pattern can be predicted and are susceptible to brute-force attacks.",
            "D: Incrementing passwords numerically aids in user account management and auditing."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Brute-Force Attack"
    },
    {
        "id": "383fb0c2-b431-43d9-88cc-71d97a9d8dc6",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating an incident where an adversary gained administrative privileges and initially went undetected within an organization's network. The adversary modified domain policies to escalate privileges and evade defenses. Which of the following actions would be the most likely taken by the adversary to abuse the domain policies in this scenario?",
        "choices": [
            "A: Reducing the frequency of password changes to extend the use of compromised credentials.",
            "B: Altering domain Group Policy Objects to deploy a malicious Scheduled Task.",
            "C: Disabling local firewalls on all endpoints to ease lateral movement.",
            "D: Creating a new user account with guest privileges for reconnaissance purposes."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Domain Policy Modification"
    },
    {
        "id": "dc97526a-b305-49c6-a4d8-10f5d5bee3e4",
        "source": "owasp_mastg",
        "question": "An Android application is designed with the following permission in its manifest file:\n\nxml\n<permission name=\"android.permission.ACCESS_FINE_LOCATION\" >\n    <group gid=\"location\" />\n</permission>\n\n\nGiven the output of the `id` command for the application's process is shown below:\n\nbash\nuid=10234(u0_a234) gid=10234(u0_a234) groups=10234(u0_a234),3003(inet),10234(all_a234) context=u:r:untrusted_app:s0:c512,c768\n\n\nWhich of the following statements accurately describes the app's permissions with respect to accessing the device's fine location?",
        "choices": [
            "A: The app has the 'ACCESS_FINE_LOCATION' permission because it belongs to the 'location' group.",
            "B: The app does not have the 'ACCESS_FINE_LOCATION' permission because it does not belong to the 'location' group.",
            "C: The app has the 'ACCESS_FINE_LOCATION' permission by default since all apps have access to fine location unless explicitly denied.",
            "D: The app does not have the 'ACCESS_FINE_LOCATION' permission because it has the 'inet' group ID, which is unrelated to location permissions."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "group ID"
    },
    {
        "id": "41af35e8-8a8e-4202-81bc-8bc5dd6aef0e",
        "source": "attck",
        "question": "An attacker has established a foothold in a corporate network and is planning to automate the collection of sensitive documents. Which of the following techniques might the attacker employ to achieve this goal without manual intervention?",
        "choices": [
            "A: Use of Command and Scripting Interpreter to periodically search and copy files matching certain criteria.",
            "B: Deploy custom antivirus software to protect collected data from being detected by network security systems.",
            "C: Manually copying files from each system to a centralized location within the network.",
            "D: Utilize social engineering to convince network administrators to compile and send the data."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Command and Scripting Interpreter"
    },
    {
        "id": "a2440bd7-65ff-45c6-aa68-3eb0018c53db",
        "source": "attck",
        "question": "An enterprise network utilizes third-party software deployment systems for administration purposes. Following best security practices, which of the following mitigations would be most effective in preventing adversaries from exploiting these systems for lateral movement or remote code execution?",
        "choices": [
            "A: Permit unrestricted remote access to deployment systems to monitor for unusual activity.",
            "B: Patch deployment systems regularly to prevent potential remote access through exploitation.",
            "C: Grant access to deployment systems to all users to increase the transparency of software distribution.",
            "D: Implement network segmentation to isolate critical systems and use firewalls to control traffic."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "bac3e3e0-a11e-403c-8dfe-8a6efd9b1d17",
        "source": "windows_security",
        "question": "You are consulting on security policies for a company's Windows servers. The IT department proposes disabling the built-in administrator account for security reasons. What are some potential drawbacks of this approach?",
        "choices": [
            "A: It could prevent unauthorized users from gaining administrative access.",
            "B: It might lead to administrative lockout if no other administrative accounts are available.",
            "C: It can offer an additional layer of security through obscurity.",
            "D: It may reduce the overall number of accounts that could be compromised."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Administrator Account Management"
    },
    {
        "id": "9b40b7bd-219d-4559-8194-f6d669e96608",
        "source": "attck",
        "question": "If a cybersecurity analyst is setting up a detection mechanism for firmware corruption on company devices, which of the following approaches would be the least effective and why?",
        "choices": [
            "A: Monitoring changes to the firmware for unexpected modifications, which does not account for legitimate updates.",
            "B: Logging attempts to read/write to BIOS and comparing against known patching behavior, but this may generate false positives if legitimate software behaves similarly.",
            "C: Checking for the presence of known malware bootloaders, which may not detect novel or unknown malware strategies.",
            "D: Inspecting network traffic for signs of firmware tampering, which may not detect local attacks that do not involve network communication."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Firmware Modification Detection"
    },
    {
        "id": "30ddec76-0262-48b1-aeb3-dd97cd0ca781",
        "source": "cs161_textbook",
        "question": "A security analyst is reviewing the code of a web application that uses SHA256 for password hashing. The analyst is asked to present arguments for and against the continuation of this practice. What are the reasons that support changing to a different password hashing strategy? (Select all that apply)",
        "choices": [
            "A: SHA256 is not collision-resistant, hence there is a risk that two different passwords might produce the same hash.",
            "B: SHA256 is designed to be fast, which could allow an attacker to test billions of password guesses rapidly in an offline password guessing attack.",
            "C: The use of SHA256 hashes allows for amortized guessing attacks, where the same guesses can be reused across multiple users, speeding up the attack process.",
            "D: SHA256 lacks a built-in salting mechanism, which means it is vulnerable to rainbow table attacks unless additional measures are implemented."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SHA256"
    },
    {
        "id": "0435bcd3-626d-494f-92a8-1371e0e70ab1",
        "source": "windows_security",
        "question": "Which of the following statements is NOT true about the Process Mitigation Options available in Windows 10 for 64-bit applications?",
        "choices": [
            "A: Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the SEH overwrite technique.",
            "B: Data Execution Prevention (DEP) marks memory pages as non-executable to prevent code from running in those regions.",
            "C: Address Space Layout Randomization (ASLR) prevents the execution of code by marking pages of memory as non-executable.",
            "D: DEP-ATL thunk emulation allows the system to handle NX faults originating from the ATL thunk layer."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "MemorySafety"
        ],
        "keyword": "ASLR"
    },
    {
        "id": "1924d6ed-68b2-4cab-8815-474344b19b0b",
        "source": "cs161_textbook",
        "question": "Alice and Bob are using a MAC function to ensure the integrity and authenticity of their communications. They're considering four different MAC functions to use. Which of the following MAC functions could potentially lead to a confidentiality breach of the messages?",
        "choices": [
            "A: A MAC function that appends the message plaintext to a valid MAC of the message.",
            "B: A MAC function that utilizes a block cipher with the property of not leaking plaintext information.",
            "C: A MAC function that is based on a cryptographic hash function that maintains its properties.",
            "D: A MAC function that allows reversing the MAC to obtain the message, given that the key is known."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Confidentiality"
    },
    {
        "id": "5243e0ec-b17b-48ff-87ba-9c97adff8b43",
        "source": "attck",
        "question": "A company is reviewing its cybersecurity strategy to better defend against adversaries using data obfuscation techniques for command and control operations. They are considering the implementation of network intrusion prevention systems. Which obfuscation technique would likely be the least mitigated by network intrusion prevention systems that use network signatures?",
        "choices": [
            "A: Junk Data",
            "B: Steganography",
            "C: Protocol Impersonation",
            "D: Embedding C2 responses in the source code of a fake webpage."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Intrusion Prevention"
    },
    {
        "id": "7cbb6109-00db-4be9-b95a-57885a5d3367",
        "source": "attck",
        "question": "As a security consultant, you are tasked with strengthening an organization's defenses against account enumeration attacks. Which of the following mitigation strategies would be least effective in preventing adversaries from discovering valid user accounts, and why?",
        "choices": [
            "A: Disabling the enumeration of administrator accounts through Group Policy settings, as it does not address the use of other built-in commands by adversaries.",
            "B: Monitoring command execution history for cloud API calls used for account discovery, as it may be circumvented by direct file system access.",
            "C: Restricting access to file resources that contain local accounts and group information, as it may be bypassed by adversaries with high privileges.",
            "D: Implementing a policy to monitor and filter outbound traffic to prevent data exfiltration of account lists, as this does not directly prevent account enumeration."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Group Policy"
    },
    {
        "id": "6d1cd0b3-f193-4607-a3e4-83d83fdd027a",
        "source": "owasp_mastg",
        "question": "When developing a mobile application, which practice should be avoided to prevent potential security and privacy breaches?",
        "choices": [
            "A: Encrypting log files using secure algorithms before storing them locally.",
            "B: Logging sensitive information that may expose data to attackers or violate user confidentiality.",
            "C: Using built-in logging mechanisms like the Log Class or Logger Class for debugging purposes.",
            "D: Sending encrypted log files to a secure endpoint when the application regains online connectivity."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Sensitive Data Logging"
    },
    {
        "id": "b718daa1-9b47-46b2-a7be-4ed4671ef61c",
        "source": "apple_platform_security",
        "question": "Evaluate the security measures and limitations for Apple's Face ID and Touch ID technologies. Select the statements that accurately reflect the described security implementations and limitations.",
        "choices": [
            "A: Face ID utilizes a structured light technique that projects a customizable random pattern to prevent spoofing attempts.",
            "B: Touch ID's fingerprint analysis retains minutiae data to ensure the highest level of accuracy during authentication.",
            "C: Face ID adapts to physical changes in the user's appearance and can authenticate even when the user is wearing a mask using advanced neural networks.",
            "D: The Magic Keyboard with Touch ID stores biometric template data and enforces security policies for Mac devices with Apple silicon."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "07973067-682b-4ba2-bc13-f41657d0c0ef",
        "source": "owasp_wstg",
        "question": "You are reviewing a web application's client-side code and encounter the following JavaScript snippet susceptible to URL redirection vulnerabilities:\n\njs\nvar redir = location.hash.substring(1);\nif (redir) {\n    window.location='http://'+decodeURIComponent(redir);\n}\n\n\nWhich of the following measures would best mitigate the vulnerability present in this code?",
        "choices": [
            "A: Implement server-side validation of the 'redir' variable before redirection.",
            "B: Use a regular expression to whitelist specific URLs that can be assigned to 'window.location'.",
            "C: Remove the 'redir' variable and use static URLs for redirection.",
            "D: Encode the 'redir' variable using Base64 encoding before assigning it to 'window.location'."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "URL Whitelisting"
    },
    {
        "id": "acffcf83-2f96-4e32-b53a-46e8f17e0bae",
        "source": "cs161_textbook",
        "question": "In the context of TLS, which of the following statements are true regarding the prevention of replay attacks?",
        "choices": [
            "A: Utilizing a counter or timestamp in messages helps prevent an attacker from replaying a message within the same connection.",
            "B: Fixed values of R_B and R_S during the handshake would prevent replay attacks by ensuring consistent generation of the same symmetric keys.",
            "C: Randomly generated values R_B and R_S for each connection thwart replay attacks by producing a different set of symmetric keys.",
            "D: Replay attacks can be fully prevented by only using symmetric encryption throughout the entire TLS connection."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TLS"
    },
    {
        "id": "349600d8-c9ff-40db-8540-cd8ad9cd2dbf",
        "source": "cwe",
        "question": "In a design meeting, a developer proposes a new feature that includes an object to hold aggregated data from multiple sources. The object is expected to have at least ten sub-elements, each of which is a complex object itself. What concerns should be raised regarding the proposed design?",
        "choices": [
            "A: The proposed design may result in a more efficient and streamlined data processing flow.",
            "B: The high number of complex sub-elements may lead to increased memory consumption and slower data processing.",
            "C: The design is likely to reduce the risk of security vulnerabilities due to the isolated handling of each sub-element.",
            "D: If the code that manages the aggregated object is accessible to attackers, it could be susceptible to performance-related security vulnerabilities."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DesignConcerns"
    },
    {
        "id": "a3a37a81-bdbb-417a-b042-6114592228b9",
        "source": "android_sec_doc",
        "question": "A developer has signed an APK with APK Signature Scheme v2 and is wondering how this will affect the installation on different versions of Android. Assuming the APK is also signed with the JAR signature scheme, how will Android platforms of different versions verify the APK?",
        "choices": [
            "A: Android 7.0 and later will verify the APK using both APK Signature Scheme v2+ and JAR signing, while older platforms will only verify the JAR signature.",
            "B: All Android versions will verify the APK using APK Signature Scheme v2 due to its backward compatibility with older signature schemes.",
            "C: Android 7.0 and later will ignore the v2 signature and only verify the APK using JAR signing, while older platforms will verify both signatures.",
            "D: Android 7.0 and later will verify the APK using APK Signature Scheme v2+, while older platforms will ignore v2 signatures and only verify JAR signing."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "APK Verification"
    },
    {
        "id": "8920a370-7704-4bf6-b4a4-558598347ef1",
        "source": "apple_platform_security",
        "question": "Identify the implications of setting the LocalPolicy file to 'Full Security' and 'Reduced Security' on a Mac with Apple silicon:",
        "choices": [
            "A: 'Full Security' ensures that the Mac can only boot software that was known to be the latest at install time.",
            "B: 'Reduced Security' allows for the use of older macOS versions which may contain unpatched vulnerabilities.",
            "C: 'Full Security' allows booting kernel extensions (kexts) required for certain applications and drivers.",
            "D: 'Reduced Security' requires the signature verification of boot objects to match the nonce in the Secure Storage Component."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityLevels"
    },
    {
        "id": "48988829-0759-4844-b993-2c115e84ea27",
        "source": "android_sec_doc",
        "question": "A system analyst is diagnosing SELinux policy violations on an Android test device. After ensuring that SELinux is in the correct mode, what steps should they take next to effectively identify and resolve the policy violations?",
        "choices": [
            "A: Examine the SELinux output to `dmesg` and refine settings in permissive mode before switching to enforcing mode.",
            "B: Execute the `androidboot.selinux=permissive` command to disable SELinux enforcement and observe changes in system behavior.",
            "C: Use `simpleperf` to capture the call chain and diagnose the denial without checking SELinux logs for errors.",
            "D: Run `audit2allow` directly on the event logs without examining the specific denial messages or contexts."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "46e95f58-15e3-497c-9f88-052d1528977c",
        "source": "attck",
        "question": "A network security analyst is tasked with enhancing the organization's defenses against adversaries who might communicate using application layer protocols to avoid detection. Which of the following measures would be most effective in mitigating such activities?",
        "choices": [
            "A: Implementing strict egress and ingress filtering rules on the firewall to control traffic based on source and destination IP addresses.",
            "B: Deploying network intrusion prevention systems that use network signatures to identify traffic for specific adversary malware.",
            "C: Enforcing a policy that requires the use of VPNs for all internal and external communications.",
            "D: Increasing the complexity of network topology to confuse potential adversaries and complicate their attack paths."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Intrusion Prevention"
    },
    {
        "id": "64ee8252-3440-4f26-b25a-3e3e8140f454",
        "source": "cwe",
        "question": "An online file management system allows users to execute file-related operations through a web interface. The system uses a server-side script to execute OS commands based on user input. To mitigate the risk of OS command injection, the development team is considering several strategies. Which of the following strategies would effectively mitigate this risk? (Choose two.)",
        "choices": [
            "A: Storing user input in the session's state instead of sending it to the client in a hidden form field.",
            "B: Using the system() function in C to execute commands, as it accepts a single string and performs appropriate quoting and filtering.",
            "C: Implementing input validation to accept only known good inputs that conform to strict specifications.",
            "D: Running the code in a sandbox environment that enforces strict boundaries between the process and the operating system."
        ],
        "answer": "AC",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "mitigation"
    },
    {
        "id": "c2534dd1-3d89-49ab-826a-0e4ec1653b68",
        "source": "android_sec_doc",
        "question": "An Android device is being prepared for deployment in a high-security environment. The security team is debating whether to set SELinux to 'Permissive' or 'Enforcing' mode. What are the implications of deploying the device with SELinux set to 'Permissive' mode?",
        "choices": [
            "A: In 'Permissive' mode, the security policy is enforced but not logged, potentially leading to unnoticed security breaches.",
            "B: In 'Permissive' mode, the security policy is not enforced, only logged, which can be useful for identifying potential failures without impacting system functionality.",
            "C: In 'Permissive' mode, devices become immune to EPERM errors since no policy enforcement takes place.",
            "D: In 'Permissive' mode, the security policy is both enforced and logged, with failures appearing as EPERM errors, offering the highest level of security."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "SELinux Permissive Mode"
    },
    {
        "id": "0e05d118-e272-48cb-9e16-1e375d809c5a",
        "source": "owasp_wstg",
        "question": "Given the benefits of ORM tools in web application development, which of the following reasons would make an application using ORM generated objects still vulnerable to ORM Injection attacks?",
        "choices": [
            "A: ORM tools can generate overly complex code that is difficult to understand and maintain, leading to security oversights.",
            "B: The use of ORM generated objects inherently slows down application performance, which can lead to timeouts and potential exploitation.",
            "C: Web applications might accept unsanitized input parameters that the ORM methods can process, leading to injection vulnerabilities.",
            "D: ORM layers completely abstract the database layer, making it impossible for attackers to direct SQL queries to the database."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "6ac83ccb-b108-49f4-a2d1-a1e5b4e7f781",
        "source": "cwe",
        "question": "You are reviewing the security of a web application which dynamically constructs web pages based on user input. The application currently does not specify an encoding in HTTP headers, potentially allowing browsers to guess the encoding and opening up to XSS attacks. Given this scenario, which of the following strategies would be effective for mitigating these security risks?",
        "choices": [
            "A: Implementing an 'accept known good' input validation strategy that rejects or transforms input not strictly conforming to specifications.",
            "B: Setting the session cookie to be HttpOnly to prevent the session cookie from being accessible via client-side scripts.",
            "C: Configuring the application firewall to detect attacks against this weakness.",
            "D: Creating a mapping from a set of fixed input values to actual filenames or URLs, and rejecting all other inputs."
        ],
        "answer": "ABCD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "ab0b25ad-642b-4324-8827-6114ac7ed7ae",
        "source": "apple_platform_security",
        "question": "How does HomeKit enhance the security of data storage and accessory access within a smart home environment?",
        "choices": [
            "A: HomeKit data is stored using the Protected Until First User Authentication class, and routers support PPSK authentication for added security.",
            "B: Local data is stored unencrypted for easy access by smart home accessories, but remote data access requires multi-factor authentication.",
            "C: HomeKit routers use a universal PSK (PPSK) for all accessories, simplifying the setup process and improving interoperability.",
            "D: Accessory data is backed up to iCloud without encryption to allow for easy recovery, and routers use WEP authentication for legacy support."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "HomeKit"
    },
    {
        "id": "e0256d82-2920-4f82-8a45-3d6702c6b561",
        "source": "cwe",
        "question": "An existing system has been found to have a vulnerability due to objects inheriting insecure permissions from their parent. As a security consultant, what recommendations would you make to the development team for remediation?",
        "choices": [
            "A: Introduce an access control list (ACL) for each object, specifying the minimum necessary privileges required for operation.",
            "B: Consolidate all permissions into a single, easily manageable permission set for the entire application.",
            "C: Instruct the development team to disable all permission checks to streamline performance until a patch can be deployed.",
            "D: Advise the development team to review and narrow down trust zones within the application, ensuring strict enforcement of trust boundaries."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "PermissionMitigation"
    },
    {
        "id": "16567bc2-f96e-48e6-919e-3b531182c69c",
        "source": "attck",
        "question": "A cybersecurity analyst is tasked with identifying potential areas where adversaries might gather reconnaissance information for an upcoming targeted attack. Considering the open technical databases adversaries might exploit, which of the following would be most effective for adversaries seeking to collect detailed information about a company's online presence and digital assets?",
        "choices": [
            "A: Reviewing industry news articles for mentions of the company's internal security protocols.",
            "B: Searching passive DNS databases for historical DNS records associated with the company.",
            "C: Analyzing financial reports for insights into the company's investment in cybersecurity.",
            "D: Investigating social media profiles of employees for potential phishing targets."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Reconnaissance"
    },
    {
        "id": "2a2549e7-cbbd-4583-8f5c-247983cc6b2a",
        "source": "cs161_textbook",
        "question": "A network engineer suggests that routers are an essential component for the expansion of a company's existing local area network (LAN) infrastructure. Evaluate the engineer's assertion by selecting the statements that correctly identify the pros and cons of introducing routers into the network.",
        "choices": [
            "A: Installing routers will allow for scalability by connecting multiple LANs, but it may introduce a single point of failure if not properly redundant.",
            "B: Routers can isolate network traffic within each LAN, reducing the chances of network congestion, but they can also cause increased latency due to message forwarding.",
            "C: By using routers, communication between LANs becomes impossible, as routers are designed to block all inter-LAN traffic.",
            "D: Routers simplify the network topology by directly connecting every machine to every other machine across the network, which can enhance communication efficiency."
        ],
        "answer": "AB",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Router"
    },
    {
        "id": "2b091e44-d561-4f3b-87a0-2db307c8793c",
        "source": "apple_platform_security",
        "question": "An organization is deploying a new online service and wants to ensure its security. They have identified several potential security measures to implement. Which of the following measures should the organization consider to enhance their service security? (Select all that apply)",
        "choices": [
            "A: Implementing a Web Application Firewall (WAF) to protect against common web vulnerabilities such as SQL injection and cross-site scripting.",
            "B: Disabling unnecessary services and ports on the server hosting the service to minimize the attack surface.",
            "C: Requiring multi-factor authentication for user access to the service to add an additional layer of security.",
            "D: Using a single, complex password for all administrative accounts to ensure password strength."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "ServiceSecurity"
    },
    {
        "id": "15f2287a-7cb2-4a8d-a5fb-c4e25c974d64",
        "source": "windows_security",
        "question": "If a security analyst claims that the primary objective of Windows 10 kernel pool protections is to enhance the speed of memory allocation, which of the following statements best refutes this claim?",
        "choices": [
            "A: Kernel pool protections aim to optimize memory usage by compressing data stored in the memory pool.",
            "B: The purpose of kernel pool protections is to secure the memory pool against unauthorized access and prevent exploitation.",
            "C: Kernel pool protections are designed to facilitate seamless connectivity between different memory pools for improved data sharing.",
            "D: They ensure that all memory pool operations are logged for auditing and post-incident analysis purposes."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Kernel pool protections"
    },
    {
        "id": "e640d5e9-26b9-416e-9d48-7b1421542192",
        "source": "apple_platform_security",
        "question": "You are developing a third-party payment app that integrates with SiriKit on iOS devices. When a user issues a voice command to make a payment to a contact, which of the following statements accurately represent how SiriKit handles the request and user data based on the provided permissions?",
        "choices": [
            "A: SiriKit will resolve the relationship in the user's request even if the app does not have access to contact information.",
            "B: If the app has permission to access contact information, Siri will provide the app with the resolved information about the user's mother when the user says 'Pay my mother 10 pounds using Payment App'.",
            "C: Siri will pass the entire original user utterance to the app extension regardless of the app's user-controlled access permissions.",
            "D: If the user's request involves a message body mentioning a relationship, such as 'Tell my mother on MessageApp that my brother is awesome', Siri won't resolve 'my brother' even if the app has access to contacts."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SiriKit"
    },
    {
        "id": "cda6385f-b225-4cff-b1be-a5826a6260dc",
        "source": "android_sec_doc",
        "question": "Considering the latest Android security guidelines, why is full-disk encryption not recommended on new devices running Android 10 and higher?",
        "choices": [
            "A: Because full-disk encryption is more resource-intensive than file-based encryption.",
            "B: Because full-disk encryption has been deprecated in favor of more flexible encryption methods like file-based encryption.",
            "C: Because full-disk encryption cannot encrypt metadata such as file sizes and permissions.",
            "D: Because full-disk encryption has been found to be less secure than other available encryption methods."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Full-disk encryption"
    },
    {
        "id": "95f18104-74d9-4901-927e-1f9c1303b863",
        "source": "cs161_textbook",
        "question": "You are setting up a web infrastructure for a new company with the domain 'examplestartup.com'. As part of this process, you need to configure DNS settings. Based on your understanding of name servers and domain zones, which of the following statements are correct?",
        "choices": [
            "A: You must register 'examplestartup.com' with a name server responsible for the '.com' zone to handle DNS queries specifically for your domain.",
            "B: A single name server somewhere on the internet will store the IP address of 'examplestartup.com' and handle all DNS requests for any domain.",
            "C: The name server handling DNS requests for 'examplestartup.com' will also be responsible for DNS information related to 'wikipedia.org'.",
            "D: Name servers have their own domain names and IP addresses, and the domain of the name server does not necessarily indicate the zone it manages."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNS"
    },
    {
        "id": "be1b91f7-77c1-42ea-a083-bcdee27e1757",
        "source": "apple_platform_security",
        "question": "A security analyst is evaluating the privacy and security features of Bluetooth Low Energy (BLE) used in iOS devices. Which of the following features contribute to the privacy and security of BLE?",
        "choices": [
            "A: Address randomisation to reduce tracking of BLE devices.",
            "B: Cross-transport key derivation for generating link keys across different Bluetooth protocols.",
            "C: Wi-Fi frame sequence number randomisation to prevent packet sniffing.",
            "D: Use of a long identity hash for AirDrop to verify contacts."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "BLE"
    },
    {
        "id": "3303b914-ce60-4e67-9f96-88061a35f999",
        "source": "cwe",
        "question": "Suppose you are reviewing the security of a sensor data handling system for a System on Chip (SoC) design. You encounter a code snippet that scales the sensor frequency value to calculate the sensed temperature using the formula: Sensed Temp = a + b * Sensor Freq, where a and b are programmable calibration data coefficients. Identify the measures that would address the weakness of missing write protection for sensor parametric data values to prevent potential hardware damage or operational failure.",
        "choices": [
            "A: Implementing a hardware-imposed limit on the maximum allowable values of coefficients a and b.",
            "B: Enforcing access controls to allow only trusted software to modify the calibration coefficients a and b.",
            "C: Periodically recalibrating the sensor at runtime to ensure that the coefficients a and b remain within safe operational limits.",
            "D: Storing the coefficients a and b in volatile memory so they are reset to default safe values upon system reboot."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "WriteProtection"
    },
    {
        "id": "05659502-7e61-4593-afd5-bbd941052fd6",
        "source": "owasp_mastg",
        "question": "As an iOS developer, you need to embed a WebView into your application that allows for extensive customization, including the ability to disable JavaScript execution for security reasons. Which WebView type would you select for this requirement?",
        "choices": [
            "A: UIWebView, because it is a well-established component and supports extensive customization.",
            "B: WKWebView, as it allows for disabling JavaScript and provides several security advantages over UIWebView.",
            "C: SFSafariViewController, due to its ease of use and built-in security features like the read-only address field.",
            "D: SFSafariViewController, because it allows disabling JavaScript and is the most secure option available."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "WebView Security"
    },
    {
        "id": "3420c1d9-7791-41ff-9a5e-13c7503f91d2",
        "source": "cs161_textbook",
        "question": "Consider a secure Message Authentication Code (MAC) algorithm in use. An attacker, Eve, is attempting to undermine the integrity of the communication between Alice and Bob. What are the potential outcomes of Eve's actions given the security properties of a secure MAC, and what is she unable to achieve?",
        "choices": [
            "A: Eve can observe a valid MAC for a message and use it to generate a valid MAC for a new, unseen message.",
            "B: Eve can modify a message and the corresponding MAC in such a way that Bob accepts the modified message as authentic.",
            "C: Eve, by knowing some valid MACs, cannot forge valid MACs for messages she has never observed before.",
            "D: Eve can choose a set of messages and have Alice transmit those with valid MACs, which will help her to forge a valid MAC for a new message."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "MAC"
    },
    {
        "id": "07df9285-875b-4cbc-b15c-3ca6edd9fa69",
        "source": "owasp_mastg",
        "question": "Consider an Android environment where two applications, App A and App B, are installed. App A has a unique user ID, while App B is designed with a 'sharedUserId' attribute in its AndroidManifest.xml file, set to the same user ID as App C, which is also installed on the device. Assuming all three apps are signed with different certificates, which of the following statements is true regarding the access permissions between these applications?",
        "choices": [
            "A: App A and App B can access each other's data directories because they are installed on the same device.",
            "B: App B and App C can access each other's data directories because they have the same user ID specified in their manifests.",
            "C: App B cannot access App C's data directory despite having the same user ID because they are signed with different certificates.",
            "D: App A can access both App B's and App C's data directories because it has a unique user ID."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "AndroidManifest.xml"
    },
    {
        "id": "b908bc08-64af-48b8-b596-8236c488193d",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing system logs to identify potential malicious activity. The analyst notices an unusual modification to a registry key that is known to be targeted by adversaries for persistence. Which of the following system actions would most likely have been logged prior to this discovery, and could indicate that an adversary had modified a startup-related registry key?",
        "choices": [
            "A: A process creation event for a script editor with cmd.exe as the parent process.",
            "B: A registry key creation event for SafeDllSearchMode with a value set to 0.",
            "C: A process execution event with command-line arguments containing the names of startup folders and registry editing tools.",
            "D: An event indicating the deletion of system restore points by a maintenance utility."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Windows Registry Key Modification"
    },
    {
        "id": "691d9dcf-28b7-432e-962b-40825317323d",
        "source": "attck",
        "question": "An adversary has obtained stolen credentials and is using a cloud service dashboard to gather information from an operational cloud environment. As a security analyst, you are tasked with suggesting mitigation strategies to limit the adversary's ability to discover sensitive information via the dashboard. Which of the following strategies would effectively mitigate this security risk?",
        "choices": [
            "A: Implement role-based access control to restrict dashboard visibility.",
            "B: Increase the frequency of mandatory password changes for all users.",
            "C: Deploy an intrusion detection system to monitor all incoming traffic.",
            "D: Disable all dashboard functionality to prevent access."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Least-Privilege"
    },
    {
        "id": "0c9450ec-f3a5-4033-aff4-e140b30dfe72",
        "source": "cwe",
        "question": "Suppose you are architecting a new software system that deals with sensitive financial data. You need to ensure that the system's security design prevents the inheritance of insecure permissions. Which of the following measures should you incorporate into your design to mitigate this risk?",
        "choices": [
            "A: Implement a strict permission model where each object defines its own permissions, rather than inheriting them.",
            "B: Allow all objects to inherit permissions from a global template to maintain consistency across the system.",
            "C: Designate certain areas of the system as 'safe' zones, where strict trust boundaries are enforced and sensitive data cannot leave.",
            "D: Ensure that all system functions run with the highest level of privileges at all times to avoid permission errors."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InheritedPermissions"
    },
    {
        "id": "68d01126-2744-4534-a2ca-cc13cd0e729c",
        "source": "mit6.858",
        "question": "A company wants to establish its online presence with a secure website that will handle sensitive customer data. They are considering which type of SSL/TLS certificate to use. The company has a reputable brand and wants the certificate to assert their trustworthiness beyond just domain ownership. They also want the validation process to be thorough but are concerned about potential costs. Which types of certificates should the company consider? Select all that apply.",
        "choices": [
            "A: Extended Validation (EV) certificates, to certify trustworthiness and display a green box with the company name next to the URL.",
            "B: Domain Validated (DV) certificates, for a quick and automated validation process ensuring domain ownership.",
            "C: Certificates with Certificate Transparency (CT), to have their certificates logged publicly for better accountability.",
            "D: Certificates with HPKP pinning managed by the web host server, to specify the server's public key and period it should last."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Certificates"
    },
    {
        "id": "0c66c1b1-a2b4-4859-ad16-46aa75b3165b",
        "source": "apple_platform_security",
        "question": "What characteristics must keychain items have to be synced using iCloud Keychain, and which of the following keychain items are eligible for syncing?",
        "choices": [
            "A: Keychain items must be marked with the kSecAttrSynchronizable attribute to be eligible for syncing.",
            "B: Wi-Fi passwords are automatically set to sync as Apple marks them with the kSecAttrSynchronizable attribute.",
            "C: iMessage keys, being device-specific, are synced across devices using iCloud Keychain.",
            "D: Third-party app developers cannot enable their keychain items to sync; only Apple can set items to sync."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Keychain Syncing"
    },
    {
        "id": "f9e18abd-23d8-47ad-8aca-3a3539091bac",
        "source": "owasp_wstg",
        "question": "An e-commerce web application implements a 'remember me' feature to improve user experience. The application stores a token on the client-side to keep users logged in for extended periods. Which of the following practices should be avoided to maintain secure session management?",
        "choices": [
            "A: The token is rotated after each session and has a limited lifetime.",
            "B: Credentials are stored in encrypted form in the browser's local storage.",
            "C: The token is bound to the user's session and is invalidated upon logout.",
            "D: The application uses a server-generated token that does not store user credentials."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "session management"
    },
    {
        "id": "068c932c-727a-4b78-9fb7-54ffff99e53c",
        "source": "apple_platform_security",
        "question": "You are tasked with designing a secure app distribution model for a desktop operating system similar to macOS. Your primary goals are to ensure that apps are free of known malware, haven't been tampered with, and respect user data privacy. Which of the following measures would you implement? (Select all that apply)",
        "choices": [
            "A: Mandatory app notarisation by the operating system vendor for all internet-downloaded apps.",
            "B: Disallowing sandboxed apps to ensure unrestricted access to system resources for enhanced functionality.",
            "C: Enabling an application firewall to monitor and control outgoing network traffic from apps.",
            "D: Requiring all executable code to be signed using an operating system vendor-issued certificate."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "App Distribution Security"
    },
    {
        "id": "7927d3a0-47b8-43f3-a705-c232719f4d34",
        "source": "cwe",
        "question": "A development team is tasked with securing a web service against injection vulnerabilities. They are evaluating different strategies for handling user input. Analyze the pros and cons of the following strategies based on their potential effectiveness against injection vulnerabilities:",
        "choices": [
            "A: Using a denylist to block known malicious inputs.",
            "B: Canonicalizing inputs to a consistent internal representation before validation.",
            "C: Relying solely on allowlists to determine the validity of inputs.",
            "D: Encoding all output irrespective of input validation strategies."
        ],
        "answer": "ABCD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategies"
    },
    {
        "id": "2fad5729-27c3-4096-bc6b-c9eb61d32667",
        "source": "owasp_wstg",
        "question": "What measures can a web application owner implement to prevent sensitive information from being indexed by search engines, and what are the potential consequences of failing to update these measures?",
        "choices": [
            "A: Employing a 'robots.txt' file and in-line HTML meta tags, with the risk of indexed sensitive content if not regularly updated.",
            "B: Relying solely on the 'nofollow' attribute in links, neglecting the possibility of direct URL access leading to content indexing.",
            "C: Using CAPTCHAs on every page, ignoring the potential negative impact on user experience and search engine rankings.",
            "D: Implementing server-side authentication only, without considering the need for client-side directives to control search engine indexing."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "robots.txt"
    },
    {
        "id": "d2a844a3-f276-4476-baca-9f6e667e5e16",
        "source": "mit6.858",
        "question": "A school has decided to enhance the security of its online grades system, where only authorized staff should be able to access and modify grades. Considering the high-level plan for thinking about security as described in the course, which of the following strategies should be considered to achieve the desired security goals?",
        "choices": [
            "A: Implement a mechanism that requires two-factor authentication for staff accessing the grades system.",
            "B: Establish a recovery plan with secure backups to restore the grades system in case of a security breach.",
            "C: Rely solely on the school's existing firewall to prevent unauthorized access to the grades system.",
            "D: Design a policy that includes a routine for staff to share passwords with the IT department for regular security checks."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityPolicy"
    },
    {
        "id": "5a1b5bf7-7efb-4602-ae8a-a57927038e09",
        "source": "owasp_wstg",
        "question": "An auditor is reviewing a web application's source code and notices that the PHP authentication code is using the 'unserialize()' function to parse user-supplied data, which is then used in a loose comparison for authentication. Which of the following code snippets would not prevent an authentication bypass in this scenario?",
        "choices": [
            "A: Checking if 'autologinid' is a boolean and denying access if it is.",
            "B: Replacing loose comparison with strict comparison using '===' operator.",
            "C: Using a custom function to validate 'sessiondata' elements before using them.",
            "D: Ensuring that 'autologinid' matches the user's password hash using an MD5 comparison."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "PHP Loose Comparison"
    },
    {
        "id": "5a2bed74-2fa5-4b05-8fdb-5f70845095b0",
        "source": "cwe",
        "question": "In the context of a hardware system design, consider that Unit_B is designed with 8 kilobytes of internal memory. This memory is mapped into a 32 kilobyte address range in the system fabric address map. The system address decoder for Unit_B is designed to mask off the upper 13 bits, decoding only the lower bits to compute the offset into the internal memory space. If an untrusted agent discovers that the memory protection unit only restricts access to the first 8 kilobyte range, which of the following actions would effectively mitigate the risk of the untrusted agent accessing the mirrored or aliased memory regions?",
        "choices": [
            "A: Program the MPU to apply protection policies to the full 32 kilobyte address range mapped to Unit_B.",
            "B: Restrict access to the internal memory of Unit_B to privileged software by implementing secure boot mechanisms.",
            "C: Block all system software from accessing the aliased address ranges that are not needed for normal operations.",
            "D: Increase the memory range of Unit_B to 64 kilobytes to prevent any possible aliasing."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "MemoryAliasing"
    },
    {
        "id": "aec974c2-1722-4fdc-b260-01d8489ffac2",
        "source": "windows_security",
        "question": "Consider the security design of Microsoft Edge in Windows 10. Evaluate the following statements and select the ones that accurately describe its security features:",
        "choices": [
            "A: Microsoft Edge includes ActiveX controls to enhance web application compatibility.",
            "B: Microsoft Edge runs only 64-bit processes on a 64-bit PC, which improves security against exploits.",
            "C: Microsoft Edge is designed as a Universal Windows app, which inherently provides sandboxing to isolate the browser.",
            "D: Microsoft Edge utilizes a simplified application structure, reducing the number of required security settings and aligning with security best practices."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Sandboxing"
    },
    {
        "id": "21f50866-ed07-480d-bde5-5b7e3c7df0c5",
        "source": "cs161_textbook",
        "question": "If an application developer argues that using UDP would significantly reduce the reliability of their application, which of the following aspects of UDP would best counter that argument?",
        "choices": [
            "A: UDP's use of port numbers allows for direct communication between specific processes, which can enhance reliability.",
            "B: The presence of a checksum in the UDP header can detect corrupted packets, thus ensuring some level of reliability.",
            "C: UDP's lack of connection establishment reduces communication overhead, which has no impact on reliability.",
            "D: The best-effort delivery nature of UDP inherently means that reliability is not a primary concern of the protocol."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Reliability"
    },
    {
        "id": "0cbdd376-208b-43b4-ac34-331177196ed5",
        "source": "apple_platform_security",
        "question": "What are the implications of the security policies implemented by Apple for the recovery of an Apple ID password?",
        "choices": [
            "A: Account recovery through SMS verification, if a trusted device is not accessible.",
            "B: The use of a previously used passcode in conjunction with an email confirmation for immediate recovery.",
            "C: Unlimited sign-in retries for password reset attempts to facilitate user experience.",
            "D: Account recovery process that may include a waiting period to ensure account security."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Recovery"
    },
    {
        "id": "25fb83f9-1115-48a6-a573-72e8157989ae",
        "source": "attck",
        "question": "An adversary is attempting to infer the geographical location of a victim host to tailor their attack strategy. Which of the following methods could be used by the adversary to accomplish this? (Select TWO.)",
        "choices": [
            "A: Checking the system's IP address and using an online geolocation IP-lookup service.",
            "B: Using the Windows API function `CreateLocale` to determine the host's locale settings.",
            "C: Monitoring the availability zone in a cloud environment by accessing the instance metadata service.",
            "D: Employing the Linux command `locale` to retrieve the current keyboard layout settings of the system."
        ],
        "answer": "AC",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "System Location Discovery"
    },
    {
        "id": "30c2d121-2dea-456a-b645-8066f7b2c2fd",
        "source": "attck",
        "question": "A security team is planning to mitigate the risk of adversaries using system binary proxy execution to bypass digital certificate validation on a network of Windows machines. Which of the following mitigation strategies would be most effective in this scenario?",
        "choices": [
            "A: Applying strict firewall rules to prevent external network connections",
            "B: Using application control to prevent execution of binaries that are susceptible to abuse",
            "C: Enforcing password complexity requirements for all user accounts",
            "D: Installing the latest antivirus software on all endpoints"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Execution Prevention"
    },
    {
        "id": "0f98e3b6-13bd-4c00-8fef-262f4cdfd3bb",
        "source": "attck",
        "question": "A financial institution has recently fallen victim to a sophisticated business email compromise campaign that resulted in significant financial theft. The attackers were able to impersonate high-level executives and successfully convinced an employee to transfer funds to an adversary-controlled account. Which of the following strategies would be the most effective in preventing a similar situation in the future?",
        "choices": [
            "A: Implement strict user account management to limit authority and authenticate transactions outside of insecure communication lines.",
            "B: Decrease the frequency of reviewing application logs to reduce the workload on the cybersecurity team.",
            "C: Encourage users to share account credentials to ensure continuity of operations in case of user absence.",
            "D: Provide comprehensive user training to identify and resist social engineering techniques."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Business Email Compromise (BEC)"
    },
    {
        "id": "1d218c70-9cb6-4131-a909-99de0317af51",
        "source": "cs161_textbook",
        "question": "Which of the following counterarguments best invalidates the decision to invest heavily in biometric authentication systems for a company's internal document sharing platform that is already protected by a robust VPN, considering the principle that a system's security is only as strong as its weakest link?",
        "choices": [
            "A: Biometric systems are generally more user-friendly, which can lead to higher employee productivity.",
            "B: Investing in biometric systems does not significantly enhance security if the VPN already represents a strong authentication layer.",
            "C: Biometric systems add a layer of security that can protect against internal threats, such as disgruntled employees.",
            "D: The biometric system can serve as a backup in case the VPN authentication mechanism fails."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "WeakestLink"
    },
    {
        "id": "e6e58518-1657-41e3-af5a-f8b2d38803a9",
        "source": "cs161_textbook",
        "question": "You are configuring a network device that needs to obtain an IP address and other network configurations upon connecting to a new network. Which of the following statements are correct regarding the DHCP process and its security considerations?",
        "choices": [
            "A: DHCP operates solely on layer 3 of the OSI model, providing configurations like IP address allocation.",
            "B: An on-path attacker can intercept DHCP requests and supply forged responses, potentially leading to network security breaches.",
            "C: DHCP's main purpose is to encrypt data transmissions between devices on a network.",
            "D: One of the defenses against DHCP vulnerabilities is to acknowledge the risk and implement security measures at higher OSI layers."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DHCP"
    },
    {
        "id": "b2e3ad40-91da-4903-aa8c-4a54d26e7ed0",
        "source": "cs161_textbook",
        "question": "Why is padding not required for the last block of plaintext in CTR mode as opposed to CBC mode when encrypting messages that are not a multiple of the block size?",
        "choices": [
            "A: CTR mode uses a stream cipher approach, avoiding the need for input to be a fixed block size.",
            "B: CTR mode generates a one-time pad that can be truncated without compromising the encryption.",
            "C: CTR mode includes an internal padding mechanism that automatically adjusts block sizes.",
            "D: CTR mode encryption strength is not dependent on the block size, so padding is optional."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "EncryptionModes"
    },
    {
        "id": "c366fdb8-d554-4570-83d3-a622a32f41fb",
        "source": "cwe",
        "question": "Consider the following code snippet that is intended to create a null-terminated string and print its contents:\n\nchar *foo;\nint counter;\nfoo = calloc(sizeof(char) * 10);\nfor (counter = 0; counter != 10; counter++) {\n    foo[counter] = 'a';\n    printf(\"%s\\n\", foo);\n}\n\nWhat could be a potential consequence if the loop condition is mistakenly changed to 'counter < 10'?",
        "choices": [
            "A: The printf() function will print the string 'foo' correctly without any issues.",
            "B: The string 'foo' will not be null-terminated, potentially leading to a buffer overflow when printed.",
            "C: The loop will terminate prematurely, resulting in fewer than 9 'a' characters in the string.",
            "D: An infinite loop will occur, as the loop condition will never evaluate to false."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "BufferOverflow"
    },
    {
        "id": "49b722e4-a12a-4cae-b641-c9bdda9b37e3",
        "source": "owasp_mastg",
        "question": "A mobile application developer needs to securely handle sensitive data such as passwords and encryption keys in memory. Which of the following approaches would be the most secure for managing this sensitive data in a Swift or Objective-C application?",
        "choices": [
            "A: Use NSString and String for storing sensitive data and overwrite them with new values when done.",
            "B: Employ primitive data structures like char [] and int [], and ensure they are overwritten with zeroes after use.",
            "C: Implement custom classes that subclass Swift's String to provide functionality for securely erasing data from memory.",
            "D: Store sensitive data in mutable collections like Array or Set, and use their built-in methods to clear the data."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Sensitive Data Handling"
    },
    {
        "id": "6eea0149-4f8d-4893-b761-f8f3146c0e87",
        "source": "attck",
        "question": "An adversary has gained access to a company's cloud environment and is attempting to exfiltrate data by creating backups of cloud instances and transferring them to another account they control within the same service provider. Which TWO actions should the cybersecurity team take to mitigate this risk?",
        "choices": [
            "A: Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.",
            "B: Increase the complexity requirements of user passwords to further secure cloud accounts.",
            "C: Limit user account and IAM policies to the least privileges required and consider using temporary credentials.",
            "D: Deploy an antivirus solution on all cloud instances to prevent unauthorized creation of backups."
        ],
        "answer": "AC",
        "topics": [
            "PenTest",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Filter Network Traffic"
    },
    {
        "id": "4919992b-bffe-49d7-aa37-2679a9ee8fec",
        "source": "cs161_textbook",
        "question": "In a DNS response, the `OPT` pseudosection is reported as an additional record. What is the primary purpose of the `OPT` pseudosection in the context of DNSSEC?",
        "choices": [
            "A: It contains the cryptographic signature for the DNS response.",
            "B: It provides extra space for DNSSEC-specific flags and ensures backwards compatibility.",
            "C: It acts as a placeholder for future DNSSEC record types that may be introduced.",
            "D: It is used to encrypt the DNS query to prevent eavesdropping."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OPT"
    },
    {
        "id": "b5776ff2-986e-4094-9a50-0e355bc4f823",
        "source": "cwe",
        "question": "An application developer needs to store sensitive information, such as API keys, within an application's executable file. Which of the following methods would be the most secure for storing this information, considering that attackers can reverse engineer binary code to obtain secret data?",
        "choices": [
            "A: Encrypt the sensitive information using a symmetric key algorithm before embedding it into the executable.",
            "B: Compress the sensitive information using a standard compression algorithm to reduce its size and then store it in the executable.",
            "C: Encode the sensitive information using base64 encoding and store it in the executable.",
            "D: Store the sensitive information in a separate configuration file outside of the executable and encrypt the file."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "SensitiveDataStorage"
    },
    {
        "id": "6a12e232-e46b-4261-a81d-64efeb89511f",
        "source": "owasp_wstg",
        "question": "Which of the following statements accurately describes the nature and use of Server-Side Includes (SSI) directives in web applications?",
        "choices": [
            "A: SSI directives are primarily used for complex tasks such as handling user authentication and session management.",
            "B: SSI directives allow developers to add dynamic code for simple tasks without full-fledged server-side scripting languages.",
            "C: SSI directives are enabled by default on all web servers due to their essential role in web application functionality.",
            "D: SSI directives require the incorporation of client-side JavaScript to execute and render dynamic content."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Server-Side Includes (SSI)"
    },
    {
        "id": "787ae1e0-8793-4659-a698-807eaa1d6574",
        "source": "cwe",
        "question": "A web application's login servlet is designed to authenticate users and handle login exceptions as follows:\n\njava\npublic class BankManagerLoginServlet extends HttpServlet {\n  protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {\n    String username = request.getParameter('username');\n    String password = request.getParameter('password');\n    try {\n      boolean isAuthentic = authenticateUser(username, password);\n      if (!isAuthentic) {\n        throw new FailedLoginException('Failed Login for user ' + username + ' with password ' + password);\n      }\n      // Proceed to success page\n    } catch (FailedLoginException ex) {\n      // Forward to error page with exception message\n    }\n  }\n}\n\n\nWhat are the potential security implications of including the user-supplied password in the `FailedLoginException` message?",
        "choices": [
            "A: It could lead to information leakage by revealing user passwords to unauthorized individuals.",
            "B: It might be beneficial as it allows users to see and correct their mistyped passwords.",
            "C: It could result in improved security by discouraging users from using simple passwords.",
            "D: It may increase security by providing system administrators with the information needed to track failed login attempts."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InformationLeakage"
    },
    {
        "id": "3ac6946b-cc31-4a19-939d-4bd94ade70ef",
        "source": "cwe",
        "question": "An application architect proposes several measures to enhance the security of an application that uses cookies for critical operations. Evaluate the proposed measures and select the ones that are not recommended based on their potential to introduce vulnerabilities:",
        "choices": [
            "A: Using HTTPS to prevent cookie interception during transmission.",
            "B: Relying on client-side script to validate cookie data before making security decisions.",
            "C: Implementing a Content Security Policy (CSP) to reduce the risk of cross-site scripting.",
            "D: Adding a secure flag to cookies to ensure they are only sent over encrypted connections."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "WebSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "DesignMitigations"
    },
    {
        "id": "7a0b7013-e5cd-4950-b53f-0ea5c5b022f0",
        "source": "cs161_textbook",
        "question": "In the design of DNSSEC where name servers sign records with their private key, which of the following would be an effective countermeasure against the risk of malicious name servers providing valid signatures on malicious records?",
        "choices": [
            "A: Implement a whitelist of trusted name servers and only accept records from those on the list.",
            "B: Establish a hierarchical trust model where the authenticity of a name server's key is verified by a higher authority.",
            "C: Encrypt the records with symmetric encryption before sending them to ensure that only trusted resolvers can read them.",
            "D: Increase the frequency of key rotation for name servers to limit the time window for potential malicious activity."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Countermeasure"
    },
    {
        "id": "4ce84110-276b-4498-871f-1f300c5f46bb",
        "source": "windows_security",
        "question": "A developer is creating a new security feature for a Windows environment that involves the creation of a token object to access local resources programmatically. To ensure proper implementation of this feature, which user right should be carefully managed and why?",
        "choices": [
            "A: SeCreateTokenPrivilege, because it allows a process to create a token which can be used to get access to local resources.",
            "B: SeDebugPrivilege, because it allows a user to debug and adjust the memory of a process owned by another account.",
            "C: SeImpersonatePrivilege, because it allows a user to impersonate other accounts.",
            "D: SeEnableDelegationPrivilege, because it allows marking user and computer accounts as trusted for delegation."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "SeCreateTokenPrivilege"
    },
    {
        "id": "f952ff48-ab5b-4f3a-8b8b-be02fa3da909",
        "source": "owasp_wstg",
        "question": "A web application developer believes that by using the HTML `<script>` tag, they can avoid the restrictions imposed by the same-origin policy and freely access data from any origin without security repercussions. As a security expert, what would you argue to correct this misconception?",
        "choices": [
            "A: The same-origin policy does not apply to `<script>` tags, which means any external scripts included are executed within the same context as the site, potentially leading to sensitive data leakage.",
            "B: The same-origin policy ensures absolute data isolation between different origins, meaning `<script>` tags cannot be used to include any cross-origin resources.",
            "C: The use of `<script>` tags is deprecated in modern web development, and any inclusion of such tags is automatically blocked by contemporary browsers.",
            "D: The `<script>` tag enforces same-origin policy by default, and resources from cross-origin domains cannot be fetched or executed in the context of the including site."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cross Site Script Inclusion (XSSI)"
    },
    {
        "id": "c8fb6837-e4c3-45cb-9401-862bf651b1f2",
        "source": "attck",
        "question": "A cybersecurity analyst observes unusual network traffic patterns on a corporate website's logs. The analyst notes a rapid succession of requests that appear to be a web crawling activity, all originating from a single source IP address. Which of the following actions would be the most appropriate to undertake initially in order to determine whether this is part of an adversary's reconnaissance activity?",
        "choices": [
            "A: Implement CAPTCHA challenges to prevent further automated web crawling.",
            "B: Immediately block the IP address to stop potential phishing attacks.",
            "C: Analyze web metadata and logs for artifacts indicative of malicious activity, such as suspicious referer or user-agent strings.",
            "D: Increase the website's bandwidth to handle the load from the unexpected traffic."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Web Crawling"
    },
    {
        "id": "804e373a-5664-4461-9c26-4ad5334d8144",
        "source": "attck",
        "question": "An adversary has successfully executed unauthorized commands in a running container by abusing the container administration service. Which of the following mitigation strategies would not address the vulnerability exploited by the adversary?",
        "choices": [
            "A: Enforcing authentication and role-based access control on the container service.",
            "B: Using network segmentation to isolate container traffic from the rest of the network.",
            "C: Removing unnecessary tools and software from containers.",
            "D: Enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "unauthorized command execution"
    },
    {
        "id": "f6e92b2b-313b-443f-916c-e38a7fc1cdcf",
        "source": "windows_security",
        "question": "A company's IT security policy is being reviewed and updated. As an IT security professional, you are analyzing the implications of the 'Network access: Allow anonymous SID/Name translation' policy setting in a Windows environment. Which of the following would be true if this policy setting is enabled?",
        "choices": [
            "A: Users can perform SID/Name translation without authentication, potentially exposing sensitive information.",
            "B: All users, including guests, are required to authenticate before SID/Name translation can occur, enhancing security.",
            "C: SID/Name translation is disabled entirely, ensuring that no unauthorized access to user identities occurs.",
            "D: It enforces mandatory two-factor authentication for SID/Name translation, adding an extra layer of security."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SID/Name translation"
    },
    {
        "id": "866ed697-5321-40e0-9325-c5c2ce391df0",
        "source": "owasp_mastg",
        "question": "An application uses AES encryption for sensitive data protection. The developers have decided to use user-supplied passwords directly as encryption keys. What are the potential security risks of this approach? (Select two.)",
        "choices": [
            "A: User-supplied passwords may not cover the full key space, leading to reduced encryption strength.",
            "B: The password's entropy is increased, making it more resilient against brute-force attacks.",
            "C: Direct use of passwords may lead to the use of a limited character set, decreasing the entropy.",
            "D: User-supplied passwords are always longer than the required AES key size, leading to performance issues."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Weak Key Generation Functions"
    },
    {
        "id": "87631917-8bbb-4b9f-8cce-8b0d28f61a48",
        "source": "cs161_textbook",
        "question": "What are the security implications of an attacker obtaining the private key in an RSA signature scheme?",
        "choices": [
            "A: The attacker can only verify signatures but cannot generate new ones.",
            "B: The attacker gains the ability to generate valid signatures for any message.",
            "C: The attacker can invert the cryptographic hash function H.",
            "D: The attacker can decrypt messages encrypted with the public key."
        ],
        "answer": "B",
        "topics": [
            "Cryptography",
            "SystemSecurity"
        ],
        "keyword": "Private Key Compromise"
    },
    {
        "id": "38500b90-855d-47d2-889b-25f3e36c648b",
        "source": "cs161_textbook",
        "question": "In the WPA2-PSK protocol, several elements contribute to the security of the handshake process. What would be the potential security consequences of not including the MAC addresses of both the access point and the client in the derivation of the PTK? Select all that apply.",
        "choices": [
            "A: It would prevent the client and access point from verifying the integrity of the nonces exchanged during the handshake.",
            "B: It would make the PTK independent of the specific devices involved, potentially allowing for the reuse of the PTK across different sessions.",
            "C: It would increase the difficulty of brute-force attacks against the PTK due to the reduced complexity involved in its derivation.",
            "D: It could lead to a situation where the same PTK is used across different networks with the same SSID and password, weakening network segregation."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PTK"
    },
    {
        "id": "b755a7aa-748b-4dcc-a6f6-45006c85bdf3",
        "source": "owasp_mastg",
        "question": "As a developer, you are tasked with implementing a secure storage solution for sensitive user data in a mobile application on the Android platform. Which of the following approaches aligns with best practices for secure data storage?",
        "choices": [
            "A: Storing sensitive data in SharedPreferences with MODE_PRIVATE.",
            "B: Using SQL Cipher to encrypt the SQLite database that stores sensitive data.",
            "C: Encrypting sensitive data with a hard-coded symmetric key before storing it locally.",
            "D: Saving sensitive data in plain text within internal storage for ease of access."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Secure Data Storage"
    },
    {
        "id": "d078802f-7667-4407-be6f-df377ea707df",
        "source": "owasp_mastg",
        "question": "You are integrating a third-party service into your mobile application. Considering the security of user data, which of the following approaches should you take?",
        "choices": [
            "A: Send all available information to the integrated service to ensure maximum functionality and user experience.",
            "B: Limit the information sent to the third-party service to the minimum required and avoid disclosing sensitive data.",
            "C: Prefer standalone libraries over full SDKs to ensure that the third-party service has limited access to the app's data.",
            "D: Use full SDKs for third-party services as they are more likely to adhere to better security practices than standalone libraries."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Third-party service integration"
    },
    {
        "id": "010c49e8-5a1c-424a-9301-a36494501eee",
        "source": "attck",
        "question": "A security engineer asserts that to prevent automated data collection by adversaries, simply restricting user permissions will suffice. Which counterargument best challenges this assertion based on the system requirements for automated data collection?",
        "choices": [
            "A: Restricting user permissions would not prevent adversaries from using cloud APIs to automatically collect data.",
            "B: Enhancing the physical security of the data center will impede adversaries from automated data collection.",
            "C: Automated data collection can only be executed by users with administrative privileges.",
            "D: Installing a next-generation firewall will automatically prevent any form of data collection."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Cloud APIs"
    },
    {
        "id": "43d16e03-37bb-47a6-9caa-ad15d03be18c",
        "source": "owasp_mastg",
        "question": "As a mobile application security tester, you are tasked with assessing the security of an iOS application. Which of the following methods would be considered best practices for securing the app during development and testing?",
        "choices": [
            "A: Implementing certificate pinning to prevent man-in-the-middle attacks.",
            "B: Using weak encryption algorithms for faster performance.",
            "C: Storing sensitive data in plaintext within the app's sandbox.",
            "D: Utilizing the iOS Keychain for storing sensitive user credentials."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "certificate pinning"
    },
    {
        "id": "93a6e363-7807-4623-ae9e-3068cdc907d5",
        "source": "cs161_textbook",
        "question": "Consider a simplified symmetric-key encryption scenario where the encryption of a plaintext is performed by XORing each bit with a corresponding bit of a key. If an attacker knows the ciphertext and has knowledge of the XOR properties, which of the following statements are true about the attacker's potential actions?",
        "choices": [
            "A: The attacker can determine the original plaintext if they also have access to the key, by XORing the ciphertext with the key.",
            "B: The attacker can produce any plaintext of their choosing by manipulating the ciphertext, regardless of the key.",
            "C: The attacker can deduce the key if they have access to both the plaintext and the ciphertext.",
            "D: The attacker can generate a valid ciphertext without knowing the key by guessing the plaintext and applying the identity property."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "XOR"
    },
    {
        "id": "38625f1c-e6a9-4b27-a84a-ee2b21e28797",
        "source": "cs161_textbook",
        "question": "A cryptosystem is designed such that when Bob receives a message from Alice, he verifies the integrity and authenticity using a tag that Alice generates. An adversary, Mallory, has managed to intercept and modify the message, but Bob's verification process fails to detect the tampering. What could be the reason for the failure of Bob's verification process?",
        "choices": [
            "A: Mallory possesses the same key Alice uses and successfully generates a valid tag for the tampered message.",
            "B: The cryptosystem lacks deniability, which allows Mallory to convincingly argue that the message originated from Bob.",
            "C: Alice's original tag was generated using a weak encryption algorithm that Mallory could easily reverse-engineer.",
            "D: Bob is using an outdated verification mechanism that does not account for modern tampering techniques employed by Mallory."
        ],
        "answer": "A",
        "topics": [],
        "keyword": "VerificationFailure"
    },
    {
        "id": "6a4c60c3-5252-43c6-8585-fbe021275ddc",
        "source": "cs161_textbook",
        "question": "A company argues that using TCP for their live video streaming service is the best choice because it guarantees the correctness of the data packets received. Which of the following would be the best counterargument to this claim?",
        "choices": [
            "A: TCP is preferred for applications where data needs to be retransmitted until the packets are correctly received, regardless of any time delays this may introduce.",
            "B: While TCP ensures data packet correctness, the indefinite waiting for packet retransmission can lead to unacceptable delays in a live video streaming context.",
            "C: TCP's 3-way handshake adds a level of security which is crucial for protecting the video content from unauthorized access.",
            "D: UDP might cause video quality degradation due to its non-guaranteed delivery, which is not desirable for a premium service."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ProtocolTradeoffs"
    },
    {
        "id": "5f1f92f6-a3a2-4970-803b-8e3e9d3fbc03",
        "source": "cwe",
        "question": "A web application uses a list-based protection mechanism to filter incoming requests based on predefined safe input patterns. However, a security analyst notices unusual behavior when certain unexpected inputs are processed. Which of the following scenarios could indicate that the protection mechanism is too permissive?",
        "choices": [
            "A: The system allows a request with an input pattern that closely resembles a known safe pattern, but it carries a slight variation that exploits a buffer overflow vulnerability.",
            "B: The list enforces strict type checking and only permits inputs that exactly match the safe patterns, resulting in a reduced number of accepted requests.",
            "C: A user's input is rejected because it matches an entry on a blacklist, even though the input is a common, non-malicious data entry.",
            "D: The system only allows inputs that have been digitally signed by a trusted authority, effectively preventing any unauthorized data from being processed."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PermissiveList"
    },
    {
        "id": "a28287ce-0c14-4044-903b-bad584671532",
        "source": "cwe",
        "question": "Review the following pseudocode for a function that handles sensitive user information. Identify the code snippet that could lead to the exposure of sensitive information if the application crashes or another weakness is present.",
        "choices": [
            "A: userCredentials.encrypt().storeInMemory();",
            "B: userPassword.toCharArray(); // Store password characters in memory",
            "C: tempFile.write(userSocialSecurityNumber.encrypt()); // Write encrypted SSN to temporary file",
            "D: memoryScrub(userCreditCardInfo); // Clear credit card info from memory after use"
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "CodeVulnerability"
    },
    {
        "id": "11cd1911-79fe-4815-b68a-b5705cc12b67",
        "source": "android_sec_doc",
        "question": "A device manufacturer is preparing to launch a new Android device and wants to ensure it uses file-based encryption (FBE) securely. What are the kernel support requirements that the manufacturer must meet, and why are these requirements critical for the secure implementation of FBE?",
        "choices": [
            "A: Kernel support for Ext4 and F2FS encryption with version 3.18 or higher is required, as this support facilitates the necessary encryption capabilities within the kernel.",
            "B: Kernel support for inline encryption hardware is optional but recommended, as it can improve performance and reduce power usage during encryption and decryption processes.",
            "C: Kernel version 5.1 or higher is mandatory for all Android devices, as older versions do not support the cryptographic acceleration needed for FBE.",
            "D: Kernel support for ARMv8 CE (Cryptography Extensions) acceleration is discouraged, as it can potentially introduce security vulnerabilities in the encryption process."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Kernel Support"
    },
    {
        "id": "cacb49dc-bd87-4e9c-9f94-ac60f73ce246",
        "source": "cs161_textbook",
        "question": "Considering the example of a web server that uses a SQL database to store course evaluations, which of the following HTTP GET requests could potentially be used by an attacker to exploit a SQL injection vulnerability in the server's query processing mechanism?",
        "choices": [
            "A: http://www.berkeley.edu/evals?course=cs61a",
            "B: http://www.berkeley.edu/evals?course=cs61a'; DROP TABLE evals--",
            "C: http://www.berkeley.edu/evals?course=1 OR '1'='1",
            "D: http://www.berkeley.edu/evals?course=cs61a AND 'x'='x"
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "3aefa1fb-e43d-4248-820a-1d2429c8c6de",
        "source": "owasp_wstg",
        "question": "Consider an HTTP request made to a web application for a user login process. Given that the request contains sensitive user information, which of the following options indicates the most secure way to transmit the user credentials?",
        "choices": [
            "A: Including the username and password as plaintext in the query string of the URL.",
            "B: Placing the credentials in the body of a POST request over a secure HTTPS connection.",
            "C: Storing the username in a cookie and the password in the query string of the URL.",
            "D: Sending the credentials through a GET request with basic HTTP authentication."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTTPS"
    },
    {
        "id": "f9582b54-68c2-45fb-ba21-d6608487f322",
        "source": "cs161_textbook",
        "question": "In the context of DNSSEC, a name server has two key pairs: a Key Signing Key (KSK) and a Zone Signing Key (ZSK). During the verification process, certain steps are performed to establish trust in these keys. Which of the following statements correctly describe the steps involved in the verification process and the roles of KSK and ZSK?",
        "choices": [
            "A: The public ZSK is endorsed by the parent name server's DS record, and the DNS resolver uses the public ZSK directly to verify the signature on the set of records.",
            "B: The public KSK, endorsed by the parent name server, is used to sign the public ZSK, which the DNS resolver verifies to establish trust in the public ZSK.",
            "C: The KSK acts as a 'parent' within the name server, endorsing the 'child' ZSK by signing it, and the DNS resolver trusts the ZSK based on this endorsement.",
            "D: The DNS resolver uses the public KSK, which is signed by the root's ZSK, to verify the authenticity of the records signed by the ZSK."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNSSEC"
    },
    {
        "id": "cd58d9f2-f046-4c87-a32f-e1a452b4d452",
        "source": "owasp_wstg",
        "question": "You are tasked with testing the security of a web application that uses GraphQL. During this process, you decide to utilize introspection queries to gather more information about the GraphQL schema. Which of the following statements best describes the reason for using introspection queries in this context and identifies a potential security implication?",
        "choices": [
            "A: Introspection queries are used to determine the GraphQL schema's efficiency and performance characteristics, potentially exposing the application to denial of service attacks.",
            "B: Introspection queries are used to retrieve the supported queries, data types, and schema details of the GraphQL deployment, possibly revealing sensitive information that could be exploited by attackers.",
            "C: Introspection queries are primarily used for search optimization within the application, providing little to no security risk.",
            "D: Introspection queries are used to modify the GraphQL schema at runtime, which could lead to unauthorized data alterations if not properly secured."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "GraphQL Introspection"
    },
    {
        "id": "8ade0a46-f799-450f-9050-c32d909afcee",
        "source": "attck",
        "question": "As a security analyst, you are configuring a detection system to identify potential Remote Service Session Hijacking activities. Which of the following data sources and components would be most effective for detecting such activities? (Select TWO.)",
        "choices": [
            "A: Monitor network traffic flow for uncommon data flows that could indicate hijacked sessions.",
            "B: Set up alerts for any use of encryption, as encrypted traffic is a clear sign of session hijacking.",
            "C: Monitor logon sessions to spot accounts accessing systems they do not normally use or exhibiting abnormal access patterns.",
            "D: Track process creation to identify new processes that could indicate the takeover of preexisting remote service sessions."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Session Hijacking Detection"
    },
    {
        "id": "df8da9aa-2a36-460c-972a-ce062f4df458",
        "source": "owasp_wstg",
        "question": "In the context of block cipher modes of operation, why might an attacker target the padding of an encrypted message using a bit-flipping attack, and what is one possible outcome if the underlying encryption mode is Cipher Block Chaining (CBC)?",
        "choices": [
            "A: The attacker aims to cause an integrity breach, resulting in the garbling of the plaintext corresponding to the manipulated cipher block.",
            "B: The attacker seeks to exhaust system resources, leading to a denial of service by triggering infinite loop decryption processes.",
            "C: The attacker's goal is to bypass input validation checks, allowing execution of unauthorized commands on the system.",
            "D: The attacker aims to intercept and modify SSL/TLS certificates, undermining the security of the communication channel."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Bit-Flipping Attack"
    },
    {
        "id": "6f2511d3-e5e1-447b-9581-66d2311d1a5f",
        "source": "cs161_textbook",
        "question": "A web development team is preparing a new website and currently has a placeholder page that simply states 'Under construction.' As a security consultant, you are asked to advise on potential security measures that should be considered even at this early stage. Which of the following practices would NOT be effective in preventing security vulnerabilities in the context of the placeholder page?",
        "choices": [
            "A: Implementing HTTPS to prevent man-in-the-middle attacks.",
            "B: Ensuring that the server software is up to date to prevent exploitation of known vulnerabilities.",
            "C: Adding input validation checks for user-submitted data.",
            "D: Disabling unnecessary services and ports on the server hosting the placeholder page."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SecurityPractices"
    },
    {
        "id": "80c72162-a388-44f1-9654-d7981f57daf3",
        "source": "attck",
        "question": "What are the potential consequences of disabling Microsoft Office macros/active content as a mitigation strategy against template injection attacks? Select two.",
        "choices": [
            "A: It can prevent the execution of malicious payloads in documents and thus reduce the risk of template injection attacks.",
            "B: It may not mitigate the Forced Authentication use for this technique, which could still prompt unauthorized authentication attempts.",
            "C: Disabling macros will encrypt the document content, making it unreadable to unauthorized users attempting to inject templates.",
            "D: The measure will automatically update the company's antivirus software to detect future template injection attempts more effectively."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Office Macro Security"
    },
    {
        "id": "018d03e1-4aee-4363-8daf-ee992d0e88c2",
        "source": "apple_platform_security",
        "question": "An organization is utilizing a variety of Apple devices across its network, including iOS, iPadOS, and macOS devices. There are concerns regarding the security of the data on these devices if they fall into the wrong hands. Which combination of security features would provide the best protection against unauthorized data access?",
        "choices": [
            "A: Using strong alphanumeric passcodes in iOS and iPadOS, which increase the entropy of encryption keys and entangle with the device’s UID.",
            "B: Leveraging the escalating time delays enforced by the Secure Enclave on devices after incorrect password attempts to prevent brute-force attacks.",
            "C: Relying solely on the built-in Data Protection feature for an Intel-based Mac, which is rooted in the dedicated silicon of the Secure Enclave.",
            "D: Setting up the Erase Data option, which removes all content and settings after 10 consecutive incorrect passcode entries."
        ],
        "answer": "ABD",
        "topics": [],
        "keyword": "UnauthorizedAccessProtection"
    },
    {
        "id": "d9fba682-724f-40b9-982a-8fdf9c402406",
        "source": "cwe",
        "question": "You are evaluating different design strategies for handling errors in an ASP.NET application during the architecture and design phase. Which of the following approaches would effectively improve security without processing or masking the error?",
        "choices": [
            "A: Configuring the application to use the framework's default error page for all users.",
            "B: Handling exceptions in source code and directing all errors, regardless of their origin, to a custom error page.",
            "C: Attempting to process errors in the code to return a generic success message instead of an error message.",
            "D: Creating a detailed error page that logs the error on the server but displays a generic error message to the user."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ErrorHandling"
    },
    {
        "id": "5e6f3998-8a0e-44f5-9308-4c8470cbebb5",
        "source": "owasp_mastg",
        "question": "As a mobile application security expert, you are tasked with reviewing the cryptographic security of a new Android application. You must ensure that the application adheres to best practices for secure storage of sensitive information. Which of the following measures should you recommend to enhance the cryptographic security of the application?",
        "choices": [
            "A: Utilize a custom encryption algorithm to ensure uniqueness and prevent known vulnerabilities found in standard algorithms.",
            "B: Implement industry-standard encryption algorithms and manage keys using a secure key management process.",
            "C: Store all cryptographic keys in plain text within the application's source code to simplify key management.",
            "D: Avoid encryption altogether, relying on Android's built-in user authentication to provide sufficient security."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Secure Key Management"
    },
    {
        "id": "1c64ff34-54ef-43c6-b136-bd405b07fa54",
        "source": "cs161_textbook",
        "question": "A stateful packet filter is experiencing intermittent failures when handling incoming network traffic, resulting in legitimate connections being dropped. Which of the following could be a plausible explanation for this behavior?",
        "choices": [
            "A: The packet filter is correctly dropping packets that do not match any rule in the access control policy.",
            "B: The packet filter's memory is depleted due to maintaining too much information per connection.",
            "C: The packet filter is not maintaining state and therefore cannot determine the context of the packets.",
            "D: The packet filter is forwarding all packets, including those that should be dropped according to the access control policy."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "FirewallFailure"
    },
    {
        "id": "c260eda4-1f94-4f41-b529-f3fcbe4aef99",
        "source": "owasp_wstg",
        "question": "A developer is implementing a new feature that requires storing sensitive user data. They must select an encryption method that ensures data confidentiality and integrity. Which of the following encryption practices should the developer avoid to maintain a high security standard?",
        "choices": [
            "A: Using AES in GCM mode with a strong, randomly generated key.",
            "B: Employing RSA encryption without Optimal Asymmetric Encryption Padding (OAEP).",
            "C: Applying SHA-256 for hashing user passwords with proper salting.",
            "D: Utilizing a custom-built encryption algorithm that is not publicly reviewed."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "RSA without OAEP"
    },
    {
        "id": "019fb4d8-8de5-4ce9-a766-28cc5f3d983d",
        "source": "apple_platform_security",
        "question": "As an administrator, you are configuring a fleet of macOS devices to enhance their security posture while allowing for certain operational flexibility. You need to modify the System Integrity Protection (SIP) settings to achieve the following objectives: 1) Permit the verification failures of the SSV volume root hash, 2) Ensure the kernel memory remains non-writable, and 3) Enforce the built-in allow list for boot-args NVRAM variable. Which of the following SIP fields would you modify?",
        "choices": [
            "A: Set sip1 to true to allow verification failures of the SSV volume root hash.",
            "B: Set sip2 to false to keep the Configurable Text Read-only Region (CTRR) hardware register locked, marking kernel memory as non-writable.",
            "C: Set sip3 to false to enforce the built-in allow list for the boot-args NVRAM variable.",
            "D: Set sip0 to a specific unsigned integer value that corresponds to disabling the enforcement of the built-in allow list for the boot-args NVRAM variable."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SystemIntegrityProtection"
    },
    {
        "id": "dd2e4e65-2e59-4eef-86a8-ec08cc315188",
        "source": "owasp_mastg",
        "question": "A mobile application developer is reviewing a piece of code in a native module that handles user input for processing. Which of the following practices should the developer ensure are implemented to mitigate the risk of memory corruption vulnerabilities?",
        "choices": [
            "A: Use of `strcpy` and `strcat` for efficient string operations.",
            "B: Implementation of precondition tests to prevent integer wrapping when using integer variables for buffer length calculations.",
            "C: Usage of `memcpy` without verifying that the target buffer is at least of equal size as the source.",
            "D: Employing Position Independent Executable (PIE) binaries to enhance Address Space Layout Randomization (ASLR)."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "MemorySafety"
        ],
        "keyword": "Memory Corruption"
    },
    {
        "id": "2d0844ac-b2d2-4154-8e73-de0c113c7344",
        "source": "attck",
        "question": "As a security analyst, you are tasked with setting up monitoring to detect potential adversaries using WMI for remote command execution. Which data source and component should you focus on to detect this activity?",
        "choices": [
            "A: Data Source: Command, Data Component: Command Execution",
            "B: Data Source: Network Traffic, Data Component: Encrypted Traffic Analysis",
            "C: Data Source: File Monitoring, Data Component: File Creation",
            "D: Data Source: Email Gateways, Data Component: Inbound Email Analysis"
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command Execution Monitoring"
    },
    {
        "id": "dfe63374-9219-4f5c-a27a-5befb178d163",
        "source": "attck",
        "question": "An attacker has successfully gathered detailed victim identity information, including email addresses, employee names, and credentials. Which of the following is the least likely method the attacker would employ using the gathered information?",
        "choices": [
            "A: Launching targeted phishing attacks using the email addresses.",
            "B: Attempting to access secure systems using the acquired credentials.",
            "C: Creating fake profiles on social media to gather more intelligence.",
            "D: Performing a network layer attack to disrupt service availability."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Victim Identity Information"
    },
    {
        "id": "501f4bd8-4152-4fc7-a707-32e002335860",
        "source": "windows_security",
        "question": "In a Windows domain environment, the security team has decided to disable the 'Network access: Allow anonymous SID/Name translation' policy setting. Which of the following is NOT a consequence of this action?",
        "choices": [
            "A: It will prevent anonymous users from resolving SIDs to usernames, reducing the chance of information leakage.",
            "B: It may increase the difficulty for system administrators to troubleshoot access issues due to the lack of anonymous SID/Name resolution.",
            "C: It will have no impact on the domain's security posture since SID/Name translation is not a significant risk.",
            "D: It could potentially lead to an increase in unauthorized access attempts as attackers try to bypass the new restriction."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "policy setting"
    },
    {
        "id": "e74a27b0-b719-4660-b828-bb3d18fdef9f",
        "source": "cs161_textbook",
        "question": "Alice and Bob are setting up a secure communication using the Diffie-Hellman key exchange protocol. They have agreed on the public parameters p and g, where p is a large prime and g is a generator. Alice chooses a secret value a and computes A=g^a mod p, which she sends to Bob. Bob chooses his secret value b and sends back B=g^b mod p. How should Alice and Bob proceed to ensure both end up with the same shared secret key?",
        "choices": [
            "A: Alice computes K=B^a mod p, and Bob computes K=A^b mod p, resulting in the same shared secret key K.",
            "B: Alice and Bob exchange their secret values a and b, then individually compute K=g^ab mod p.",
            "C: Alice computes K=A^b mod p, and Bob computes K=B^a mod p, and they use these different keys for encryption and decryption respectively.",
            "D: Alice and Bob publicly announce the computed values A and B, and an external trusted third party calculates K=g^(ab) mod p and sends it to both."
        ],
        "answer": "A",
        "topics": [],
        "keyword": "Diffie-Hellman"
    },
    {
        "id": "c9efb908-a952-492d-b339-59578aae8b3b",
        "source": "apple_platform_security",
        "question": "When using the Tap to Pay on iPhone feature, which of the following is NOT a security measure or operational characteristic of the service?",
        "choices": [
            "A: The Secure Element secures the payment card data and is involved in the contactless payment process.",
            "B: The NFC controller is responsible for handling communication between the Application Processor and the Secure Element.",
            "C: Payer's names, addresses, or phone numbers are collected and stored by the Tap to Pay service.",
            "D: Tap to Pay on iPhone has been externally assessed for security and approved by major credit card companies."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Tap to Pay"
    },
    {
        "id": "12eb76f3-49f4-407a-b5fe-cb1a8eaca791",
        "source": "apple_platform_security",
        "question": "A system administrator needs to adjust the security settings on an Intel-based Mac with an Apple T2 Security Chip to meet specific operational requirements. The administrator must enable the Mac to boot from a network volume despite not being able to verify the SSV volume root hash and to accept boot arguments that are not on the built-in allow list. Which System Integrity Protection (SIP) policy bits should the administrator change using csrutil or bputil from 1TR?",
        "choices": [
            "A: Set sip0 to disable SIP and downgrade to Permissive Security.",
            "B: Set sip1 to true, allowing iBoot to skip verifying the SSV volume root hash.",
            "C: Set sip2 to true, to lock the CTRR hardware register.",
            "D: Set sip3 to true, to bypass the boot-args NVRAM variable allow list."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SIP"
    },
    {
        "id": "cbc6b64d-1922-4cde-8f4d-aea90122fced",
        "source": "owasp_wstg",
        "question": "A web-based document management system allows users to upload and classify documents based on sensitivity levels. The sensitivity levels are represented in the system as a dropdown list, which is populated based on the user's role. What could be a potential vulnerability if the application's implementation is not properly secured?",
        "choices": [
            "A: Users with sufficient privileges are prevented from selecting certain sensitivity levels due to a misconfiguration.",
            "B: The application correctly hides the dropdown for sensitivity levels from users without sufficient privileges.",
            "C: An attacker modifies the sensitivity level of a document using an intercepting proxy, bypassing the role-based dropdown list.",
            "D: The system logs all changes to document sensitivity levels and requires administrator approval for sensitivity level changes."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Role-Based Access Control"
    },
    {
        "id": "565eb940-6d24-4a0a-a5f9-1839980d382d",
        "source": "attck",
        "question": "A security consultant argues that implementing preventive controls such as application whitelisting and user access controls would effectively mitigate the risk of adversaries collecting data from network shared drives. What is the most accurate counterargument to this claim?",
        "choices": [
            "A: While useful, preventive controls cannot easily mitigate this risk since adversaries exploit legitimate system features to perform the collection.",
            "B: Application whitelisting and user access controls will prevent any form of data collection, making them the most effective solution.",
            "C: Network shared drives are inherently secure, and therefore, additional preventive controls are not necessary.",
            "D: Adversaries do not target network shared drives, so focusing on preventive controls is an inefficient use of resources."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Preventive Controls"
    },
    {
        "id": "fa4cce19-1984-43d6-a09b-8a374b352e2a",
        "source": "owasp_mastg",
        "question": "In a secure mobile application development environment, which of the following practices ensures the safe inclusion of a system library without introducing common security flaws?",
        "choices": [
            "A: Including the same system header file multiple times to ensure it is loaded.",
            "B: Using an absolute path in the #include directive for clarity and certainty of the file's location.",
            "C: Using angle brackets in the #include directive for system header files to follow convention.",
            "D: Including a custom header file with the same name as a system file to override unwanted functions."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "#include convention"
    },
    {
        "id": "79080944-4cdf-44de-aa0d-4ef36b52c2a0",
        "source": "owasp_wstg",
        "question": "When securing a web application against SQL injection attacks, which of the following strategies is most effective in preventing such vulnerabilities?",
        "choices": [
            "A: Escaping all user inputs in SQL queries to ensure that they are treated as data rather than SQL code.",
            "B: Using parameterized queries or prepared statements to separate SQL code from data inputs.",
            "C: Increasing the privileges of the database user to ensure that the application can handle all types of inputs.",
            "D: Restricting the length of user inputs to prevent attackers from injecting SQL code into the input fields."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Parameterized Queries"
    },
    {
        "id": "cd30d3d2-001f-4389-8b38-6f85e10fe92c",
        "source": "owasp_mastg",
        "question": "A mobile application is vulnerable to data leakage due to insecure storage practices on the iOS platform. Which of the following code examples does not address this vulnerability?",
        "choices": [
            "A: Encrypting data before storing it in the device's keychain.",
            "B: Storing sensitive information in plain text within the application’s sandboxed directory.",
            "C: Using iOS’s Data Protection API to enforce encryption at rest.",
            "D: Implementing file-level encryption for sensitive files stored on the device."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "insecure storage"
    },
    {
        "id": "25137ba1-8c14-4a36-ad1a-1cc4143fe815",
        "source": "attck",
        "question": "In a discussion about adversary tactics, one team member claims that collecting the battery status information from compromised hosts is typically irrelevant for APT actors when establishing a foothold within a network. Which of the following would serve as the best counterargument to this claim?",
        "choices": [
            "A: Battery status could indicate the use of a mobile or portable device, which might be outside the network's secure perimeter more often.",
            "B: Battery status is critical to APTs as it always indicates the presence of an uninterruptible power supply (UPS) which they can exploit.",
            "C: APT actors are only interested in high-value targets, and battery status does not correlate with the value of a system.",
            "D: APTs focus exclusively on data exfiltration and would not waste time on peripheral system information such as battery status."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Battery status information"
    },
    {
        "id": "51f950ad-bf07-4153-8265-4ff4b3c4067e",
        "source": "apple_platform_security",
        "question": "A small company is planning to upgrade their network security. Which of the following measures should they implement to ensure a secure and robust network? (Select all that apply)",
        "choices": [
            "A: Install a next-generation firewall with integrated intrusion prevention capabilities.",
            "B: Enable SSID broadcasting to ensure that all devices can easily find and connect to the network.",
            "C: Implement a network segmentation strategy to divide the network into separate zones.",
            "D: Regularly update antivirus software on all network-connected devices."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "NetworkSecurityMeasures"
    },
    {
        "id": "58806859-e182-4267-8e7a-8ccd21b9c4da",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the cloud infrastructure of an organization and notices that instances have been created in geographic service regions that the organization does not typically use. Understanding that adversaries may exploit unused regions for evasion, which mitigation strategy should the analyst recommend to reduce the risk of this type of activity going undetected?",
        "choices": [
            "A: Increase the computational resources in frequently used regions to improve overall performance and redundancy.",
            "B: Configure alerting mechanisms to notify of activity in normally unused regions or unusual instance creation.",
            "C: Migrate all cloud services to a single region that supports advanced detection services to facilitate monitoring.",
            "D: Regularly rotate user account credentials for managing cloud infrastructure to prevent account compromise."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Infrastructure"
    },
    {
        "id": "ad51eab3-c1e0-447d-ab34-06b6c84ee19a",
        "source": "cwe",
        "question": "A developer is working on a user input handling function for a web application. The developer wants to secure the application against attacks involving the injection of NUL characters or null bytes. Which of the following approaches should the developer employ to mitigate this security weakness? (Choose all that apply)",
        "choices": [
            "A: Implement input validation that rejects input not strictly conforming to specifications, such as unexpected lengths or types.",
            "B: Strip out all null bytes from user inputs before processing to prevent any chance of misinterpretation.",
            "C: Allow input containing null bytes if they pass through an allowlist filter that checks for only alphanumeric characters.",
            "D: Decode and canonicalize inputs to the application's current internal representation before validation to prevent double-encoding attacks."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "6d853ce0-bb98-4805-bbfd-8c27d9e6f52b",
        "source": "attck",
        "question": "A security analyst claims that simply increasing the frequency of data backups will suffice to mitigate the threat of data destruction techniques that overwrite files with random data. What counterargument accurately addresses the limitations of this claim?",
        "choices": [
            "A: While frequent data backups can help restore data, they must also be stored off-system and protected against adversary access to ensure recovery.",
            "B: Data backups should be encrypted to prevent adversaries from overwriting files, as encryption is known to deter data destruction.",
            "C: Overwriting files with random data is an irreversible process, and thus increasing the frequency of backups will not mitigate this threat.",
            "D: Frequent data backups are sufficient as long as the storage media is physically secure, even if connected to the network."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Data Backup Security"
    },
    {
        "id": "932a98ba-5cf5-4c01-85e1-b842d5612bcd",
        "source": "attck",
        "question": "An organization has implemented strict password policies and privileged account management to protect against unauthorized credential access. However, adversaries are still attempting to fetch credential material. Which mitigation strategy could further hinder the adversaries' efforts without relying solely on user training and policy?",
        "choices": [
            "A: Increasing the frequency of password expiration to force users to change passwords more often.",
            "B: Restricting the number of failed login attempts to lock out accounts after several incorrect password entries.",
            "C: Implementing multi-factor authentication to add an additional layer of security beyond just passwords.",
            "D: Allowing users to store passwords in their web browsers for ease of access and to prevent password fatigue."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "57b89d12-dd5a-49be-95a0-5b25ca90e6f4",
        "source": "mozilla_security",
        "question": "A developer is generating a hash for the Subresource Integrity attribute of a script that will be loaded from a CDN. The developer executes the following command:\n\n$ curl -s https://cdn.example.com/library.js | openssl dgst -sha384 -binary | openssl base64 -A\n\nWhich of the following statements is a valid critique of this process?",
        "choices": [
            "A: Using the 'curl' command is not recommended because it cannot retrieve script files reliably from CDNs.",
            "B: The process is incorrect; the developer should use a different hashing algorithm, not SHA-384, for generating the integrity hash.",
            "C: The command correctly chains the retrieval of the script content with the generation of a SHA-384 base64-encoded hash, suitable for the integrity attribute.",
            "D: The developer should directly download the file and manually compute the hash to ensure accuracy, rather than using command-line tools."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SHA-384"
    },
    {
        "id": "a6186291-af7f-4aa0-8a43-e13710333562",
        "source": "cwe",
        "question": "A developer is implementing an XML processing module that uses an external library to parse XML documents with associated DTDs. To prevent a potential denial-of-service attack caused by recursive entity references, what measures should the developer consider? (Select two.)",
        "choices": [
            "A: Disable the processing of DTDs within the XML parser configuration to prevent recursive entity expansion.",
            "B: Implement a sophisticated AI algorithm to predict and block malicious XML uploads based on user behavior.",
            "C: Scan XML files for recursive entity declarations before parsing and reject documents with potentially explosive entity expansion.",
            "D: Create a whitelist of allowed XML tags and attributes, and filter out all others during the parsing process."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "XML_Entity_Expansion"
    },
    {
        "id": "dbbdd987-c6ef-495b-8861-35e37972fcae",
        "source": "owasp_wstg",
        "question": "An application security engineer is reviewing the usage of Java APIs within an application to ensure they are not vulnerable to XXE attacks. The engineer is aware that certain APIs require specific configurations to prevent XXE. Which of the following Java APIs, if used without proper configuration, would not prevent an XXE attack?",
        "choices": [
            "A: javax.xml.parsers.DocumentBuilderFactory",
            "B: java.net.URL.openConnection",
            "C: javax.xml.transform.TransformerFactory",
            "D: java.io.FileInputStream"
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "XXE"
    },
    {
        "id": "6f5decce-06fa-4883-a5fd-34a2dbea58bd",
        "source": "android_sec_doc",
        "question": "A security engineer is tasked with troubleshooting an Android device that has failed to start the encryption process. The device's UI needs to prompt the user to reboot the device and alert them that the encryption process has not commenced. Which `vold` property should the engineer investigate to ensure it is setting the correct status for this situation?",
        "choices": [
            "A: `vold.encrypt_progress error_not_encrypted`",
            "B: `vold.encrypt_progress error_reboot_failed`",
            "C: `vold.encrypt_progress error_partially_encrypted`",
            "D: `vold.decrypt trigger_shutdown_framework`"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "vold.encrypt_progress"
    },
    {
        "id": "79098a56-9ca9-4787-9502-f6be4adda810",
        "source": "owasp_wstg",
        "question": "Why is it important to ensure that there are appropriate policies, standards, and documentation in place before the development of an application begins?",
        "choices": [
            "A: Documentation serves no real purpose and is often ignored by development teams, making it an unnecessary step.",
            "B: Policies and standards are only useful post-development to guide the deployment and maintenance phases.",
            "C: Documentation provides development teams with guidelines and policies to follow, helping them make informed decisions during development.",
            "D: Establishing policies and standards is only essential for applications that use cryptography or require high-security measures."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "WebSecurity"
        ],
        "keyword": "Secure Coding Standard"
    },
    {
        "id": "d2bb5c1c-f7e0-47f9-b50b-28e322b723c4",
        "source": "attck",
        "question": "An adversary has gained access to a system within an organization's internal network. Which of the following commands or utilities could the adversary use to enumerate current network connections and gather information about connected systems and services? (Select TWO.)",
        "choices": [
            "A: Using the `netstat -anpo tcp` command to display TCP connections.",
            "B: Executing the `show ip sockets` command on a network device CLI to display IP sockets.",
            "C: Applying the `update-rc.d` command to enable service persistence.",
            "D: Running the `traceroute` command to map the path data takes to its destination."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "netstat"
    },
    {
        "id": "84b19ad2-602e-4328-8531-05e9a17d1b7c",
        "source": "windows_security",
        "question": "An administrator is configuring auditing policies on a Windows system and wants to ensure that event 4670(S) is generated when permissions on file system objects are changed. Which of the following actions should be taken to ensure that the event is logged, and what will NOT trigger the event?",
        "choices": [
            "A: Set 'Change Permissions' and/or 'Take Ownership' in the file system object’s SACL to ensure logging; changing the SACL itself will not trigger the event.",
            "B: Set 'Write DAC' and/or 'Write Owner' in the registry object’s SACL to ensure logging; changing the owner of the file system object will not trigger the event.",
            "C: Set 'Execute File' and/or 'Delete' in the file system object’s SACL to ensure logging; changing the SACL itself will trigger the event.",
            "D: Set 'Read Data' and/or 'List Folder' in the file system object’s SACL to ensure logging; changing the object's data will trigger the event."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "SACL"
    },
    {
        "id": "db7eb7d2-91c0-4f79-8d52-61bcf7030e12",
        "source": "cwe",
        "question": "What are the potential consequences of freeing a pointer that points to memory not allocated with heap allocation functions such as malloc() or calloc()?",
        "choices": [
            "A: The program's memory management data structures may become corrupted, possibly leading to a program crash or allowing an attacker to modify critical program variables or execute code.",
            "B: The operating system will automatically correct the error and reallocate the memory to prevent any adverse effects.",
            "C: A compiler error will be triggered, preventing the program from compiling whenever free() is used incorrectly.",
            "D: The memory management system will silently ignore the free() call, leaving the program's operation unaffected."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "MemoryCorruption"
    },
    {
        "id": "28408480-29d1-456a-8a17-cf2ee8f6daee",
        "source": "windows_security",
        "question": "An organization is considering whether to deploy a Windows Server-based PKI or use a third-party Enterprise certification authority for Windows Hello for Business. As a security consultant, you are asked to provide a counterargument to the claim that 'using an existing Windows Server-based PKI is always the most secure and cost-effective option for an organization.' Which of the following responses would best address the claim?",
        "choices": [
            "A: A third-party Enterprise certification authority can offer specialized support and may have higher security standards than an in-house PKI.",
            "B: Using a Windows Server-based PKI will require the organization to install the certification authority on a domain controller, which is a security best practice.",
            "C: Deploying an enterprise certification authority is a complex process that should never be done internally.",
            "D: An existing Windows Server-based PKI will always ensure compatibility with all devices and services within the organization."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Enterprise Certification Authority"
    },
    {
        "id": "d02d7da3-cfb0-4890-93d4-a76378e24541",
        "source": "apple_platform_security",
        "question": "Select the statements that accurately describe the security mechanisms employed by Apple in the given scenarios:",
        "choices": [
            "A: The Handoff feature uses Bluetooth Low Energy (BLE) to advertise the domain name of a web page in encrypted bytes, which can only be decrypted by the user's other devices.",
            "B: Universal Clipboard's content is protected and is only shared with apps on the user's devices if the user explicitly allows clipboard sharing in their iCloud settings.",
            "C: When setting up iPhone mobile call relay, the audio transmission from the iPhone to another device is unprotected until the user authenticates the devices through a secure code.",
            "D: Text Message Forwarding requires devices to be signed into iMessage with the same Apple ID, and after enrolment, SMS messages are encrypted and forwarded using iMessage security methods."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Apple Security"
    },
    {
        "id": "353011e4-196f-41f7-9c39-636b7503f18a",
        "source": "apple_platform_security",
        "question": "Alice is using her Apple Watch to access macOS and third-party apps. She is out of Bluetooth range from her iPhone, but within a Wi-Fi network that her iPhone has previously joined. Which of the following actions can Alice perform securely with her Apple Watch?",
        "choices": [
            "A: Approve authorisation prompts from macOS and Apple apps.",
            "B: Join a new Wi-Fi network that neither her Apple Watch nor iPhone has joined before.",
            "C: Fetch Gmail emails by connecting directly to Gmail servers without the iPhone.",
            "D: Use the OAuth token from her iPhone's Mail app to authenticate to Google on her Apple Watch."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "authentication"
    },
    {
        "id": "b28f821f-3f20-4d2b-ab9d-f7186cd718e5",
        "source": "apple_platform_security",
        "question": "An iCloud user is attempting to recover their keychain through iCloud Keychain's escrow security. Which of the following are components of the recovery process as implemented by Apple?",
        "choices": [
            "A: The user must authenticate with their iCloud account and password as well as respond to an SMS sent to their registered phone number.",
            "B: The user directly provides the iCloud security code to Apple during the recovery process.",
            "C: If the user fails to retrieve their record after several attempts, the escrow record is destroyed and the keychain is lost forever.",
            "D: The iCloud security code is verified using the Secure Remote Password (SRP) protocol, ensuring the code itself isn’t sent to Apple."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "EscrowRecovery"
    },
    {
        "id": "43aafe27-95b8-48e3-a631-56bfada5d32e",
        "source": "owasp_mastg",
        "question": "As a security engineer, you are reviewing the network security practices for an Android mobile application. Which of the following practices should be implemented to ensure that the application adheres to recommended security standards?",
        "choices": [
            "A: Employing certificate pinning to prevent man-in-the-middle attacks.",
            "B: Using weak ciphers for encryption to ensure backward compatibility with older devices.",
            "C: Implementing HTTPS using TLS for secure communication over the network.",
            "D: Allowing self-signed certificates for ease of development and testing."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Certificate Pinning"
    },
    {
        "id": "f34abd9c-0ce5-4928-ab4f-1261ac6155cf",
        "source": "windows_security",
        "question": "You are tasked with configuring a Windows Information Protection (WIP) policy for your organization using a management tool. Your goal is to ensure that enterprise data is properly identified and protected without affecting employee productivity. Which of the following options should you include in your WIP policy configuration?",
        "choices": [
            "A: Designate all installed applications as 'protected' to ensure maximum security.",
            "B: Choose specific applications that require WIP-protection based on their access to enterprise data.",
            "C: Set the WIP-protection level to 'Block' to prevent any data from leaving the enterprise environment.",
            "D: Automatically classify all data as enterprise data to simplify management."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Windows Information Protection (WIP)"
    },
    {
        "id": "0a04ad67-0946-4a37-8445-50bf6eacf439",
        "source": "owasp_wstg",
        "question": "You are reviewing the security of an application framework that handles user input. To mitigate Mass Assignment vulnerabilities, the framework implements various measures. Which of the following measures would be effective in preventing an attacker from exploiting a Mass Assignment vulnerability?",
        "choices": [
            "A: The framework limits the HTTP methods to GET and POST, disallowing PUT and DELETE requests.",
            "B: The framework includes a feature that requires developers to explicitly define a list of allowed fields for binding in model classes.",
            "C: The framework implements a strict Content-Type header check, only accepting requests with 'application/x-www-form-urlencoded'.",
            "D: The framework uses a complex algorithm to hash field names before binding them to model properties."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Allowed Fields for Binding"
    },
    {
        "id": "d5e581cf-ac05-41a1-b7c1-70fa75fbfa0b",
        "source": "cs161_textbook",
        "question": "Consider a symmetric block cipher used in secure communications. Which of the following statements accurately reflect the properties and functions of a block cipher in the context of encryption and decryption? (Select all that apply)",
        "choices": [
            "A: The block cipher must be nondeterministic to ensure that the same plaintext input does not produce the same ciphertext output when encrypted with the same key.",
            "B: The block cipher must be a permutation on the n-bit strings, which implies that it is an invertible function to allow for decryption.",
            "C: A block cipher's security is solely determined by the length of the key, with longer keys always guaranteeing stronger security regardless of other factors.",
            "D: The block cipher uses a fixed-length key to select from a set of scrambling settings, ensuring that without the key, an attacker should not be able to decrypt the ciphertext."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "BlockCipher"
    },
    {
        "id": "595d4d64-2228-4924-9ed3-c4fe79368c45",
        "source": "windows_security",
        "question": "A company's security policy mandates minimizing the use of NTLM authentication due to known vulnerabilities. As a Windows Security Administrator, which policy setting would you first implement to transition towards this mandate, and what subsequent step should you take to ensure minimal disruption to existing systems?",
        "choices": [
            "A: Set the policy to 'Allow all' and then use the 'Audit all' setting to log NTLM authentication requests.",
            "B: Set the policy to 'Audit all' to log NTLM authentication requests, then review the logs to create an exception list.",
            "C: Set the policy to 'Deny all' immediately to force all systems to use more secure protocols like Kerberos.",
            "D: Set the policy to 'Not defined' which is the same as 'Deny all', effectively blocking all NTLM authentication."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "NTLM"
    },
    {
        "id": "b875832e-41ab-41ab-aa0d-a427771a0d62",
        "source": "windows_security",
        "question": "A company is looking to enhance the security of its Windows-based systems against DMA attacks from external peripherals. They have decided to enable Kernel DMA Protection. Which of the following actions are necessary to ensure Kernel DMA Protection is enabled and functioning correctly?",
        "choices": [
            "A: Disable BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection.",
            "B: Ensure that peripherals use drivers incompatible with DMA Remapping to prevent unauthorized DMA.",
            "C: Turn on Intel Virtualization Technology for I/O (VT-d) in UEFI settings.",
            "D: Reconfigure the system to support DMA attacks via 1394/FireWire for added security."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Kernel DMA Protection"
    },
    {
        "id": "3712d045-4e06-4d92-8417-e1f14de4ed47",
        "source": "apple_platform_security",
        "question": "Why does the Apple update process require a network connection to Apple servers during a software update, and why is a user's data volume not mounted during the update?",
        "choices": [
            "A: To verify that the update is personalised for the requesting device using the device's unique Exclusive Chip Identification (ECID).",
            "B: To ensure that the device downloads all available updates for every application installed, not just the operating system.",
            "C: To prevent any potential interference with user data or privacy breaches during the software update.",
            "D: To allow the user to interact with the update process and make decisions about which components to install."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "UpdateRequirements"
    },
    {
        "id": "890ef2ea-0064-4962-84b3-98e68e0b62bf",
        "source": "apple_platform_security",
        "question": "How does the Find My app ensure the privacy and anonymity of users and their devices while locating missing Apple devices?",
        "choices": [
            "A: The finder devices send encrypted location information to Apple without any authentication information, preventing Apple from identifying the finder or the owner of the device.",
            "B: The Find My app uses a static public key for broadcasting from the missing device, allowing only the owner to identify and track their device.",
            "C: Apple retains a log that correlates finder and owner identities based on the encrypted location information received.",
            "D: The missing device uses a counter-based key derivation method to frequently update its public key, preventing it from being tracked by a persistent identifier."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Privacy"
    },
    {
        "id": "77b19bf6-67b7-4be5-9a9f-1ad4edaaf535",
        "source": "apple_platform_security",
        "question": "An employee is setting up a new Magic Keyboard with Touch ID for the company's Mac. As an IT security analyst, you are asked to ensure all necessary security measures are taken during the setup. Which of the following steps are required to securely pair and authenticate the keyboard with the Mac? (Select all that apply.)",
        "choices": [
            "A: Exchange of public keys between the Secure Enclave on the Mac and the PKA block in the Magic Keyboard, rooted in the trusted Apple CA.",
            "B: Use of biometric data from the employee's fingerprint to generate a unique pairing key for the devices.",
            "C: Encrypting Touch ID data with AES-GCM using a key length of 256 bits and ephemeral ECDH keys upon successful secure pairing.",
            "D: Establishing a secure channel between the Magic Keyboard Touch ID sensor and the PKA block using a unique key created during the manufacturing process."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Pairing"
    },
    {
        "id": "faa0e896-8c81-4b26-9eb9-fe8ab5f98a10",
        "source": "windows_security",
        "question": "A security engineer is assessing the feasibility of enabling a security feature across the organization's IT infrastructure. The feature in question is 'memory integrity,' which is designed to mitigate the risk of code execution attacks by protecting the kernel and driver code. For which of the following systems should the engineer NOT consider enabling this feature?",
        "choices": [
            "A: Windows Server 2019",
            "B: Windows 10",
            "C: Windows Server 2008",
            "D: Windows 11"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Kernel Code Protection"
    },
    {
        "id": "1fb7ee87-99bd-4fec-895f-ae8c9637a5dd",
        "source": "android_sec_doc",
        "question": "Why might an SoC vendor prefer updating SELinux policy in Android 8.0 and higher as opposed to earlier versions of the operating system?",
        "choices": [
            "A: Earlier versions of Android required modifications to `boot.img` or `system.img`, making updates more cumbersome than the separate platform and vendor policy builds in later versions.",
            "B: Android 8.0 and higher do not support SELinux, thus simplifying the update process for SoC vendors.",
            "C: In Android 8.0 and higher, the `init` process no longer needs to load SELinux policies, eliminating the need for SoC vendors to modify these policies.",
            "D: The monolithic sepolicy files in the root directory of earlier Android versions were simpler to update compared to the modularized SELinux policy files in later versions."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "SELinux Policy Update"
    },
    {
        "id": "9b615dce-eb2c-408f-a4d3-89a6cf77a257",
        "source": "mozilla_security",
        "question": "A security team is evaluating measures to secure their web applications. Which combination of actions would be most effective in mitigating MIME type security risks?",
        "choices": [
            "A: Disallowing JavaScript execution, enabling X-Content-Type-Options header, and using only standard MIME types",
            "B: Running all content from a single domain, avoiding the use of cookies, and disabling client-side scripting",
            "C: Implementing comprehensive input validation, enforcing strict authentication protocols, and enabling full disk encryption",
            "D: Using robust encryption algorithms, updating all software to the latest versions, and implementing a firewall"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "X-Content-Type-Options"
    },
    {
        "id": "3a6b83ac-e13e-4d70-86f4-139503315a9a",
        "source": "android_sec_doc",
        "question": "In the context of Android security, if a security analyst argues that attestation certificates generated at the `Software` security level are equally as secure as those generated at the `StrongBox` level, what would be the best counterargument to this claim?",
        "choices": [
            "A: Attestations at the `Software` level are only as secure as the Android system itself, which can be more easily compromised than dedicated hardware security modules.",
            "B: The `Software` level indicates that the attestation is generated in a TEE, which is less secure than the Android system.",
            "C: Attestations generated at the `StrongBox` level are considered less secure because they rely on software-based protections.",
            "D: The `StrongBox` level is not recognized in Android security and therefore cannot be compared to the `Software` level."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Attestation"
    },
    {
        "id": "c21613d4-e9b5-4a4e-88ea-80e057500f48",
        "source": "apple_platform_security",
        "question": "An organization is reviewing the security features of Apple devices for use in a sensitive environment where audio surveillance and unauthorized access are primary concerns. They need to understand specific hardware security implementations that would mitigate these risks. Based on the hardware security features mentioned in Apple devices, which of the following statements are true?",
        "choices": [
            "A: Mac notebooks with Apple silicon disconnect the camera in hardware when the lid is closed to prevent any software from accessing it.",
            "B: iPads with an MFi-compliant case disconnect the microphone in hardware when the case is closed to prevent access by any software, regardless of its privileges.",
            "C: Face ID adapts to changes in appearance and uses a secure connection between the biometric sensor and the Secure Enclave for authentication purposes.",
            "D: The NFC controller in iPhone SE 2nd generation provides visual notification for completed Express Card transactions even when iOS isn't in use."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HardwareSecurity"
    },
    {
        "id": "073971b1-e9c8-47d5-9894-79db3d820305",
        "source": "windows_security",
        "question": "What is the primary reason some EMET features, such as Heap Spray, EAF, and EAF+, were not included in Windows 10's security mitigations?",
        "choices": [
            "A: These features were deemed to have low impact on the current threat landscape and did not significantly increase the difficulty of exploiting vulnerabilities.",
            "B: The features were too complex to integrate into the new Windows 10 architecture.",
            "C: Microsoft determined that these features could potentially compromise the stability of the Windows 10 operating system.",
            "D: Such features were not compatible with the Windows 10 user interface design principles."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "EMET Features"
    },
    {
        "id": "d0452a6e-eec2-417f-b62f-9bedebebe955",
        "source": "apple_platform_security",
        "question": "An organization's IT administrator is using Apple Configurator for Mac to manage a fleet of devices. Which of the following tasks can the administrator perform with this tool, and which restriction must be adhered to?",
        "choices": [
            "A: Restore iOS, iPadOS, and tvOS devices without an internet connection by linking them to a host Mac with internet access.",
            "B: Inspect and use the file containing the latest minor updates to the operating systems after a device is revived or restored.",
            "C: Add devices to Apple School Manager or Apple Business Manager even if the devices were not purchased from Apple or an authorised reseller.",
            "D: Bypass Activation Lock requirements during the setup of devices that are not connected to Wi-Fi or mobile networks."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DeviceManagement"
    },
    {
        "id": "cbd7f4b8-31b4-40bc-9f7c-f596279a09d5",
        "source": "cwe",
        "question": "Which of the following statements accurately reflect the consequences or mitigation strategies for the vulnerability associated with PRNG seed reuse?",
        "choices": [
            "A: Reusing a PRNG seed across sessions increases the entropy of the generated numbers, enhancing the security of the application.",
            "B: Utilizing libraries or frameworks that conform to FIPS 140-2 standards can help mitigate issues arising from obvious entropy problems in PRNGs.",
            "C: Re-seeding a PRNG periodically with user-provided input data can prevent attackers from predicting future outputs.",
            "D: Using a small seed space, such as sequential user IDs, for re-seeding PRNGs does not impact the predictability of the output."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "mitigation"
    },
    {
        "id": "0cd3fb7a-a11c-4978-95ea-bd8ef014f78c",
        "source": "owasp_wstg",
        "question": "A company has recently decommissioned one of its services that was previously hosted on an external cloud provider. The subdomain 'service.company.com' was used to access this service. As a security consultant, you are tasked to ensure that the decommissioning process does not leave the company vulnerable to subdomain takeover. Which of the following actions is most appropriate to prevent this security risk?",
        "choices": [
            "A: Update the 'service.company.com' DNS record to point to the company's primary website.",
            "B: Remove the 'service.company.com' DNS record from the company's DNS zone.",
            "C: Redirect the 'service.company.com' to a 404 Not Found error page.",
            "D: Maintain the DNS record but disable the cloud service account."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "DNS zone"
    },
    {
        "id": "bc023b01-d17a-438c-83cb-fabcbd04e188",
        "source": "owasp_mastg",
        "question": "In an Android environment, a developer is tasked with ensuring the security of cryptographic keys. Which Android security module should the developer rely on to ensure that cryptographic keys are handled securely within a Trusted Execution Environment (TEE)?",
        "choices": [
            "A: StrongBox, because it provides file-based encryption allowing different files to be encrypted with different keys.",
            "B: Hardware-backed KeyStore, as it enables apps to perform cryptographic operations in a TEE without exposing the cryptographic key material.",
            "C: GateKeeper, since it is responsible for pattern and password authentication, ensuring secure cryptographic key handling.",
            "D: SELinux, because it uses labels to define access controls and secure cryptographic key operations."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Hardware-backed KeyStore"
    },
    {
        "id": "9c4fdf32-66ab-49e1-a48b-0efd9a27aa78",
        "source": "cwe",
        "question": "While reviewing the code for a new feature of an application, a developer finds that input validation is only performed based on checking for known malicious or malformed inputs. Considering the best practices for secure coding, identify the issues that may arise from this approach and recommend more robust input validation methods.",
        "choices": [
            "A: Relying solely on denylists for input validation can be incomplete and may miss undesirable inputs, thereby recommending an 'accept known good' strategy.",
            "B: Using stringent allowlists for filename validation can help avoid directory traversal and file inclusion vulnerabilities.",
            "C: Input validation should ignore the full range of acceptable values, as focusing on syntax and length is sufficient for security.",
            "D: Removing dangerous characters like '../' sequentially from inputs is an effective method to prevent path traversal attacks."
        ],
        "answer": "AB",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "b8937968-6ff7-4dd7-b280-2795bf6cfd9e",
        "source": "cwe",
        "question": "Assess the following code snippets. Which of these does NOT illustrate a scenario that could indicate an empty code block vulnerability, assuming that each snippet represents the complete implementation of the intended functionality?",
        "choices": [
            "A: if (user.isAuthenticated()) {} // Intentional no-op for authenticated users.",
            "B: try { performCriticalOperation(); } catch (Exception e) {} // Catch block left empty.",
            "C: for (int i = 0; i < 10; i++) { /* Reserved for future use */ }",
            "D: void processUserInput(String input) { System.out.println(input); } // Regular function with behavior."
        ],
        "answer": "D",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "EmptyCodeBlock"
    },
    {
        "id": "413ba89c-0478-467b-9899-a77060f6dcb1",
        "source": "cs161_textbook",
        "question": "Given the trust-based nature of BGP, what is a feasible attack that a malicious Autonomous System (AS) might carry out to disrupt internet traffic?",
        "choices": [
            "A: Claiming responsibility for a network it doesn't own, redirecting traffic to itself.",
            "B: Encrypting all traffic passing through it, demanding a ransom for decryption.",
            "C: Physically cutting the cables of other ASs to become the only routing option.",
            "D: Sending corrupted packets to overload the network buffers of honest ASs."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "BGP_Attack"
    },
    {
        "id": "12daac5a-3b65-4420-9bce-4154d86750dc",
        "source": "windows_security",
        "question": "A company is planning to upgrade their Windows desktop environment to enhance security against new and emerging threats. As an IT security consultant, you are tasked with recommending features that should be included in the new Windows deployment to maximize threat protection. Which of the following features should you advise the company to implement? (Select two.)",
        "choices": [
            "A: Microsoft Defender Antivirus with cloud-based protection and machine learning capabilities",
            "B: Downgrading to a previous version of Windows to utilize established security protocols",
            "C: Enabling Controlled Folder Access to protect against unauthorized changes by hostile applications",
            "D: Disabling the Windows Firewall to prevent conflicts with third-party antivirus software"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Controlled Folder Access"
    },
    {
        "id": "c54381a5-6280-4e69-8ed3-34b2878e7610",
        "source": "windows_security",
        "question": "You are reviewing a PowerShell script that is intended to output the properties of issuance policies. The script uses a method to format the display of the distinguished name of an object referred to by the variable $OID. Based on PowerShell syntax and best practices, which of the following options provides the best counterargument to the claim that using `$OID.distinguishedName.ToString()` is the proper way to display the distinguished name?",
        "choices": [
            "A: Using ToString() method is unnecessary because PowerShell automatically calls this method when an object's property is referenced in a string.",
            "B: The distinguishedName property should be accessed directly without a method call, as ToString() may result in loss of data type integrity.",
            "C: The ToString() method is the correct approach for ensuring that the distinguished name is displayed with the appropriate data type formatting.",
            "D: The distinguishedName property is not a string, thus calling ToString() on it will cause a runtime error."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "PowerShell Object Properties"
    },
    {
        "id": "eb279d8b-8708-4616-bdc8-d800a6e7c231",
        "source": "windows_security",
        "question": "A security analyst is assessing risks associated with physical access to a company's workstations equipped with Thunderbolt ports. To mitigate the risk of drive-by Direct Memory Access (DMA) attacks via these ports, which security feature should be enabled?",
        "choices": [
            "A: Hypervisor-protected Code Integrity (HVCI)",
            "B: Kernel Direct Memory Access (DMA) protection",
            "C: Virtualization-based security (VBS)",
            "D: Hardware-enforced stack protection"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Kernel DMA Protection"
    },
    {
        "id": "e7da4823-07cd-41ee-8a2f-6c2a0727776d",
        "source": "owasp_wstg",
        "question": "Which of the following statements is a valid counterargument to the claim that 'Electronic Code Book (ECB) mode is a suitable encryption mode for protecting data because it is a mode of symmetric key encryption'?",
        "choices": [
            "A: ECB mode is not suitable because it does not hide data patterns well, making it vulnerable to certain types of cryptanalysis.",
            "B: ECB mode is asymmetric encryption and should not be used for data protection.",
            "C: Using ECB mode is ideal because it allows for parallel processing of data blocks, thus enhancing performance.",
            "D: ECB mode is the most secure encryption mode available and should be used for all encryption needs."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ECB mode vulnerabilities"
    },
    {
        "id": "ce76d584-0eeb-4720-9460-73b218458e08",
        "source": "attck",
        "question": "An adversary is conducting reconnaissance on a company's hosts to gather administrative data and configuration details. The security team is trying to detect this activity. Which combination of data source and data component should the security team focus on to detect patterns associated with the collection of host information from visitors?",
        "choices": [
            "A: Internet Scan - Response Content",
            "B: External Database - Query Logs",
            "C: Network Traffic - Packet Headers",
            "D: Application Logs - Error Messages"
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Reconnaissance"
    },
    {
        "id": "72963d98-6575-44f5-a19a-e637d42d2631",
        "source": "owasp_wstg",
        "question": "Consider a web service that retrieves user details based on their ID using a PostgreSQL database. The service generates a query to fetch user data from an HTTP request parameter 'id'. Given the SQL query template below, which code snippet correctly prevents SQL Injection attacks while allowing the service to function as intended?\n\n`SELECT * FROM users WHERE id = $_GET['id'];`",
        "choices": [
            "A: Using parameterized queries with prepared statements:\n`$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');\n$stmt->execute([$_GET['id']]);`",
            "B: Appending a comment character to truncate the query:\n`$query = 'SELECT * FROM users WHERE id = '. $_GET['id'] . '--';\n$result = pg_query($query);`",
            "C: Adding a semicolon to separate statements:\n`$query = 'SELECT * FROM users WHERE id = '. $_GET['id'] . ';';\n$result = pg_query($query);`",
            "D: Using `LIMIT` and `OFFSET` to control the result set:\n`$query = 'SELECT * FROM users LIMIT 1 OFFSET ' . $_GET['id'];\n$result = pg_query($query);`"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "85980c4a-b73b-441a-86aa-4f0e8a8a027c",
        "source": "owasp_wstg",
        "question": "As a security engineer, you are tasked with mitigating the risk of session fixation attacks in your company's web application. Which of the following strategies would effectively prevent session fixation attacks? (Select two)",
        "choices": [
            "A: Implementing full HTTP Strict Transport Security (HSTS) to prevent attackers from downgrading connections to unencrypted HTTP.",
            "B: Renewing session tokens after a user successfully authenticates.",
            "C: Disabling cookies entirely and using URL parameters to track sessions.",
            "D: Storing session identifiers in a database without issuing a new session ID upon user authentication."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HSTS"
    },
    {
        "id": "7eb1130f-328f-4106-b07c-4639f7542704",
        "source": "owasp_wstg",
        "question": "You are tasked with integrating security practices into the software development life cycle (SDLC) for a new project. Which of the following activities would best align with ensuring security is addressed throughout the SDLC?",
        "choices": [
            "A: Implement security testing only after the application has been fully developed and is ready for deployment.",
            "B: Define security requirements and review security mechanisms such as authentication and data confidentiality during the definition and design phase.",
            "C: Limit security considerations to the maintenance and operations phase to reduce the complexity of the development process.",
            "D: Exclude threat modeling from the design phase since it is more effectively performed post-deployment."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SDLC"
    },
    {
        "id": "86a4aad8-d3b6-4360-9568-af9f843db9f5",
        "source": "cs161_textbook",
        "question": "You are tasked with enhancing the security of a corporate network. Given the need to monitor potentially malicious activities, where could you install detectors to improve intrusion detection, and what is a potential advantage and drawback of each location? Select two sets of valid options.",
        "choices": [
            "A: Perimeter of the network: Advantage - Monitors all incoming and outgoing traffic; Drawback - Unable to detect insider threats.",
            "B: On each host: Advantage - Personalized security measures; Drawback - High maintenance due to numerous endpoints.",
            "C: In the cloud: Advantage - Global visibility; Drawback - Limited by cloud provider's infrastructure.",
            "D: On the main server only: Advantage - Centralized management; Drawback - Single point of failure."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IntrusionDetectionPlacement"
    },
    {
        "id": "728170e9-7d95-41bb-b035-4223729fdc04",
        "source": "owasp_mastg",
        "question": "You are tasked with intercepting and analyzing the traffic between a mobile application and its backend services. The mobile app utilizes both HTTP and non-HTTP protocols for communication. Which of the following methods would be suitable for intercepting and analyzing this traffic, and what are potential challenges you might face?",
        "choices": [
            "A: Configuring a system proxy on the mobile device to redirect HTTP(S) traffic through an interception proxy like Burp Suite or OWASP ZAP.",
            "B: Using nscurl or testssl.sh to intercept non-HTTP traffic such as XMPP or proprietary binary protocols.",
            "C: Employing tools such as Burp-non-HTTP-Extension or Mitm-relay to visualize and intercept non-HTTP protocols.",
            "D: Hooking functions such as SSL_write and SSL_read in the app to monitor sensitive data before it is transmitted over the network."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Interception Proxy"
    },
    {
        "id": "3ba5ff71-18fd-4de1-956b-773381a476fb",
        "source": "cwe",
        "question": "In the context of securing a system against the use of hard-coded credentials, which mitigation strategy would be LEAST effective and why?",
        "choices": [
            "A: Storing passwords and keys in an encrypted configuration file with restricted access.",
            "B: Implementing a 'first login' mode that requires the user to set a unique strong password.",
            "C: Using a static password for a back-end service that is known only to system administrators.",
            "D: Applying strong one-way hashes to passwords with randomly assigned salts for each hash."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Mitigation Strategies"
    },
    {
        "id": "44f59918-7a93-449f-93dc-c88c00fb3811",
        "source": "cs161_textbook",
        "question": "Consider an online banking system with different access control mechanisms in place. Which design choice would most likely result in a violation of the principle of complete mediation?",
        "choices": [
            "A: Implementing a session management mechanism that revalidates user credentials before performing any transaction.",
            "B: Using a single security module that verifies user permissions before performing account-related operations.",
            "C: Caching user permissions upon login to reduce load and using this cache for all subsequent permission checks.",
            "D: Designing the system to request two-factor authentication for every money transfer operation."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AccessControl"
    },
    {
        "id": "dc8d3e5a-bbc8-4a8c-a10e-9ad7a4afc1e0",
        "source": "cs161_textbook",
        "question": "A startup company is developing a smart home device that stores sensitive user data. To align with best security practices, they are considering various options for securing their device. Which of the following options best aligns with the principle of 'detect if you can't prevent' and ensures a proper response mechanism?",
        "choices": [
            "A: Implementing a multi-layered firewall to prevent any unauthorized access attempts.",
            "B: Using tamper-evident seals on the hardware to indicate any physical breaches.",
            "C: Developing a sophisticated AI that predicts potential vulnerabilities before they can be exploited.",
            "D: Maintaining offsite backups to restore service in the event of a catastrophic attack."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "detection"
    },
    {
        "id": "e7e1ac8b-5a66-4cbd-a099-699105c4e66b",
        "source": "attck",
        "question": "An organization's cybersecurity team is analyzing logs to detect potential adversarial tactics involving peripheral device discovery. Which of the following data sources and components should they primarily monitor to detect activities associated with the enumeration of peripheral devices?",
        "choices": [
            "A: Monitor network traffic patterns for unusual outbound connections to external command and control servers.",
            "B: Monitor for executed commands and arguments that may attempt to gather information about attached peripheral devices and components connected to a computer system.",
            "C: Monitor file access patterns to sensitive documents for unauthorized duplication or transmission.",
            "D: Monitor system logs for failed authentication attempts to identify potential brute-force attacks."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Peripheral Device Discovery"
    },
    {
        "id": "c371636c-e252-4d1c-9cac-238d2186f16d",
        "source": "attck",
        "question": "In a Windows multi-domain/forest environment, your team is preparing to deploy a new domain. To prevent adversaries from exploiting domain trust relationships for lateral movement, which approach would be most effective?",
        "choices": [
            "A: Frequent change of trust relationships between domains to confuse potential adversaries.",
            "B: Utilize the GetAllTrustRelationships() .NET method to dynamically adjust trust levels based on real-time threat analysis.",
            "C: Design the domain architecture to minimize the number of trust relationships and closely monitor domain trust enumeration activities.",
            "D: Encourage the use of shared credentials across domains to reduce the number of trust relationships required."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Domain Trust Relationships"
    },
    {
        "id": "eed07a1c-1b92-4510-8eea-606d118d400c",
        "source": "apple_platform_security",
        "question": "Consider a scenario where an iOS app developer is working on improving the security of their application. They are implementing various security features provided by the iOS Software Development Kit (SDK). Select the security measures that correctly apply to the developer's scenario:",
        "choices": [
            "A: Enabling Address Space Layout Randomization (ASLR) for third-party libraries to mitigate return-to-libc attacks.",
            "B: Utilizing Execute Never (XN) to mark certain memory pages as non-executable and prevent arbitrary code execution.",
            "C: Restricting the app's custom keyboard extension from having network access by default to protect user data.",
            "D: Opting the app out of the Data Protection class to ensure that user data remains encrypted until the first user authentication."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "iOS_Security_Features"
    },
    {
        "id": "772eaf2d-50f1-4097-a919-44d32f873de9",
        "source": "owasp_wstg",
        "question": "A pen tester is analyzing the security of a web application. During the assessment, the tester retrieves the robots.txt file and notices several Disallow directives. Understanding that web spiders, robots, or crawlers can intentionally ignore these directives, which of the following is the most accurate conclusion the tester can draw from this information?",
        "choices": [
            "A: The Disallow directives can be used to effectively protect sensitive web application directories from being indexed by search engines and accessed by unauthorized users.",
            "B: The Disallow directives in the robots.txt file are suggestions for the behavior of web spiders, robots, or crawlers and are not enforced by the server, making them unreliable for security enforcement.",
            "C: The robots.txt file is a legal document that web spiders, robots, or crawlers must adhere to, and any violation of the Disallow directives can lead to legal consequences for the offending party.",
            "D: The presence of Disallow directives indicates a robust security configuration, ensuring that the specified paths are completely inaccessible to all web spiders, robots, or crawlers."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Robots Exclusion Protocol"
    },
    {
        "id": "096e7d32-54e4-4460-a4b9-8cd1d67bf990",
        "source": "attck",
        "question": "If an adversary has wiped configuration files on network devices using Network Device CLI commands, why would upgrading network intrusion detection systems (NIDS) alone not be sufficient to prevent such incidents in the future?",
        "choices": [
            "A: Because NIDS are primarily focused on monitoring network traffic and may not detect command execution or unauthorized changes to device configurations.",
            "B: Because NIDS are outdated technology and have been replaced by next-generation firewalls in modern network security infrastructures.",
            "C: Because NIDS typically prevent physical access to network devices, not the execution of CLI commands by authorized users.",
            "D: Because NIDS are designed to prevent data backups from being accessed or destroyed, which is not relevant to wiping configuration files."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Device CLI"
    },
    {
        "id": "91c34387-8541-4e48-ae6d-04f5225a1172",
        "source": "cwe",
        "question": "Consider the implementation of a Struts framework ActionForm Bean. Which of the following options correctly describes the consequences of implementing a validate() method without calling super.validate(), and the benefits of including the call to super.validate()?",
        "choices": [
            "A: Not calling super.validate() disables the Struts default validation framework, potentially missing out on predefined validation routines.",
            "B: Including super.validate() call might cause performance issues due to redundant checks if the custom validation covers all necessary cases.",
            "C: Not calling super.validate() enables the form to bypass unnecessary validation steps, which might not be applicable to the specific form, enhancing performance.",
            "D: Calling super.validate() ensures that any global validation rules defined in separate configuration files are applied."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Validation"
    },
    {
        "id": "2198d116-a880-42c4-9ddf-76fd34a52cd7",
        "source": "owasp_wstg",
        "question": "A web application has implemented Multi-Factor Authentication (MFA) to enhance security. Which of the following actions would be considered a best practice in the context of robust MFA implementation?",
        "choices": [
            "A: Using a single factor for sensitive accounts to simplify the login process.",
            "B: Implementing MFA only for user accounts but not for administrative accounts.",
            "C: Employing MFA for all relevant accounts and ensuring protection against brute-force attacks.",
            "D: Avoiding auditing and logging of MFA-related activities to maintain user privacy."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Multi-Factor Authentication (MFA)"
    },
    {
        "id": "0e7e958e-18ed-4c54-bfdf-77fbfd6c7bcf",
        "source": "owasp_wstg",
        "question": "Review the following JavaScript code snippet used in a web application. Identify the line that introduces a potential security vulnerability due to improper use of encoding or decoding:",
        "choices": [
            "A: var encodedData = btoa(userInput);",
            "B: var decodedData = atob(encodedData);",
            "C: var urlEncodedData = encodeURIComponent(userInput);",
            "D: var htmlEncodedData = escape(userInput);"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Encoding/Decoding"
    },
    {
        "id": "27e50ce9-6abd-4c24-9fd8-baca8d02ab8d",
        "source": "owasp_mastg",
        "question": "When developing a mobile application for Android, you're considering using specific Android Platform APIs to enhance the app's capabilities. From a security perspective, which of the following statements are true regarding the use of Android Platform APIs?",
        "choices": [
            "A: Utilizing Android Platform APIs can expose the application to security risks if permissions are not appropriately managed.",
            "B: Android Platform APIs are inherently secure and do not require additional security measures when used in applications.",
            "C: Using Android Platform APIs can improve app security by providing standardized, well-tested functions.",
            "D: Android Platform APIs should be avoided completely to ensure the highest level of application security."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Android Platform APIs"
    },
    {
        "id": "263123cb-2687-4ee4-b5ed-daff666c732b",
        "source": "attck",
        "question": "In a security audit, you discover that an adversary has been leveraging the `dlopen` and `dlsym` functions in Linux to execute shared objects from arbitrary paths. Which of the following scenarios is a possible cause for this security issue?",
        "choices": [
            "A: The system's antivirus software is outdated, allowing adversaries to exploit known vulnerabilities.",
            "B: The application control settings are not configured to restrict module loading to trusted directories.",
            "C: Network firewall settings are improperly configured, allowing external access to internal resources.",
            "D: The intrusion detection system is not set up to monitor module load activities effectively."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Module Loading"
    },
    {
        "id": "a66504f7-824a-4bc2-974c-999e37e1ca9b",
        "source": "apple_platform_security",
        "question": "Bob wants to update his iMessage Name and Photo Sharing preferences to reflect his new profile picture and nickname. What cryptographic processes will his iPhone perform to securely update and share this information with his contacts?",
        "choices": [
            "A: Bob’s device will randomize a 128-bit record key and derive three subkeys using HKDF-HMAC-SHA256. Each field (name, photo, and filename) is encrypted with AES-CTR using one of the subkeys.",
            "B: Bob’s device will generate a 256-bit key for each iMessage contact, encrypt his name and photo using AES-GCM, and then securely share the keys with each contact over iMessage.",
            "C: Bob’s device will create a digital signature for the name and photo using his private ECDSA key, which his contacts can use to verify the authenticity of the shared information.",
            "D: Bob’s device uploads the encrypted name and photo to the public CloudKit database under a RecordID, and when sharing, sends the RecordID along with the record key in the iMessage payload."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "iMessage Name and Photo Sharing"
    },
    {
        "id": "daa238c2-a95b-475c-92a8-cda4f41c9448",
        "source": "attck",
        "question": "In a scenario where an adversary has gained access to a cloud service dashboard with stolen credentials, which detection methods could help identify unauthorized access and why?",
        "choices": [
            "A: Monitor for unusual outbound traffic patterns, as they may indicate data exfiltration by the adversary.",
            "B: Monitor for newly constructed logon behavior across cloud service management consoles.",
            "C: Correlate user account authentication logs with other security systems.",
            "D: Analyze the frequency of page views on the dashboard to detect automated scraping attempts."
        ],
        "answer": "BC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Logon Session Monitoring"
    },
    {
        "id": "8192660d-3029-4fcd-928c-12fd10c4221f",
        "source": "owasp_wstg",
        "question": "An e-commerce website selling precious metals quotes prices based on the market value at the time the user logs in. To secure the quoted price, a user must complete the transaction within a set time frame. An attacker attempts to exploit the system by initiating a transaction without completing it, waiting to see if the market price increases, and then finalizing the purchase at the initial lower quote. As a security consultant, which of the following would be effective remediations to prevent this type of exploitation?",
        "choices": [
            "A: Implement a system that updates the quoted price in real-time throughout the transaction process.",
            "B: Remove all time-dependent features from the website to prevent any form of timing attack.",
            "C: Allow unlimited time for users to complete transactions to prevent attackers from predicting when prices are updated.",
            "D: Introduce random delays in processing times to obscure any potential information leakage through timing analysis."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Timing Attacks"
    },
    {
        "id": "e6bc5c7d-9edb-4ede-8361-f9383144d2f4",
        "source": "apple_platform_security",
        "question": "In the context of cryptographic systems, what is the primary purpose of utilizing a 'unique ID (UID)' within a device's security infrastructure? (Select all that apply.)",
        "choices": [
            "A: To act as a one-off number in various security protocols, ensuring the uniqueness of each transaction or session.",
            "B: To serve as a 256-bit AES key that is used by the processor's hardware AES Engine, which is critical for data encryption processes.",
            "C: To identify web-based resources uniquely and consistently across different platforms and services.",
            "D: To generate a secure and unique signature for provisioning profiles, which enables apps to be installed and tested on iOS devices."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "UID"
    },
    {
        "id": "603f6eee-90eb-4c53-99ac-c093426b9b0a",
        "source": "attck",
        "question": "An adversary has infiltrated a network and is looking to escalate privileges within the system. Which of the following techniques could they use to discover group permission settings, and why would this information be valuable for follow-on activity?",
        "choices": [
            "A: Enumerating local group memberships to determine users with elevated permissions, facilitating targeted attacks.",
            "B: Decrypting encrypted traffic to reveal communication data, bypassing the need for group permission settings.",
            "C: Disabling security software to prevent detection, irrespective of group permissions.",
            "D: Spoofing network addresses to gain unauthorized access without discovering group permissions."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Permission Groups Discovery"
    },
    {
        "id": "77bc1ffd-3f46-4d0c-bc24-69ff98fc9ed5",
        "source": "owasp_mastg",
        "question": "An iOS application developer intends to store a user's authentication token securely on the device. Which of the following methods and attributes would be most appropriate to ensure the data is protected using the cryptographic hardware available on iOS devices?",
        "choices": [
            "A: Use `NSUserDefaults` with the attribute `FileProtectionType.complete` to ensure the data is encrypted using hardware-backed encryption.",
            "B: Use `NSFileManager` to create a file with the attribute `FileAttributeKey.protectionKey: FileProtectionType.complete` to secure the authentication token with hardware-backed encryption.",
            "C: Store the authentication token in a SQLite Database without any additional encryption, as SQLite provides sufficient security by default.",
            "D: Save the authentication token in a plist file using `NSDataWritingFileProtectionCompleteUnlessOpen`, which only encrypts the file when the device is locked."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "hardware-backed encryption"
    },
    {
        "id": "b560b723-d1d9-44a8-8398-34d5575b9e58",
        "source": "cwe",
        "question": "An IoT device manufacturer discovers a critical vulnerability in a Bluetooth Low Energy (BLE) SDK used across its product line. Which of the following mitigation strategies would be least effective in addressing the discovered vulnerability?",
        "choices": [
            "A: Clarifying roles and responsibilities for applying patches to ensure timely updates.",
            "B: Waiting for the annual security audit to review and address the vulnerability.",
            "C: Monitoring announcements from the SDK vendor and expediting patch deployment.",
            "D: Maintaining a Bill of Materials and monitoring for new vulnerabilities or EOL announcements."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "Vulnerability"
        ],
        "keyword": "Vulnerability Mitigation Strategy"
    },
    {
        "id": "3b844253-d779-4184-8f1f-fd7319ce8efb",
        "source": "android_sec_doc",
        "question": "An Android developer is designing a key management scheme that includes several constraints: the keys must have a device-unique identifier, there should be a limit on the number of uses per boot, and the keys need to support a specific minimum MAC length. Which combination of Android Keymaster tags would best fit these requirements?",
        "choices": [
            "A: Tag::UNIQUE_ID, Tag::MAX_USES_PER_BOOT, Tag::MIN_MAC_LENGTH",
            "B: Tag::NONCE, Tag::MIN_SECONDS_BETWEEN_OPS, Tag::MAC_LENGTH",
            "C: Tag::ORIGIN, Tag::OS_VERSION, Tag::PADDING",
            "D: Tag::KEY_SIZE, Tag::OS_PATCHLEVEL, Tag::NO_AUTH_REQUIRED"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Keymaster Tags"
    },
    {
        "id": "99504617-5f9d-45d3-9469-e497692389fb",
        "source": "cwe",
        "question": "A web application uses a blacklist approach to filter out user input before it is displayed on the site. The developers are considering switching to a whitelist approach for better security. What are the potential advantages and disadvantages of this change?",
        "choices": [
            "A: Advantage: A whitelist approach may be more exhaustive in preventing unexpected input. Disadvantage: It could lead to blocking legitimate user input if not comprehensive.",
            "B: Advantage: A blacklist is easier to maintain as it only needs to list known bad inputs. Disadvantage: A whitelist can become outdated, allowing new types of attacks.",
            "C: Advantage: A whitelist approach rarely needs updating. Disadvantage: A blacklist can offer more fine-grained control over user input.",
            "D: Advantage: Blacklisting can adapt quickly to new threats. Disadvantage: Whitelisting provides no security benefit as it cannot anticipate unknown threats."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "FilteringStrategies"
    },
    {
        "id": "c895dde1-080e-488e-860a-80e814f62af1",
        "source": "mit6.858",
        "question": "In designing a secure file storage system, a threat model was developed with the assumption that attackers can guess passwords but cannot physically steal the server. Based on the course's principles, which of the following could be potential oversights or inadequacies in this threat model?",
        "choices": [
            "A: The threat model does not account for the possibility of inside threats, such as a disgruntled employee with legitimate access.",
            "B: The threat model adequately considers all necessary precautions by focusing on password guessing attacks.",
            "C: The threat model has overlooked the potential for attackers to exploit vulnerabilities in the software used by the storage system.",
            "D: The threat model fails to consider the risk of attackers intercepting file transmissions over the network."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "ThreatModel"
    },
    {
        "id": "b921ae0d-a1ec-455c-89d8-74c6dff19354",
        "source": "windows_security",
        "question": "An administrator is reviewing the security event logs of a Windows Server and notes an event with EventID 4656. This event entry indicates that a request for access to a resource was made. Based on your knowledge of Windows security, which of the following statements are correct regarding this event? (Select TWO.)",
        "choices": [
            "A: Event 4656 confirms that the requested operation was performed successfully.",
            "B: Event 4656 is generated only if the object's SACL has the required ACE to handle the use of specific access rights.",
            "C: The 'Access Reasons' field is present in Event 4656 only from Windows Server 2012 and Windows 8 onwards.",
            "D: Event 4656 is generated to indicate that the requested access was declined, signifying a failure event."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SACL"
    },
    {
        "id": "2df1a1a3-fbc6-43b1-bd42-06623e3229a8",
        "source": "attck",
        "question": "A penetration tester is analyzing the security posture of an organization that has recently experienced a data breach. The breach was due to an adversary deploying network sniffing to capture user credentials and other sensitive information. Considering the techniques used by the adversary, which of the following mitigation strategies would be MOST effective in preventing such an incident in the future?",
        "choices": [
            "A: Regularly updating antivirus signatures on all endpoints.",
            "B: Implementing network segmentation to prevent broadcast and multicast sniffing.",
            "C: Increasing the complexity of user passwords.",
            "D: Restricting physical access to server rooms and network hardware."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "0f2fe8c2-ddc8-4fb0-b12f-fbcc1e5790d1",
        "source": "windows_security",
        "question": "In which of the following scenarios is the use of Remote Credential Guard NOT recommended due to its inherent limitations?",
        "choices": [
            "A: Connecting to a remote device that is joined to an Active Directory domain and authenticates using Kerberos.",
            "B: Accessing a file server from a remote host that requires a device claim.",
            "C: Establishing a direct RDP session to a target machine that acquires Kerberos Service Tickets on behalf of the user.",
            "D: Using Remote Desktop Connection Broker to facilitate connections to multiple remote devices."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Remote Credential Guard"
    },
    {
        "id": "8fb9728f-0f2d-49f1-a286-c853744a0e7d",
        "source": "android_sec_doc",
        "question": "You are updating an Android app to improve its security features. You decide to implement APK Signature Scheme v3 for your app's next release. Which of the following describes the correct format and purpose of the APK Signature Scheme v3?",
        "choices": [
            "A: The scheme allows for multiple signing keys and the convergence of different ancestor signing certificates to one, simplifying the management of app signatures.",
            "B: It introduces a proof-of-rotation struct to allow apps to rotate their signing certificate without being blocked by other apps, and to maintain a singly-linked list of older signing certs for trust continuity.",
            "C: The v3 scheme is designed to replace the v1 APK format completely, eliminating the need for an APK Signing Block and simplifying the installation process on Android devices.",
            "D: It supports APK key rotation by storing only the newest signing key in the APK signing block, and discards all previous keys for enhanced security."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "APK Signature Scheme v3"
    },
    {
        "id": "f2a9d380-597c-475d-9d4a-13519f83ec0c",
        "source": "cs161_textbook",
        "question": "Consider a scenario where a network engineer is troubleshooting a communication issue between two machines. The engineer captures a packet and begins examining it from the lowest layer upwards. What information will the engineer encounter first, and which header will be removed last during the process of decoding the packet back into human-readable text?",
        "choices": [
            "A: The engineer will first encounter the header for the highest layer protocol and remove it last.",
            "B: The header for the lowest layer protocol will be encountered first and removed last.",
            "C: The engineer will first encounter the header for the lowest layer protocol and remove it first.",
            "D: The header for the highest layer protocol will be encountered first and removed first."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Protocols"
    },
    {
        "id": "e9a42fcf-7177-4502-a594-e69f1f6a17a8",
        "source": "windows_security",
        "question": "In a Windows domain environment, an administrator has converted a security group to a distribution group. What are the potential implications of this change? (Select two.)",
        "choices": [
            "A: The group can no longer have security-related permissions.",
            "B: The group can now be used to distribute emails to members.",
            "C: The group will now provide administrative access to all members.",
            "D: The group will be automatically deleted after 30 days."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Group Type Change"
    },
    {
        "id": "eca946df-b622-433f-bc31-4e50fc338553",
        "source": "owasp_wstg",
        "question": "Given the following code snippet for a web application that uses a Microsoft SQL Server backend, which of the following factors does NOT contribute to preventing SQL injection attacks?",
        "choices": [
            "A: Employment of parameterized queries",
            "B: Adequate sanitization of user input",
            "C: Usage of ORM (Object-Relational Mapping) tools",
            "D: Concatenation of user input directly into SQL queries"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Dynamic SQL"
    },
    {
        "id": "01ef1160-6e04-4773-9b2b-2451d600f35f",
        "source": "attck",
        "question": "An incident responder notices that a particular piece of malware has been designed to exfiltrate recently modified files with certain extensions such as .doc, .xls, and .ppt from a compromised host. The malware selectively targets files based on their last modified timestamp and ignores all other files. Which of the following file discovery techniques does this behavior most closely resemble, and what is the rationale behind its selective nature?",
        "choices": [
            "A: Searching for files based on their extension, which can quickly identify potentially valuable data but may result in a large volume of less relevant files.",
            "B: Using a regular expression to locate configuration files, which may ensure that only specific types of files are targeted for exfiltration.",
            "C: Checking for specific folders to determine if the malware has run previously, which can minimize redundant data collection.",
            "D: Collecting recently changed files with specific extensions, which focuses on files that are likely to contain the most current and potentially sensitive information."
        ],
        "answer": "D",
        "topics": [
            "PenTest"
        ],
        "keyword": "Recently Changed Files"
    },
    {
        "id": "d99a1150-bf14-4f21-a92c-3b4c751f9801",
        "source": "windows_security",
        "question": "What could be a potential consequence of not incorporating device health attestation in a Zero Trust security model for Windows devices?",
        "choices": [
            "A: Increased administrative overhead due to manual verification of device configurations.",
            "B: Higher likelihood of compromised devices gaining access to the network, potentially leading to breaches.",
            "C: Restricted user access to resources, leading to decreased productivity.",
            "D: Over-reliance on network perimeter security, which might cause neglect of endpoint security measures."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Device Health Attestation"
    },
    {
        "id": "6c491b9f-50e0-4781-92b2-45949e4ccf42",
        "source": "cwe",
        "question": "In a code review, a team member suggests using a 'volatile' keyword for a shared counter variable to ensure thread safety in a multithreaded web application. Which of the following is the most compelling counterargument to this suggestion?",
        "choices": [
            "A: The 'volatile' keyword only ensures that the value of the variable is always read from the main memory, but it does not provide atomicity for read-modify-write operations.",
            "B: The 'volatile' keyword will significantly degrade the application's performance due to the increased overhead of synchronization.",
            "C: The 'volatile' keyword is not supported in the web application's programming language.",
            "D: Using 'volatile' is the best practice for ensuring thread safety and there are no compelling counterarguments."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Volatile"
    },
    {
        "id": "e008b67d-9946-4754-b55a-d5959aa94b06",
        "source": "cs161_textbook",
        "question": "When designing a web application, which of the following aspects related to the use of HTTP should a security analyst be particularly vigilant about?",
        "choices": [
            "A: Ensuring that all HTTP requests are stateful to maintain continuous user authentication.",
            "B: Implementing measures against Man-in-the-Middle (MitM) attacks, such as using HTTPS instead of plain HTTP.",
            "C: Configuring the server to accept HTTP 0.9 requests to ensure backwards compatibility with legacy systems.",
            "D: Using HTTP GET requests instead of POST for transmitting sensitive data to enhance performance."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Security"
    },
    {
        "id": "56d0688e-ffa9-4649-9d98-aa35f0ae8a2c",
        "source": "windows_security",
        "question": "In the context of Windows security, how do hardware-based security features generally compare to software-based security measures?",
        "choices": [
            "A: Hardware-based security features often provide more robust protection against physical tampering.",
            "B: Software-based security measures are inherently more secure as they can be updated more frequently.",
            "C: Hardware security features are less reliable because they can't be patched as easily as software vulnerabilities.",
            "D: Software-based security measures are less prone to zero-day exploits than hardware security features."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Physical Tampering"
    },
    {
        "id": "6504ace0-5ac4-4011-9093-39c8eb47644e",
        "source": "cs161_textbook",
        "question": "In the context of IP routing using BGP, why would relying solely on higher layer defenses be an insufficient strategy to protect against malicious activity by local networks?",
        "choices": [
            "A: Higher layer defenses can prevent misrouting but do not protect against traffic analysis.",
            "B: BGP operates at layer 3 and therefore is unaffected by defenses implemented at higher layers.",
            "C: Malicious local networks could still read and potentially modify messages in transit, despite higher layer defenses.",
            "D: BGP is designed to be self-securing and does not require additional defenses."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Defense Strategy"
    },
    {
        "id": "badc033f-f1cc-4080-899c-18762b95fc2b",
        "source": "windows_security",
        "question": "In an enterprise environment, you are considering enabling memory integrity to enhance the security posture of your Windows systems. Which of the following considerations should be taken into account before enabling memory integrity?",
        "choices": [
            "A: Compatibility with certain hardware device drivers may lead to system malfunctions or boot failures.",
            "B: Enabling memory integrity is only effective on systems with the latest antivirus software installed.",
            "C: Memory integrity should only be enabled on systems with a specific brand of processors to function correctly.",
            "D: The feature requires all systems to be disconnected from the network during the enablement process to ensure security."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Memory Integrity"
    },
    {
        "id": "d07949ae-8eb8-4a9a-a85b-2473410d5e6f",
        "source": "cwe",
        "question": "In a system where a certificate's revocation status is only checked during the initial connection setup, which of the following scenarios would not increase the vulnerability of the system to a potential attack?",
        "choices": [
            "A: A mechanism is implemented to periodically re-check the revocation status of the certificate during the session.",
            "B: Certificates are given a very short expiration time to limit the window of opportunity for an attacker.",
            "C: The system is designed to only check certificate revocation status on system startup, not upon each session or transaction.",
            "D: A monitoring system is in place to detect unusual patterns of use with certificates, hinting at potential malicious activity."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "Vulnerability"
        ],
        "keyword": "RevocationChecking"
    },
    {
        "id": "ad5e7454-4f48-4809-962e-43c4caa8a9c0",
        "source": "android_sec_doc",
        "question": "A new diagnostic tool has been developed for an Android device, which requires the use of the `sys_ptrace` capability to trace system processes for debugging. As a security engineer, you are evaluating the tool's compatibility with SELinux 'neverallow' rules. Which of the following is the most appropriate action to take?",
        "choices": [
            "A: Grant the `sys_ptrace` capability to the diagnostic tool since it is crucial for its functionality.",
            "B: Do not grant the `sys_ptrace` capability as it would violate SELinux `neverallow` rules, indicating the tool should not be present in user-facing builds.",
            "C: Allow the `sys_ptrace` capability only during development builds and remove it for production releases.",
            "D: Modify the SELinux `neverallow` rules to exempt the diagnostic tool from the `sys_ptrace` restriction."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "sys_ptrace"
    },
    {
        "id": "2802d9ab-980e-4f45-aa2a-3698c9872240",
        "source": "cwe",
        "question": "You are reviewing the design of a web application that accepts file paths as input from users. You need to ensure the application is secure against path traversal attacks. Which of the following strategies would be effective in mitigating this risk? (Choose all that apply)",
        "choices": [
            "A: Reject inputs that do not conform to a list of acceptable paths, transforming or discarding inputs that are dangerous or irrelevant.",
            "B: Use client-side validation to restrict user input to a set of predefined safe paths.",
            "C: Deploy an application firewall that can detect and block attack patterns related to path traversal.",
            "D: Allow unrestricted file path inputs and rely on the operating system's file permissions to provide security."
        ],
        "answer": "AC",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "823a1f0c-d738-4f84-9c02-5fd3be5eee28",
        "source": "windows_security",
        "question": "Which of the following statements is NOT true regarding the configuration of a CRL distribution point (CDP) and the associated settings in the issuing Certificate Authority (CA)?",
        "choices": [
            "A: The 'Include in the CDP extension of issued certificates' option must be selected for the CRL distribution point URL to be included in the certificates issued by the CA.",
            "B: The web server's file share should be named 'cdp$' to prevent it from being easily browsable, and the CA must be granted 'Full control' permissions on it.",
            "C: The CDP URL should begin with 'https://' to ensure secure delivery of the CRL over SSL/TLS.",
            "D: The new CRL distribution point URL should be added to the CA properties under the 'Extensions' tab by selecting 'CRL Distribution Point (CDP)' from the 'Select extension' list."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "CRL Distribution Point (CDP)"
    },
    {
        "id": "1e6f87ef-644a-4c53-8e06-b594d2a70170",
        "source": "windows_security",
        "question": "In a centralized security monitoring setup using Windows Event Forwarding, an analyst observes that the 'Group Domain' field for a newly created security-enabled local group is set to the computer's name rather than the domain name. What is the significance of this information for security monitoring purposes?",
        "choices": [
            "A: It indicates the group was created on a domain controller and requires immediate investigation",
            "B: It suggests that the local security group was created on a member server or workstation, which is an expected behavior",
            "C: It signifies the event was improperly forwarded and there may be an issue with the Event Forwarding configuration",
            "D: It means that the event is likely to be a false positive and can be disregarded in the monitoring process"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Windows Event Forwarding"
    },
    {
        "id": "007c98ee-f24d-46d7-9bf4-e1fbb418eeb4",
        "source": "cwe",
        "question": "In the context of defending against SQL Injection, why might input validation alone be insufficient, and what additional measure should be employed?",
        "choices": [
            "A: Input validation may not catch all malicious inputs; adding strict type checking can enhance security.",
            "B: Input validation is adequate for all user inputs; no additional measures are necessary.",
            "C: Input validation can be bypassed; therefore, error messages should contain detailed information for debugging.",
            "D: Input validation may miss certain inputs; proper output encoding and escaping are necessary."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidationLimitations"
    },
    {
        "id": "b9f740aa-3e0f-4025-afea-d691a9533013",
        "source": "cwe",
        "question": "Given the code snippet below, which modification would NOT prevent the exploitation of a path traversal vulnerability?\n\n\nmy $dataPath = \"/users/cwe/profiles\";\nmy $username = param(\"user\");\nmy $profilePath = $dataPath . \"/\" . $username;\nopen(my $fh, \"<\", $profilePath) || ExitError(\"profile read error: $profilePath\");\n\n",
        "choices": [
            "A: Sanitizing the 'username' parameter by removing any '../' sequences before appending it to the data path.",
            "B: Replacing the concatenation of '$dataPath' and 'username' with a hardcoded path that does not include user input.",
            "C: Adding an allowlist verification step to ensure 'username' corresponds to an existing profile within a predefined directory.",
            "D: Validating that 'username' is alphanumeric only, without ensuring it does not contain directory traversal sequences."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "PathTraversal"
    },
    {
        "id": "ae018421-b2a4-4cae-9dda-da6dc1afbd33",
        "source": "owasp_wstg",
        "question": "A company uses a webmail application that interacts with internal mail servers using the IMAP/SMTP protocols. The internal mail servers are not directly accessible from the internet and are presumed to have less rigorous security measures compared to the front-end servers. As a security consultant, you are tasked with assessing potential vulnerabilities. Which of the following actions should you prioritize to evaluate the security of this setup effectively?",
        "choices": [
            "A: Conduct a penetration test to inject arbitrary IMAP/SMTP commands to check if input data is properly sanitized.",
            "B: Focus solely on the security of the front-end web servers since they are the first line of defense.",
            "C: Restrict the assessment to the exploitation of known IMAP/SMTP protocol vulnerabilities exclusively.",
            "D: Implement anti-automation processes to prevent any form of injection attacks."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "IMAP/SMTP Injection"
    },
    {
        "id": "6b40c780-7a76-4e13-a984-14b82d76dd4f",
        "source": "owasp_wstg",
        "question": "In an eCommerce application, a user is allowed to download three documents monthly based on their subscription plan. Which of the following techniques, if implemented, would not effectively prevent a user from downloading more than the allowed number of documents?",
        "choices": [
            "A: Tracking the document download count in the user's browser cookies and preventing further downloads once the limit is reached.",
            "B: Using a server-side counter associated with the user's account to keep track of the downloads and enforce the limit.",
            "C: Setting up a database trigger to decrement a quota counter every time a document is downloaded and blocking downloads when the quota is zero.",
            "D: Implementing a cryptographic token that is issued per download and invalidated once used, with a maximum of three tokens issued per month."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "function usage limit"
    },
    {
        "id": "57ae34cc-2a53-499e-b1b9-ce3ffa9f44a0",
        "source": "apple_platform_security",
        "question": "A macOS administrator is configuring security policies on a Mac with Apple silicon. They are considering the implications of different security policy settings on the system's security posture. Which of the following statements correctly describe the effects of setting Reduced Security and Permissive Security policies?",
        "choices": [
            "A: Reduced Security allows for third-party kernel extensions but requires a reboot due to the merging of kexts into an Auxiliary Kernel Collection.",
            "B: Permissive Security enables signature verification throughout the secure boot chain and allows for a custom XNU kernel to be loaded.",
            "C: Setting a Mac with Apple silicon to Reduced Security prevents rollback attacks and disables System Integrity Protection.",
            "D: Under Permissive Security, disabling SIP on a Mac with Apple silicon allows for any arbitrary kext to be loaded into kernel memory during AuxKC generation."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityPolicy"
    },
    {
        "id": "509cf232-a8d0-4320-8f00-659c7d8c6266",
        "source": "apple_platform_security",
        "question": "As an IT administrator, you are explaining the features of Screen Time to a group of staff who use various Apple devices. Which of the following statements accurately describe the features supported by Screen Time across different operating systems?",
        "choices": [
            "A: Enforcing additional restrictions using Screen Time is possible on iOS, iPadOS, macOS, and watchOS.",
            "B: Setting web usage limits is a feature unique to macOS and is not available on iOS or iPadOS.",
            "C: Configuring Downtime is a feature available across iOS, iPadOS, macOS, and watchOS.",
            "D: Screen Time allows viewing of usage data only on iOS devices and not on iPadOS or macOS."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Screen Time"
    },
    {
        "id": "ee7b164a-ff51-4aff-be54-197bbc6fd0c1",
        "source": "cs161_textbook",
        "question": "Alice wishes to send an anonymous message to Bob using a proxy server and public key encryption to maintain her anonymity. What steps must Alice take to ensure that her identity remains concealed from both Bob and potential eavesdroppers?",
        "choices": [
            "A: Alice must encrypt her message using her own private key and send it directly to Bob.",
            "B: Alice should encrypt the message along with Bob's address using the proxy server's public key and send it to the intermediary.",
            "C: Alice needs to encrypt the message with Bob's public key and then send it to the proxy server for further anonymization.",
            "D: Alice should send an unencrypted message to the proxy server, relying on the intermediary's security measures to protect her identity."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Anonymity"
    },
    {
        "id": "d2c889dd-cd0a-4cbb-bd37-43de18dd7e6f",
        "source": "cwe",
        "question": "A web application developer is creating a new authentication feature. To secure the session management, which of the following techniques should the developer implement to mitigate the risk of session fixation attacks?",
        "choices": [
            "A: Generate a new session identifier upon user login and invalidate the old one.",
            "B: Keep using the existing session identifier after user login for performance reasons.",
            "C: Implement a secondary cookie with a random value that must match a session variable.",
            "D: Use a static session identifier to ensure users can easily return to their session."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "SessionFixation"
    },
    {
        "id": "b6b7fdc5-1175-4eda-ba73-98720c6c8bd8",
        "source": "apple_platform_security",
        "question": "In the context of Apple's integrated app security features for macOS and iOS/iPadOS platforms, which of the following correctly pairs a native capability with its intended purpose or third-party equivalent?",
        "choices": [
            "A: XProtect/YARA signatures - To help randomise memory regions and protect against memory corruption.",
            "B: eficheck - Necessary for a Mac without an Apple T2 Security Chip for rootkit detection.",
            "C: System Integrity Protection - Acts as an application firewall to restrict network access.",
            "D: App notarisation - To ensure third-party apps are from a known and approved source."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SecurityFeatures"
    },
    {
        "id": "8bc4bb88-bcac-40b4-a39a-764fb9e8d55d",
        "source": "attck",
        "question": "An adversary is attempting to evade defenses on a Windows system by executing arbitrary commands without directly invoking the command-line interpreter (cmd). Which of the following utilities could the adversary potentially abuse for this purpose, and what defensive mechanism could they be attempting to bypass?",
        "choices": [
            "A: Forfiles utility to bypass static file analysis",
            "B: Disk Cleanup utility to bypass application whitelisting",
            "C: Windows Defender to bypass heuristic analysis",
            "D: Program Compatibility Assistant (pcalua.exe) to bypass application control"
        ],
        "answer": "AD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Indirect Command Execution"
    },
    {
        "id": "c1e4b5c4-6956-46dc-a8ee-3d66385fd251",
        "source": "cs161_textbook",
        "question": "Consider the following URLs and determine which pairs will be considered to have the same origin under the same-origin policy:",
        "choices": [
            "A: `https://example.com:443` and `https://example.com`",
            "B: `https://example.com:80` and `http://example.com`",
            "C: `http://example.com:80` and `http://example.com`",
            "D: `http://example.com` and `http://www.example.com`"
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "same-origin policy"
    },
    {
        "id": "95240c65-da3a-46b3-b1a1-0dbe23447e10",
        "source": "cwe",
        "question": "Your team is tasked with enhancing the security of an existing software system that handles sensitive user data. During the requirements phase, you identify that encryption is necessary for both storage and transmission of this data. Which of the following actions should be taken to ensure that encryption is properly integrated into the system design? (Select all that apply.)",
        "choices": [
            "A: Specify which data is considered sensitive and ensure that its transmission or storage is encrypted using well-vetted algorithms.",
            "B: Develop a custom encryption algorithm tailored to your system's specific needs to avoid known vulnerabilities in public algorithms.",
            "C: Use strong, up-to-date cryptographic libraries or frameworks and ensure they are implemented correctly without skipping essential steps.",
            "D: Compartmentalize the system to create 'safe' areas and enforce privilege separation to control access to sensitive data."
        ],
        "answer": "ACD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "EncryptionIntegration"
    },
    {
        "id": "97a05d2f-9391-46c2-8acc-dd1d67b6b56c",
        "source": "attck",
        "question": "A penetration tester is tasked with discovering services on a target organization's systems to shape their follow-on behaviors. Which of the following techniques would provide the most comprehensive information regarding registered local system services without directly interacting with the Windows API?",
        "choices": [
            "A: Using `QueryServiceStatusEx` to directly query service statuses.",
            "B: Executing OS utility commands such as `sc query` and `net start`.",
            "C: Monitoring the network traffic for service-related data packets.",
            "D: Employing a third-party vulnerability scanner to passively detect services."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "System Service Discovery"
    },
    {
        "id": "fe3b3331-b239-482c-b535-d913fed29111",
        "source": "cwe",
        "question": "A web application developer needs to secure a session cookie to prevent CSRF attacks. Given the following four options to configure the session cookie, which option(s) will effectively mitigate the risk of CSRF attacks and adhere to best security practices?",
        "choices": [
            "A: Set the cookie with `sameSite: 'None'` and ensure all requests requiring the cookie are made using the POST HTTP method.",
            "B: Set the cookie with `sameSite: 'Strict'` to ensure the cookie is only sent with same-domain requests.",
            "C: Set the cookie with `sameSite: 'Lax'` which sends the cookie with top-level cross-domain GET requests but not with other methods that could mutate state.",
            "D: Do not set a SameSite attribute, relying solely on the secure flag to encrypt the cookie with HTTPS."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SameSite"
    },
    {
        "id": "c5a6b274-747c-4fb1-b9dd-f2b2bdf21266",
        "source": "owasp_mastg",
        "question": "You are tasked with performing security testing on a mobile application. Given that this is the first time the app is being tested and time is limited, which testing approach should you request from the development team, and why would this approach be most beneficial?",
        "choices": [
            "A: Request black-box testing access to simulate a real attacker's perspective since this approach is the fastest.",
            "B: Request white-box testing access because it allows for a much faster and thorough analysis due to full knowledge of the app.",
            "C: Opt for gray-box testing since it is the most common kind of testing and balances the number of test cases and speed.",
            "D: Avoid any testing access to the app's source code and rely solely on automated scanning tools to identify vulnerabilities."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "White-box testing"
    },
    {
        "id": "14f5a054-29ae-407d-8bc4-7f4ed7b394fa",
        "source": "android_sec_doc",
        "question": "You are tasked with writing a user space program that needs to interact with a Trusty service using the Trusty IPC Client API. Which of the following steps, in order, would you take to establish communication, send a message, and close the connection appropriately?",
        "choices": [
            "A: Call 'tipc_connect()' with the service name, use 'write()' to send messages, and 'tipc_close()' to end the connection.",
            "B: Invoke 'tipc_create_channel()' with the device pointer, queue messages using 'tipc_chan_queue_msg()', and use 'tipc_chan_destroy()' to terminate.",
            "C: Use 'write()' to send a request to the Trusty service, call 'tipc_connect()' with the device node, and 'tipc_close()' to terminate the connection.",
            "D: Start by opening the device node with 'open()', then 'tipc_connect()' with the service name, and finally 'close()' the file descriptor."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Trusty IPC Client API"
    },
    {
        "id": "aee6cc10-9021-46ed-b9b0-3966f1617492",
        "source": "attck",
        "question": "An organization's network was compromised through the use of tainted shared content, where adversaries executed code by adding malicious payloads to files on network drives. Which detection method would most likely identify this type of activity?",
        "choices": [
            "A: Monitoring for unexpected and abnormal access to network shares, especially when associated with file activity.",
            "B: Scanning emails for malicious links and attachments.",
            "C: Analyzing web traffic for signs of SQL injection attacks.",
            "D: Observing for irregular patterns in system resource utilization."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Share Access"
    },
    {
        "id": "e7605014-9769-48af-a7ed-0bdb55b409dc",
        "source": "windows_security",
        "question": "A company is evaluating its current security posture on its Windows client systems. Which of the following capabilities should be prioritized to improve protection against emerging threats? (Select all that apply.)",
        "choices": [
            "A: Deploying a sandbox environment for testing and analysis of suspicious applications and files.",
            "B: Configuring network-level authentication for Remote Desktop Protocol to reduce the risk of unauthorized access.",
            "C: Removing all third-party security software to avoid compatibility issues with Windows security updates.",
            "D: Implementing a strict password policy and educating employees about the importance of password complexity."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Sandbox Environment"
    },
    {
        "id": "e52cc525-749d-4fb7-ad09-d6c7abf67176",
        "source": "cwe",
        "question": "In designing a new web application, your team is concerned about protecting against Reflected XSS (Type 1) vulnerabilities. Which of the following measures should be implemented to reduce the risk of such vulnerabilities?",
        "choices": [
            "A: Escaping all user-supplied input when re-displayed to ensure that it does not execute on the client side.",
            "B: Configuring the application to use register_globals in PHP for better input handling.",
            "C: Validating only fields that are expected to be redisplayed by the site to save on performance.",
            "D: Using allowlists that limit the character set for dynamically constructed web pages."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "XSS"
    },
    {
        "id": "77c4583d-dd11-4bc5-be97-166004866a73",
        "source": "attck",
        "question": "An adversary is attempting to establish persistence on a compromised Windows system without being detected by host forensic analysis. Which of the following actions would likely be part of their strategy?",
        "choices": [
            "A: Modifying Registry keys to prepend key names with a null character to create pseudo-hidden keys.",
            "B: Increasing the Registry size limit to prevent the system from logging new entries and concealing their activity.",
            "C: Disabling the Windows Registry Editor (regedit) to prevent any further changes to the Registry.",
            "D: Encrypting the entire Registry database to render forensic analysis tools ineffective."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Registry Key Hiding"
    },
    {
        "id": "2dca13cb-6db6-4889-b2b3-2b5bd3c977bb",
        "source": "mozilla_security",
        "question": "A web application developer is configuring HTTP headers to prevent their site from being framed by any other site as part of a clickjacking defense strategy. Which of the following header configurations would NOT meet this requirement?",
        "choices": [
            "A: Content-Security-Policy: frame-ancestors 'self'",
            "B: X-Frame-Options: SAMEORIGIN",
            "C: Content-Security-Policy: frame-ancestors 'none'",
            "D: Content-Security-Policy: frame-ancestors https://trusted.partner.com"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Security Headers"
    },
    {
        "id": "e058c3bf-0566-4e2f-bf96-1048ad19ef40",
        "source": "windows_security",
        "question": "As an IT administrator, you are required to deploy a root CA certificate to Microsoft Entra joined devices to ensure they trust certificates issued by your organization's certificate authority. What are the essential steps you need to perform for this operation using Microsoft Intune?",
        "choices": [
            "A: Open the 'Certificate Manager' and request new certificates for each device individually.",
            "B: Create a new certificate profile in the Microsoft Intune admin center and assign it to the devices.",
            "C: Configure automatic certificate enrollment for domain controllers to avoid manual deployment.",
            "D: Set a calendar reminder for certificate expiration and manually update the devices."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Root CA Certificate Deployment"
    },
    {
        "id": "4a4c52ad-ca37-451a-b45f-a11cfbb8b3f7",
        "source": "windows_security",
        "question": "A user with a Microsoft Entra joined device is attempting to access corporate resources that require Kerberos authentication. Which of the following options accurately describes the sequence and methods used during the sign-in and resource access process?",
        "choices": [
            "A: The device uses the user's private key to sign a nonce received from Microsoft Entra ID, receives a PRT with a session key, and then leverages the TPM to protect the session key before authenticating to Active Directory using a cloud Kerberos trust.",
            "B: The device acquires a partial TGT from an on-premises AD FS server, then authenticates to Active Directory using a certificate-based Kerberos trust, and finally uses the partial TGT to request resources from Microsoft Entra ID.",
            "C: During sign-in, the device authenticates to Microsoft Entra ID and receives an encrypted PRT with session key, which is then decrypted with a transport key. For resource access, it uses metadata from the Windows Hello for Business key to locate a domain controller and sends a partial TGT to obtain a full TGT.",
            "D: The device bypasses Microsoft Entra ID authentication and directly connects to Active Directory using a self-signed certificate for Kerberos preauthentication, then retrieves a PRT from an on-premises domain controller to access the resource."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Windows Hello for Business"
    },
    {
        "id": "aa2f5df4-e5c3-4c1d-8b47-679c72706145",
        "source": "cs161_textbook",
        "question": "A company has recently faced a data breach, and it has been revealed that the attacker gained access to user accounts by exploiting password vulnerabilities. As a security consultant, you are asked to evaluate the situation and propose measures to mitigate such risks in the future. Which of the following risks were likely exploited by the attacker and what countermeasure could be implemented to prevent each risk?",
        "choices": [
            "A: Risk: Online guessing attacks. Countermeasure: Implementing an account lockout policy after a certain number of incorrect login attempts.",
            "B: Risk: Server compromise. Countermeasure: Storing passwords in cleartext to allow for easy recovery in case of server issues.",
            "C: Risk: Eavesdropping. Countermeasure: Enforcing the use of encrypted web connections using protocols like HTTPS.",
            "D: Risk: Client-side malware. Countermeasure: Encouraging users to install reputable antivirus software on their devices."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "PasswordSecurity"
    },
    {
        "id": "e0f49000-1b7c-4ae0-8e19-513c09417db5",
        "source": "cwe",
        "question": "An embedded system is designed to perform a secure-boot process by transferring bootloader code from Non-Volatile Memory (NVM) to Volatile Memory (VM) within the system. The design team is concerned about the potential for adversaries to modify the boot code in VM after authentication. Which of the following approaches could mitigate this security risk?",
        "choices": [
            "A: Implement a real-time monitoring system to track changes in VM after the bootloader code has been authenticated.",
            "B: Restrict access to VM by setting up hardware-based access controls and ensuring that only authenticated code can write to it.",
            "C: Encrypt the bootloader code in NVM using a symmetric key algorithm to prevent adversaries from reading the code.",
            "D: Design a watchdog timer that resets the system if the bootloader code execution takes longer than expected."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SecureBoot"
    },
    {
        "id": "99170c96-194d-4d0a-84ac-40e6e1b15378",
        "source": "apple_platform_security",
        "question": "In the context of iOS and iPadOS security, consider the usage of entitlements and the concept of App Groups. Choose the statements that reflect the security advantages and potential risks associated with these features.",
        "choices": [
            "A: Entitlements can be modified at runtime by third-party apps to escalate privileges, posing a security risk.",
            "B: Entitlements provide a mechanism for third-party apps to access sensitive user information and system features, but are digitally signed to prevent modification.",
            "C: App Groups allow different apps and extensions owned by the same developer to share a common container, potentially exposing sensitive information if one app is compromised.",
            "D: App Groups enhance security by segregating apps into isolated containers, preventing any form of data sharing or communication."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "iOS Security"
    },
    {
        "id": "88fd7f84-427f-4b2d-82da-f410265622df",
        "source": "owasp_mastg",
        "question": "You are reviewing the network security configuration of an Android application that targets API level 28. The application's requirement is to ensure secure network communication but also needs to maintain compatibility with a legacy system that uses clear traffic. How should you configure the application's network security to meet these requirements?",
        "choices": [
            "A: Set android:usesCleartextTraffic to 'true' in the application's manifest file to allow clear traffic connections.",
            "B: Modify the res/xml/network_security_config.xml file to define a domain-specific configuration that allows clear traffic for the legacy system.",
            "C: Disable TLS by default because it is not compatible with clear traffic connections.",
            "D: Enforce DNS over TLS globally to allow clear traffic for legacy systems."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "network_security_config.xml"
    },
    {
        "id": "94c663ae-3885-44c7-aef4-9b0528d390bf",
        "source": "windows_security",
        "question": "You are reviewing the logs on an Active Directory domain controller and notice an entry indicating that a cleanup operation has taken place. Which of the following entries would most likely represent the schema of an event where a lingering object was removed from a replica?",
        "choices": [
            "A: Destination DRA: XYZ, Source DRA: ABC, Object: UserObject123, Options: Cleanup, Status Code: 200",
            "B: Destination DRA: XYZ, Source DRA: ABC, Object: UserObject123, Operation: ObjectDeletion, Result: Successful",
            "C: Target Replica: XYZ, Initiating Replica: ABC, Removed Object: UserObject123, Method: Automated, Response Code: 200",
            "D: Destination DRA: XYZ, Source DRA: ABC, Object: UserObject123, Options: NULL, Status Code: 0"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Active Directory"
    },
    {
        "id": "b533dca8-7422-4b22-86d8-e0157d8bc736",
        "source": "windows_security",
        "question": "An organization's security team has received an alert that the Per User Audit Policy has been changed, and the event has been logged with Event ID 4912. As part of the security investigation, what details would be most crucial to review in the Event 4912 log entry to determine the scope and impact of the change?",
        "choices": [
            "A: The specific changes made to the subcategory, as well as the Subcategory GUID to identify the exact policy altered.",
            "B: The date and size of the event log file to assess when the change occurred and how much data was written.",
            "C: The version of the operating system to verify if the event log entry is valid for the current system.",
            "D: The name and version of the antivirus software installed on the system to check for potential security breaches."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Event ID 4912"
    },
    {
        "id": "47eb3e63-8afa-424e-8969-2d5dab27a379",
        "source": "attck",
        "question": "An attacker has successfully enumerated all running processes on a compromised host. What are the potential advantages and disadvantages for the attacker following this action?",
        "choices": [
            "A: Advantage: Identification of security tools that could detect further malicious activities. Disadvantage: Increased network traffic alerting defenders.",
            "B: Advantage: Ability to manipulate system time to evade detection. Disadvantage: Limited access to user credentials stored in processes.",
            "C: Advantage: Direct access to modify firewall settings. Disadvantage: High chance of crashing the system leading to detection.",
            "D: Advantage: Enumeration of services to find unpatched vulnerabilities. Disadvantage: Triggering system alerts by accessing protected system files."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Process Enumeration"
    },
    {
        "id": "4e9270eb-fef6-44a9-ae23-c46ca2a55234",
        "source": "owasp_wstg",
        "question": "An administrator is considering obscuring web server information in the HTTP response headers to improve security. What would be a potential benefit and a potential drawback of implementing this practice?",
        "choices": [
            "A: Benefit: It would improve the encryption of data transmitted between the server and clients. Drawback: It could increase the server's response time to client requests.",
            "B: Benefit: It could prevent attackers from discovering version-specific vulnerabilities. Drawback: It may interfere with legitimate administrative tasks and diagnostics.",
            "C: Benefit: It would enhance the server's ability to handle high traffic loads. Drawback: It might make the server incompatible with certain web browsers.",
            "D: Benefit: It would automatically patch any existing vulnerabilities in the server. Drawback: It could lead to legal issues due to non-disclosure of server information."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "HTTP Response Headers"
    },
    {
        "id": "30d8a272-5248-4cf6-8e52-6c77b490103a",
        "source": "cwe",
        "question": "You are securing a Windows server and need to ensure that all files are only accessible via their long filenames to prevent unauthorized access through alternate naming schemes. Which of the following actions should you take to mitigate the risks associated with path equivalence issues, and what is a potential consequence of this action?",
        "choices": [
            "A: Enable support for 8.3 filenames in the Windows registry to standardize file naming and prevent alternate name creation.",
            "B: Disable Windows from supporting 8.3 filenames by editing the Windows registry, but understand that this will not remove previously generated 8.3 filenames.",
            "C: Rename all files to have 8.3 compliant names to avoid any path equivalence issues.",
            "D: Implement a file monitoring system that alerts administrators when a file is accessed using an 8.3 filename."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "8c52e7ec-2064-4168-ab04-9f3104a1c9d8",
        "source": "attck",
        "question": "During an incident response, a forensic analyst finds traces of a tool used by an adversary on a compromised system. The tool is known to collect various types of information about the system. Which of the following is NOT a function the analyst should expect the tool to have based on adversary behaviors observed in the wild?",
        "choices": [
            "A: Gathering OS version and hardware configuration",
            "B: Enumerating active network connections",
            "C: Retrieving drive information including free space",
            "D: Checking the system's BIOS or UEFI firmware information"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "BIOS/UEFI"
    },
    {
        "id": "027ab7ed-e446-4149-a82c-55f46a774e8e",
        "source": "owasp_wstg",
        "question": "A financial institution uses `https://secure.finbank.com` for all its online banking services. During a security assessment, you discover that the institution also has a mobile app that uses a separate authentication mechanism and does not enforce TLS encryption. Given this setup, which of the following actions should be recommended to remediate the identified security issue?",
        "choices": [
            "A: Enforce consistent authentication policies and TLS encryption across all channels.",
            "B: Only allow authentication through the primary web channel and discontinue the mobile app.",
            "C: Implement a stronger password recovery mechanism for the mobile app.",
            "D: Ignore the mobile app's authentication mechanism since it is not the primary channel."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "TLS encryption"
    },
    {
        "id": "0aed254f-8d18-4ea1-b374-b6d7751029fd",
        "source": "apple_platform_security",
        "question": "An organization is planning to deploy Magic Keyboards with Touch ID for their employees who use Mac computers. As the cybersecurity expert, evaluate the security measures in place for the Magic Keyboard with Touch ID. Which of the following statements accurately reflect the security mechanisms and policies present in this deployment scenario?",
        "choices": [
            "A: The Magic Keyboard with Touch ID performs biometric matching and stores biometric templates for user convenience.",
            "B: The Secure Enclave on the Mac performs enrolment, matching operations, and enforces security policies that require a password after a certain period of inactivity.",
            "C: All Touch ID data communicated between the Mac and Magic Keyboard with Touch ID is encrypted using AES-GCM with a key length of 256 bits.",
            "D: The Magic Keyboard with Touch ID can be paired with multiple Macs simultaneously to enable seamless user experience across different devices."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurePairing"
    },
    {
        "id": "33fc2bfc-0014-4e3e-aae1-780e708172e4",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, XML injection attacks can lead to a variety of exploits. Which of the following statements is true about the impact and limitations of XML injection in mobile apps?",
        "choices": [
            "A: XML injection can only impact the logic of an application and does not allow for other types of exploits.",
            "B: XML injection in mobile apps can potentially compromise the logic of an application, cause denial-of-service conditions, and access local files depending on parser configuration.",
            "C: Mobile apps are immune to XML injection due to the small attack surface and the fact that they rarely use XML.",
            "D: XML injection is a client-side attack, thus mobile apps are not vulnerable as they are server-side applications."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "XML injection"
    },
    {
        "id": "aa39c79d-8913-4e43-b0e1-2715b4b3a188",
        "source": "cs161_textbook",
        "question": "A company is planning to implement a firewall to serve as a reference monitor for their network. As the security expert, you are tasked with ensuring that the firewall will be effective in its role. Which features should the firewall exhibit to fulfill its intended purpose based on the principles outlined in standard firewall practices?",
        "choices": [
            "A: The firewall must have the ability to be bypassed for high-priority traffic to ensure performance.",
            "B: The firewall should be designed to automatically allow packets through if it fails to ensure constant network availability.",
            "C: The firewall must be tamper-resistant to prevent unauthorized modifications to its operation or policy enforcement.",
            "D: The firewall should be verifiable to confirm that it enforces the correct access control policy."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "firewall"
    },
    {
        "id": "80c18574-6ade-4e50-a37a-060d76ee1db4",
        "source": "android_sec_doc",
        "question": "You are designing an application that requires high security for its Android APK files. You've chosen to implement APK Signature Scheme v2 for signing the APKs. What are the benefits of integrating APK Signature Scheme v2 into your application's APK files, and what could be a potential drawback?",
        "choices": [
            "A: Benefits include increased verification speed and stronger integrity guarantees; a drawback is increased complexity in the signing process.",
            "B: Benefits include reduced file size and compatibility with all Android versions; a drawback is the reduced strength of the integrity guarantees.",
            "C: Benefits include stronger encryption methods and reduced need for permissions; a drawback is the lack of support on newer Android versions.",
            "D: Benefits include automated signing with multiple keys and self-validation of APKs; a drawback is the loss of backward-compatibility with older Android versions."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "APK Signature Scheme v2"
    },
    {
        "id": "e97e4103-c321-4145-95e3-0c7ad7a59969",
        "source": "apple_platform_security",
        "question": "When using a state ID from Apple Wallet, which of the following security mechanisms are applied according to the ISO/IEC 18013-5 standard to protect the user's identity data?",
        "choices": [
            "A: Use of an issuer-provided signature on the ID in Apple Wallet to allow verification by compliant readers.",
            "B: Session encryption that relies on the transmission layer's security, such as NFC or Bluetooth, to protect PII.",
            "C: The ID in Apple Wallet authenticates the identity reader using a protocol that shows an icon derived from the reader’s certificate.",
            "D: The ID in Apple Wallet requires users to make server calls during presentation to authenticate their identity."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ISO/IEC 18013-5"
    },
    {
        "id": "07bc2dae-5c16-404e-8b2d-2652be0c67de",
        "source": "owasp_mastg",
        "question": "You are tasked with enhancing the security of a mobile application by implementing fingerprint authentication for users on Android devices. Considering the best practices for biometric authentication, which of the following approaches provides the most secure method for using fingerprint data to authorize user access to a remote service?",
        "choices": [
            "A: Use the deprecated FingerprintManager class to authenticate users and store the authentication token in Shared Preferences.",
            "B: Implement BiometricPrompt with a symmetric key in the Android KeyStore, unlocked by the user's fingerprint and set with setUserAuthenticationRequired(true).",
            "C: Create an asymmetric key pair in the KeyStore and store the private key unencrypted on the device's internal storage.",
            "D: Utilize the BiometricManager class to check for biometric hardware availability only, without involving any cryptographic operations."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "BiometricPrompt"
    },
    {
        "id": "bffcc697-5264-4d0a-9d76-4e3a85085fe9",
        "source": "apple_platform_security",
        "question": "You are tasked with ensuring the security of the boot environment on a series of Macs with Apple silicon. When configuring the LocalPolicy file, which of the following constraints and properties should you consider to maintain the integrity of the boot process?",
        "choices": [
            "A: The LocalPolicy file must include the ECID of the Mac to prevent cross-device policy signing.",
            "B: A RemotePolicy Nonce Hash (rpnh) must be included in the LocalPolicy to cater to Find My Mac and Activation Lock events.",
            "C: The LocalPolicy for system recoveryOS should include a separate recoveryOS Nonce Hash (ronh) to allow booting even when other operating systems are disabled.",
            "D: A Chip Identification (CHIP) 4CC is not necessary in the LocalPolicy since it does not contribute to security policy configuration."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "LocalPolicy"
    },
    {
        "id": "7360ae18-72ad-4319-af55-85d06d5626d3",
        "source": "cs161_textbook",
        "question": "In a scenario where a cryptosystem utilizes a pRNG to sequentially generate secret keys and then initialization vectors (IVs) for encryption operations, what would be a potential consequence of using a pRNG that lacks rollback resistance?",
        "choices": [
            "A: It would enhance the performance of the cryptosystem due to simpler algorithmic requirements.",
            "B: It would make the pRNG's output more predictable, facilitating cryptographic operations.",
            "C: It could allow an attacker to deduce the value of the secret key if they compromise the internal state after IV generation.",
            "D: It would increase the cryptographic strength of the IVs generated after the secret keys."
        ],
        "answer": "C",
        "topics": [],
        "keyword": "consequence"
    },
    {
        "id": "d2368210-3833-48a7-8116-a4f982dfdfd5",
        "source": "owasp_mastg",
        "question": "A mobile security project rewards companies with a 'MAS Advocate' status for their contributions. Which of the following benefits is NOT directly associated with achieving this status?",
        "choices": [
            "A: Having the company logo displayed on the main project site.",
            "B: Using the project's resources as an endorsement by the project for preferred provider status.",
            "C: Special acknowledgement in project releases containing contributed PRs.",
            "D: Re-shares from the project's accounts on new publications."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "MAS Advocate Benefits"
    },
    {
        "id": "5cb80c47-fef9-4a9e-8c86-b764870d1ac5",
        "source": "owasp_mastg",
        "question": "A mobile app developer is configuring their iOS app's Info.plist file to ensure compliance with Apple's App Store review guidelines regarding App Transport Security (ATS). The app needs to communicate with a development server using self-signed certificates for testing purposes. Which of the following configurations of ATS exceptions is most appropriate to meet Apple's guidelines while maintaining security best practices?",
        "choices": [
            "A: Add 'NSAllowsArbitraryLoads' to allow all types of connections, including those using self-signed certificates.",
            "B: Add 'NSExceptionAllowsInsecureHTTPLoads' and 'NSExceptionMinimumTLSVersion' for the specific development server domain.",
            "C: Customize the server trust evaluation process to accept the self-signed certificates for the development server domain.",
            "D: Disable ATS entirely to ensure uninterrupted communication with the development server."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "App Transport Security (ATS)"
    },
    {
        "id": "b464b1c2-315c-4f18-82b8-6d6674fa4da9",
        "source": "owasp_wstg",
        "question": "Why is it crucial for technical personnel to translate their knowledge of software vulnerabilities into monetary terms for an organization's decision-makers?",
        "choices": [
            "A: Because technical personnel need to justify their own roles and the necessity of a security team within the organization.",
            "B: To enable Chief Information Officers (CIOs) to develop an accurate return on security investment and assign appropriate budgets for software security.",
            "C: So that technical personnel can focus exclusively on the most expensive vulnerabilities, disregarding the less costly ones.",
            "D: Because the cost of software vulnerabilities is always the primary concern for businesses, outweighing any other security consideration."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Return on Security Investment"
    },
    {
        "id": "ab94a879-2c54-4e3e-9678-a9cb3b60ea4d",
        "source": "apple_platform_security",
        "question": "A user has enabled Advanced Data Protection on their iCloud account and frequently collaborates on documents and shares photos. Considering the security implications and operational requirements of the Advanced Data Protection feature for iCloud, which of the following statements are correct regarding how data is handled?",
        "choices": [
            "A: When Advanced Data Protection is enabled, shared Notes remain end-to-end encrypted and Apple servers have no access to the encryption keys.",
            "B: If the user selects the 'anyone with a link' option for collaboration, the content needs to be accessible to Apple servers and thus is not end-to-end encrypted.",
            "C: Disabling Advanced Data Protection uploads both original and new service keys to iCloud Hardware Security Modules (HSMs), making all data accessible after authentication.",
            "D: iCloud Mail, Contacts, and Calendar are end-to-end encrypted even when Advanced Data Protection is turned off."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "iCloud"
    },
    {
        "id": "f251a4eb-6a81-445d-842f-81bcae54186b",
        "source": "android_sec_doc",
        "question": "An Android Keymaster RSA key is configured with both `KeyPurpose::ENCRYPT` and `KeyPurpose::SIGN` purposes. Why could this configuration be considered insecure?",
        "choices": [
            "A: Using the same key for both encryption and signing does not pose any security risk if the key is stored securely.",
            "B: An attacker could potentially exploit this configuration to generate valid signatures by decrypting arbitrary data.",
            "C: RSA keys are inherently insecure and should not be used for encryption or signing purposes.",
            "D: This configuration limits the key's functionality and hinders the performance of the Android Keymaster."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "KeyPurpose"
    },
    {
        "id": "51222a6e-c629-4ab5-996c-de4d6951ac2f",
        "source": "owasp_mastg",
        "question": "A company is planning to attain a prestigious recognition for its consistent support and high-impact contributions to a well-known mobile application security project. What actions would NOT contribute to achieving this recognition?",
        "choices": [
            "A: Regularly making financial donations to support the project.",
            "B: Creating and maintaining code samples for the project's repository.",
            "C: Promoting the project through social media by re-sharing content.",
            "D: Hosting public training sessions on the project's guidelines and updates."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "MAS Advocate"
    },
    {
        "id": "bc5b3422-3a7a-49ac-a77d-1bee63081b50",
        "source": "android_sec_doc",
        "question": "Consider an Android device that allows users to set their own root of trust for the purpose of installing custom versions of Android. If this feature is implemented, what security precautions must be in place to maintain the integrity and safety of the device's boot process?",
        "choices": [
            "A: The user-settable root of trust can be set remotely by the manufacturer to ensure only authorized versions of Android are installed.",
            "B: Physical confirmation is required to set or clear the user-settable root of trust, and it must be stored in tamper-evident storage.",
            "C: The device should boot any version of Android without validation once a user-settable root of trust is configured.",
            "D: User notification is not necessary when the device boots using the user-settable root of trust since the integrity is already ensured by the user's configuration."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "user-settable root of trust"
    },
    {
        "id": "903e72a1-df6a-40c4-96c3-cbb0402e83cf",
        "source": "windows_security",
        "question": "An IT professional at a company must configure Windows audit policy settings to monitor and track when an administrator modifies settings or data on servers containing finance information, and when employees access critical files. Which category or categories of advanced security audit policy settings should the professional focus on to efficiently meet these requirements?",
        "choices": [
            "A: Account Logon and Account Management",
            "B: Object Access and Policy Change",
            "C: Detailed Tracking and DS Access",
            "D: Logon/Logoff and Privilege Use"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Advanced security audit policy settings"
    },
    {
        "id": "7b093d7d-9012-4fd5-9200-6e9286a50498",
        "source": "attck",
        "question": "A system administrator has proposed a mitigation strategy to protect against adversaries attempting to inhibit system recovery. Which of the following actions would NOT enhance the recovery resilience of the system?",
        "choices": [
            "A: Regularly storing data backups off-system to prevent adversaries from accessing and destroying the backups.",
            "B: Enabling versioning on storage objects in cloud environments and copying backups to other accounts or regions.",
            "C: Disabling the Volume Shadow Copy Service (VSS) to prevent adversaries from using 'vssadmin.exe' to delete shadow copies.",
            "D: Implementing technical controls to prevent the disabling of services or deletion of files involved in system recovery."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Volume Shadow Copy Service (VSS)"
    },
    {
        "id": "4eb084c1-517b-482a-b0c9-2bb3402c68d5",
        "source": "windows_security",
        "question": "If an organization has a strict policy against remote registry access but still requires the use of remote management tools, which of the following statements provides a valid counterargument to enabling the Remote Registry service?",
        "choices": [
            "A: Enabling the Remote Registry service is necessary for remote management tools to function, but access can be regulated with proper ACLs.",
            "B: The Remote Registry service should always be disabled to maintain high security, even if it impedes the functionality of remote management tools.",
            "C: Remote management tools do not need the Remote Registry service to access the registry if the 'Network access: Remotely accessible registry paths' policy is configured correctly.",
            "D: The Remote Registry service is not related to the security of registry paths and therefore can be safely enabled without concern."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Remote Registry service"
    },
    {
        "id": "f1f400bd-0ec0-49b3-9f01-1df7a4dbe538",
        "source": "windows_security",
        "question": "A security administrator is configuring a monitoring system to alert on unauthorized changes to critical system files. To comply with best practices, which of the following configurations should be monitored? (Choose two.)",
        "choices": [
            "A: Alert on all events where 'Process Name' is not located in 'System32' or 'Program Files'.",
            "B: Alert on all events with 'Process Name' equal to 'cmd.exe' regardless of its path.",
            "C: Monitor 'Process Name' for the presence of substrings such as 'safeupdate' or 'patchme'.",
            "D: Alert only on events where 'Process Name' is located in 'Temporary Internet Files'."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security Monitoring"
    },
    {
        "id": "d610d2b2-9aac-49ad-acab-fc24e0a52182",
        "source": "owasp_wstg",
        "question": "A web application has implemented JWT for authentication and the tokens are transmitted over HTTPS. The developers have ensured that the JWT payload does not contain sensitive information. However, they are storing the JWTs in local storage on the client-side. Which of the following statements present a valid security concern?",
        "choices": [
            "A: Storing JWTs in local storage is secure since the payload does not contain sensitive information and the tokens are transmitted over HTTPS.",
            "B: Storing JWTs in local storage is insecure because it is susceptible to Cross-Site Scripting (XSS) attacks which could lead to token theft.",
            "C: JWTs should never be stored on the client-side, regardless of the transmission security or payload content, due to compliance with GDPR.",
            "D: Client-side storage of JWTs is recommended as it offloads the server from managing session state, enhancing the application's scalability."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Local Storage"
    },
    {
        "id": "8d06dea5-88d7-42be-8999-e33cf4adb41e",
        "source": "apple_platform_security",
        "question": "As a macOS application developer, you have completed the development of your app and are preparing to distribute it outside of the App Store. Which of the following steps are necessary to comply with Apple's security requirements and ensure that your app can be run under the default Gatekeeper settings?",
        "choices": [
            "A: Sign the app with an Apple-issued Developer ID certificate and private key.",
            "B: Notarize the app with Apple to confirm it's free of known malware.",
            "C: Obtain a revocation ticket from Apple for previous versions of the app.",
            "D: Ensure the app supports authentication with an MFi-SAP (Secure Association Protocol)."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "macOS"
    },
    {
        "id": "84333ec3-72d1-4f04-8682-e51f93aa1ca2",
        "source": "cs161_textbook",
        "question": "Why might signature-based detection not be sufficient as the sole security measure for a critical financial transaction system?",
        "choices": [
            "A: The system processes a high volume of transactions, which might cause performance issues with signature-based detection.",
            "B: Signature-based detection can easily be evaded by attackers using polymorphic code that changes its appearance every time it runs.",
            "C: Financial systems only require encryption for security, making signature-based detection irrelevant.",
            "D: Signature-based detection systems are primarily used for detecting physical intrusions, not cyber threats."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Limitations"
    },
    {
        "id": "636b9144-b96d-4770-8700-7024355ba1ba",
        "source": "cs161_textbook",
        "question": "As a cybersecurity consultant, you are explaining to a client why connecting their devices to an unencrypted WiFi network is a security risk. Which of the following reasons accurately explain why this practice should be avoided?",
        "choices": [
            "A: Connecting to an unencrypted WiFi network allows data to be transmitted securely, preventing unauthorized access.",
            "B: Unencrypted WiFi networks do not require a password, allowing any device to join and potentially monitor or inject traffic.",
            "C: Unencrypted WiFi networks utilize advanced encryption algorithms to protect data from being intercepted.",
            "D: Connecting to an unencrypted network typically involves a complex handshake process that increases security."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Unencrypted_Network_Risk"
    },
    {
        "id": "36b07f4b-b1b3-496c-8026-af02be0c1977",
        "source": "cwe",
        "question": "A web application development team is designing a feature that accepts user-generated content in the form of free-form text comments. To ensure security, the team has decided to apply various input validation techniques. Select the strategies that would effectively mitigate the risks associated with improper input validation.",
        "choices": [
            "A: Implement a list of acceptable inputs that strictly conform to specifications and reject any input that does not conform.",
            "B: Use a denylist to filter out known malicious inputs and allow all other inputs.",
            "C: Use client-side validation to provide immediate feedback to users and reduce server-side processing time for accidental input errors.",
            "D: Parse inputs using a formal language and build 'recognizers' for that language, enforcing a boundary between raw input and internal representations."
        ],
        "answer": "ACD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "54fa35cd-2b5d-4667-816a-80d6378f4773",
        "source": "mozilla_security",
        "question": "Which of the following HTTP response headers, if configured incorrectly, could potentially lead to security issues due to the misinterpretation of MIME types by the browser?",
        "choices": [
            "A: X-Content-Type-Options: nosniff",
            "B: Content-Security-Policy: default-src 'none'",
            "C: X-WebKit-CSP: default-src 'self'",
            "D: X-Permitted-Cross-Domain-Policies: none"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "MIME type security"
    },
    {
        "id": "0102d6b4-0d82-446a-976d-329cecc90480",
        "source": "cs161_textbook",
        "question": "Why might the use of randomized virtual keyboards not be an effective mitigation strategy against client-side malware designed to capture passwords?",
        "choices": [
            "A: Because users often forget their passwords when the keys are not in the usual order.",
            "B: Because malware can monitor and record the location of each mouse click and take a screenshot with each click.",
            "C: Because virtual keyboards are less efficient to use and thus more prone to user input errors.",
            "D: Because the electricity consumption of displaying a virtual keyboard can lead to system instability."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Virtual Keyboard"
    },
    {
        "id": "e2943d3f-386e-4940-8897-db4d2019ebdb",
        "source": "apple_platform_security",
        "question": "Select the roles and security measures that are correctly associated with the Secure Enclave and the Secure Neural Engine in Apple devices.",
        "choices": [
            "A: The Secure Enclave uses a Secure Storage Component to provide anti-replay security for events such as a Passcode change or adding a new Apple Pay card.",
            "B: The Secure Neural Engine on A11 to A13 SoCs is a separate processor with its own monitoring circuits to detect illegal operating points.",
            "C: The Secure Enclave includes power and clock monitors that stop the clocks automatically if an illegal operating point is detected, preventing restart until the next SoC reset.",
            "D: Starting with the A14 and M1 family, the Secure Neural Engine uses a dedicated hardware security controller to switch between tasks, ensuring the isolation of Face ID data."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Secure Enclave"
    },
    {
        "id": "9b3067aa-e203-4e94-a49b-b14b6adac87f",
        "source": "owasp_wstg",
        "question": "When assessing a web application for potential business logic vulnerabilities, which of the following statements best reflects the limitations of automated security testing tools?",
        "choices": [
            "A: Automated tools can effectively detect all types of business logic vulnerabilities by analyzing the application's state transitions.",
            "B: Automated tools excel at identifying syntax errors and misconfigurations but cannot understand the application's business context.",
            "C: Automated tools primarily rely on manual input to identify business logic vulnerabilities and thus are not useful in automated scanning.",
            "D: Automated tools can replace the need for manual penetration testing entirely, as they can adapt to the unique business processes of any application."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Automated Security Testing"
    },
    {
        "id": "3a6667d6-9dfc-4b9f-8f8f-1ec43c4a4e49",
        "source": "windows_security",
        "question": "You are configuring a new Windows deployment for a client who requires meticulous auditing for compliance purposes. You decide to review the default event logging settings to ensure they cover the necessary activities without overwhelming the system with logs. Which of the following statements are correct regarding the 'Other Events' auditing subcategory in Windows?",
        "choices": [
            "A: The 'Other Events' subcategory primarily logs user-initiated actions.",
            "B: Events in the 'Other Events' subcategory are enabled by default and are generated automatically.",
            "C: The 'Other Events' subcategory needs to be manually enabled during the initial setup of the operating system.",
            "D: Auditing events under the 'Other Events' subcategory are designed to log system shutdowns and startups."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Windows event logging"
    },
    {
        "id": "da33cff8-d623-4e13-adde-64bb3ce96a18",
        "source": "apple_platform_security",
        "question": "An organization's security officer is assessing the security features of Apple devices used by their employees. For enhanced security, the officer is looking into the measures that can be taken to control the flow of sensitive information through various Apple services. Select the measures an organization can take to mitigate risks associated with the following services:",
        "choices": [
            "A: Disable iPhone Mobile Calls in FaceTime settings to prevent phone call relay.",
            "B: Turn off Text Message Forwarding in Messages settings to stop automatic SMS forwarding.",
            "C: Disable iCloud sign-in on all devices to prevent Universal Clipboard data access.",
            "D: Revoke the DSID to stop Instant Hotspot from discovering and communicating with other devices."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "AppleServices"
    },
    {
        "id": "e186b702-d7fa-469a-9be3-bcb0c54a8666",
        "source": "apple_platform_security",
        "question": "Which of the following are security and privacy measures Apple Pay employs when a user pays within an app or uses Apple Pay on the web?",
        "choices": [
            "A: Apple Pay on the web requires all participating websites to register with Apple and a TLS client certificate is issued for domain name validation.",
            "B: The full set of requested transaction information is provided to the app immediately when the user initiates a payment request.",
            "C: The Secure Element marks any previously added cards as deleted upon receipt of a new Authorisation Random (AR) value.",
            "D: Apple Pay Handoff transmits payment-related information using a protocol that is not end-to-end encrypted, ensuring ease of access."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PrivacyMeasures"
    },
    {
        "id": "f7cf15b9-1245-4008-b776-7091f8226d2e",
        "source": "cwe",
        "question": "A company is developing a security system that relies on automated facial recognition to grant access to restricted areas. The system is based on machine learning algorithms that have been trained on a vast dataset of face images. Considering the risk of adversarial input perturbations, what are the potential strengths and limitations of this system?",
        "choices": [
            "A: The system can quickly adapt to new users by learning from additional data over time.",
            "B: The system could be tricked by introducing small, imperceptible changes to a face image that lead to misclassification.",
            "C: The system might be less effective if attackers lack the technical expertise to create adversarial inputs.",
            "D: The system may incorrectly recognize a person if the input data it was trained on is not sufficiently diverse."
        ],
        "answer": "BD",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "AdversarialPerturbation"
    },
    {
        "id": "2d44a561-2de0-4a71-acd7-7633a65bd225",
        "source": "owasp_wstg",
        "question": "In the context of performing web application security assessments, which of the following practices should not be considered as it does not contribute to improving the quality of a security assessment report?",
        "choices": [
            "A: Including a disclaimer indicating the limitations of the security test.",
            "B: Securing and encrypting the report to ensure confidentiality.",
            "C: Creating a version control section to document report changes.",
            "D: Assuming all findings have equal impact and presenting them without prioritizing based on risk level."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Report Prioritization"
    },
    {
        "id": "02310a86-6ad6-4a43-8bb8-7bac023163ed",
        "source": "cwe",
        "question": "A developer is implementing a login system that should not expose any internal state or decision process. Which of the following scenarios, if observed in the system, would indicate a potential security weakness due to observable behavioral discrepancies?",
        "choices": [
            "A: The system processes login attempts at different speeds, depending on whether the username exists.",
            "B: All failed login attempts result in an identical error message displayed to the user.",
            "C: The system logs detailed error messages, including stack traces, to the console upon a failed login attempt.",
            "D: A generic 'access denied' message is displayed for both incorrect usernames and passwords."
        ],
        "answer": "AC",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "ObservableBehavior"
    },
    {
        "id": "a1bd344e-0486-4e89-b55b-4926b0c6d033",
        "source": "owasp_wstg",
        "question": "You have been tasked with evaluating the security of a web application's session management schema. During your evaluation, you notice that the application uses cookies to manage sessions. Which of the following practices would you recommend to enhance the security of the session management system?",
        "choices": [
            "A: Ensure cookies that contain user information are not signed to provide greater transparency.",
            "B: Implement sufficient randomness in session token generation to prevent session forging.",
            "C: Limit the cookie collection process to a small sample to speed up the reverse engineering phase.",
            "D: Use URL parameters instead of cookies to avoid the complexity of managing cookie security."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Session Management"
    },
    {
        "id": "40a99051-cada-4294-929b-acd7d9c39ba9",
        "source": "mit6.858",
        "question": "In a side-channel timing attack on an RSA implementation, such as the one described against an Apache HTTPS web server using OpenSSL, what factors could contribute to the success of the attack in extracting the private key?",
        "choices": [
            "A: The malicious process would need to have administrative privileges on the victim server to perform cache analysis attacks.",
            "B: The adversary's ability to measure precise timing variations in the server's response to predict bits of the secret exponent is critical.",
            "C: The attacker must be physically present at the server's location to accurately measure response times.",
            "D: The adversary must be network-proximate to the victim server to effectively average over more queries and reduce noise."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Timing Attack"
    },
    {
        "id": "5f1f1b39-9cda-469b-abb7-6b0480dabda2",
        "source": "windows_security",
        "question": "Your organization's IT security policy mandates the auditing of sensitive privilege use on Windows servers. A colleague argues that this policy is unnecessary since user rights are already restricted to authorized personnel. How would you counter this argument? (Select two)",
        "choices": [
            "A: Sensitive privileges may still be misused by authorized personnel, and auditing helps in detecting such misuse.",
            "B: Auditing sensitive privilege use is only useful for systems with unpatched security vulnerabilities.",
            "C: The policy is crucial as it completely prevents the misuse of administrative privileges by creating technical barriers.",
            "D: Auditing provides a record of privilege use which can be critical for compliance and post-incident investigations."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Audit Policy"
    },
    {
        "id": "2108e61d-cf75-4387-b668-00fa8ec3e12a",
        "source": "owasp_wstg",
        "question": "A web application has implemented a 'remember me' feature using tokens to keep users authenticated. Security consultants argue that the tokens must have an expiration to enhance security. What is the best counterargument against indefinitely valid 'remember me' tokens?",
        "choices": [
            "A: Indefinitely valid tokens pose no risk if they are stored securely and the underlying data is encrypted.",
            "B: Tokens that never expire increase the risk of unauthorized access if they are intercepted or stolen, as they remain valid.",
            "C: Having tokens without expiration dates reduces the server load, as it does not have to frequently reauthenticate users.",
            "D: Users prefer the convenience of never having to re-enter credentials, outweighing any potential security concerns."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "token-lifetime"
    },
    {
        "id": "1be914ae-51aa-4a60-aef3-813ff2b9bd1a",
        "source": "attck",
        "question": "In a scenario where an organization's sensitive data is being exfiltrated, the security team discovers that whenever employees copy payment-related information, it gets replaced with an adversary's cryptocurrency wallet address. Which technique is most likely being used by the adversary in this case?",
        "choices": [
            "A: Clipboard Monitoring and Data Replacement",
            "B: Process Hollowing",
            "C: Keystroke Injection",
            "D: Clipboard Data Encryption"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Clipboard Data Manipulation"
    },
    {
        "id": "da234937-a67a-47d4-bf51-670371b56b88",
        "source": "cs161_textbook",
        "question": "In a system where a pRNG is used for cryptographic purposes, which of the following actions could potentially compromise the security of the generated pseudorandom numbers?",
        "choices": [
            "A: Reusing the same seed over multiple initializations without any additional entropy.",
            "B: Allowing the 'Generate(n)' function to add additional entropy during the generation of pseudorandom bits.",
            "C: Updating the pRNG's internal state with new entropy through the 'Reseed(entropy)' function.",
            "D: Generating multiple sequences of pseudorandom bits without changing the initial seed."
        ],
        "answer": "AD",
        "topics": [],
        "keyword": "pRNG security"
    },
    {
        "id": "00a7865f-3dc5-421d-933d-f5b2c66e372e",
        "source": "android_sec_doc",
        "question": "An Android application developer is implementing encryption and decryption functionality using RSA keys. They have already set up an RSA key pair for this purpose. Based on the application's requirements, which two of the following padding modes should the developer choose to correctly configure the RSA encryption/decryption keys?",
        "choices": [
            "A: PaddingMode::RSA_OAEP",
            "B: PaddingMode::RSA_PSS",
            "C: PaddingMode::RSA_PKCS1_1_5_ENCRYPT",
            "D: PaddingMode::PKCS7"
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "RSA Padding Modes"
    },
    {
        "id": "30b155d5-ebfa-439d-a965-20db77f60108",
        "source": "windows_security",
        "question": "In a Windows environment, enabling the audit policy for Sensitive Privilege Use has several security implications. Which of the following are correct regarding the benefits of enabling this policy? (Select two)",
        "choices": [
            "A: It generates audit events for every application installation, ensuring software deployment transparency.",
            "B: It helps in tracking the use of user rights assigned to sensitive privileges, contributing to insider threat detection.",
            "C: It provides encryption for sensitive data accessed during privileged operations, bolstering data confidentiality.",
            "D: It creates a log of events when sensitive privileges are utilized, aiding in forensic analysis after a security incident."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Audit Sensitive Privilege Use"
    },
    {
        "id": "1f62b210-dbf9-4ac2-b3c1-9190ea147e9a",
        "source": "cs161_textbook",
        "question": "In a TLS handshake, when a client and server aim to establish a secure communication channel, several steps are taken to ensure the confidentiality and integrity of the connection. What are the purposes of generating a Premaster Secret (PS) and exchanging MACs over all messages sent during the handshake?",
        "choices": [
            "A: The Premaster Secret ensures that both the client and server have a shared key that is not known to eavesdroppers, and MACs guarantee message integrity by verifying that handshake messages have not been tampered with.",
            "B: The Premaster Secret is used to verify the server's certificate, and MACs are exchanged to authenticate the client to the server.",
            "C: The Premaster Secret prevents replay attacks, and MACs are used to determine the encryption algorithm for the session.",
            "D: The Premaster Secret is a form of client authentication, and MACs ensure that the handshake messages are received in the correct order."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TLS"
    },
    {
        "id": "b446d01f-3df5-4625-b8ea-99d7ac7130b1",
        "source": "apple_platform_security",
        "question": "In the context of cybersecurity, what are the potential benefits and drawbacks of implementing multifactor authentication and express mode for accessing workplace amenities using employee badges in Apple Wallet?",
        "choices": [
            "A: Multifactor authentication increases security but may reduce convenience for employees, while express mode enhances convenience but could potentially decrease security.",
            "B: Express mode requires additional hardware to be installed at each access point, increasing costs, whereas multifactor authentication can be easily bypassed with social engineering attacks.",
            "C: Multifactor authentication can be inconvenient for guests in a hotel environment, and express mode may not provide sufficient security for high-risk areas like server rooms.",
            "D: Both multifactor authentication and express mode significantly increase the battery consumption on employee devices, leading to more frequent charging."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AccessControl"
    },
    {
        "id": "82912638-c863-436f-802e-744578d1c532",
        "source": "windows_security",
        "question": "A company is upgrading its authentication system for Windows devices and needs to choose a method that enhances security and user convenience. They are currently using virtual smart cards but have heard that there are more modern methods available. Which of the following options should the company consider implementing to align with current security recommendations?",
        "choices": [
            "A: Windows Hello for Business or FIDO2 security keys",
            "B: Retain the use of virtual smart cards for legacy support",
            "C: Biometric authentication with no secondary factor",
            "D: Password-only authentication upgraded with complexity requirements"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Two-factor authentication"
    },
    {
        "id": "9a4ccefd-5b0a-40f9-827b-fbfc4c802fcd",
        "source": "apple_platform_security",
        "question": "You are developing an iOS app that requires users to generate a new password. As part of the user experience, you want to ensure the generated passwords are both strong and compatible with the service's requirements. Which of the following practices should you implement?",
        "choices": [
            "A: Set UITextContentType.newPassword on the app's text field to trigger password generation when the heuristic fails.",
            "B: Provide custom password rules using UITextInputPasswordRules to guide the password generation process.",
            "C: Allow passwords to contain at least one special character like an asterisk (*) or exclamation mark (!) to ensure complexity.",
            "D: Implement a manual password creation interface to bypass the default 20-character password generation."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "password"
    },
    {
        "id": "e65e4176-b461-43d2-9002-620827d8a74e",
        "source": "apple_platform_security",
        "question": "A peripheral device attempts unauthorized memory access on a Mac computer. What is the expected behavior of the system in response to this action for a Mac with Apple silicon and an Intel-based Mac, respectively?",
        "choices": [
            "A: The system with Apple silicon triggers a kernel panic due to IOMMU detecting the unauthorized attempt.",
            "B: The Intel-based Mac system allows the DMA request after software initializes the IOMMUs.",
            "C: The Intel-based Mac system blocks the DMA request by default due to IOMMU's default-deny policy.",
            "D: The system with Apple silicon allows the peripheral to access memory exclusively mapped for its use."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "DMA Protections"
    },
    {
        "id": "89913009-4917-4f1a-88be-7769772e8a48",
        "source": "cs161_textbook",
        "question": "Imagine that you are developing a new web application that requires secure storage of user passwords. To mitigate the risk of password leaks, you decide to use cryptographic hash functions. Considering the threat of length extension attacks and the need for secure hashing, which cryptographic hash algorithm would you choose to implement, and why?",
        "choices": [
            "A: SHA-256, because it is a member of the SHA2 family and has a 256-bit output, which is considered secure.",
            "B: SHA-512, because it is a member of the SHA2 family with a 512-bit output, providing higher security.",
            "C: SHA3-256, because SHA3 includes additional internal state that is not reflected in the output, making it resistant to length extension attacks.",
            "D: MD5, because it was one of the earliest hash functions and is well-understood in terms of security."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "hash"
    },
    {
        "id": "3b1f25bd-25ef-49bf-9df5-28ab8315c94b",
        "source": "cs161_textbook",
        "question": "Alice is setting up an RSA signature scheme for her secure messaging application. She needs to generate keys, sign messages, and allow receivers to verify the signatures. Based on the RSA signature scheme outlined in the text, which of the following statements are true regarding the setup and functionality of Alice's RSA signature scheme?",
        "choices": [
            "A: Alice should select two 1024-bit primes p and q, where both are congruent to 2 modulo 3, to form the public key n = pq.",
            "B: To sign a message M, Alice will use the signing algorithm Sign_d(M) = H(M)^3 mod n.",
            "C: The verification algorithm will output 'true' if and only if H(M) equals S cubed modulo n, where S is the signature of message M.",
            "D: If the private key d is compromised, it becomes computationally feasible for an attacker to compute cube roots modulo n, thus breaking the security of the signature scheme."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "RSA"
    },
    {
        "id": "a4c6e381-9d21-4c8c-8fa6-8c5d09d0a845",
        "source": "mozilla_security",
        "question": "A developer is securing an HTML page that includes third-party JavaScript libraries. To ensure the integrity of the libraries and to maintain user privacy, the developer must set appropriate attributes for the script tags. Which of the following attribute usages is NOT recommended?",
        "choices": [
            "A: Using the 'integrity' attribute with the appropriate cryptographic hash of the file.",
            "B: Setting the 'crossorigin' attribute to 'anonymous' to make requests without cookies.",
            "C: Omitting the 'integrity' attribute when the library is hosted on a trusted CDN.",
            "D: Applying the 'crossorigin' attribute with the value 'use-credentials' to send user credentials with every request."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cross-Origin Resource Sharing (CORS)"
    },
    {
        "id": "393e4eb3-b6d6-406b-92ba-f11785412b58",
        "source": "cs161_textbook",
        "question": "As a security administrator, you are tasked with defining the security policy for your company's web server. Considering both security and functionality, which of the following statements are accurate regarding the choice of implementing a default-deny policy or a default-allow policy?",
        "choices": [
            "A: A default-allow policy may lead to security breaches if a service known to be vulnerable is accidentally not added to the deny list, potentially causing expensive security failures.",
            "B: A default-deny policy could result in loss of functionality or availability if a safe service is mistakenly omitted from the allow list, but is less likely to result in a security breach.",
            "C: A default-allow policy ensures that all services are inaccessible to external users unless they are explicitly listed in the allowed list, minimizing the chances of attacks.",
            "D: A default-deny policy might not detect security breaches quickly because it fails closed, and functional issues are less noticeable than open security gaps."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SecurityPolicy"
    },
    {
        "id": "2f85c70e-881f-449e-b122-d55b00f88527",
        "source": "owasp_wstg",
        "question": "Why is it important for web applications to find a balance between security and usability when determining the duration of session timeouts?",
        "choices": [
            "A: Shorter session timeouts can frustrate users due to frequent re-authentication, while longer timeouts may increase security risks.",
            "B: Longer session timeouts are preferred for public forums and home banking applications to enhance user convenience.",
            "C: Session timeouts are irrelevant as long as the user has not explicitly logged out of the application.",
            "D: Having a fixed session timeout for all applications regardless of their data sensitivity level simplifies the application design."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Session Management"
    },
    {
        "id": "300943f3-c4f2-4bec-aaae-7c0947c60aef",
        "source": "windows_security",
        "question": "In the context of Windows Hello for Business, why might an enterprise consider dual enrollment in situations where the Privileged Access Workstations feature cannot be used?",
        "choices": [
            "A: Because dual enrollment provides the same level of security as Privileged Access Workstations.",
            "B: Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device.",
            "C: Dual enrollment is preferred as it simplifies user access management by allowing a single sign-on for all administrative functions.",
            "D: To prevent the need for administrators to sign in and out, or use fast user switching when alternating between privileged and non-privileged workloads."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Privileged Access Workstations"
    },
    {
        "id": "c03adffe-3d27-4939-8a7e-b164c705f9ea",
        "source": "attck",
        "question": "A cybersecurity analyst is assessing a system that utilizes signature-based detection, anti-virus, and host intrusion prevention systems. Which adversarial technique could potentially bypass these defenses by altering the appearance of a malicious file without changing its functional properties?",
        "choices": [
            "A: Exploiting a zero-day vulnerability in the system's web server software.",
            "B: Using an XOR cipher to encode strings and payloads.",
            "C: Conducting a DDoS attack to overwhelm the system's resources.",
            "D: Implementing a sandbox environment to test system defenses."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability",
            "PenTest"
        ],
        "keyword": "Defense Evasion"
    },
    {
        "id": "d7285ef7-e2b1-4c68-a4be-c0acd529a095",
        "source": "cwe",
        "question": "Review the following code snippets that create a communication channel in a networked application. Which one does NOT employ a proper method to prevent the server from being tricked into sending traffic to an unintended destination?",
        "choices": [
            "A: The application uses a cryptographic nonce included in each UDP packet to verify that the response is sent to the correct source address.",
            "B: The server parses XML input and replaces all external entity references with safe placeholders before processing requests.",
            "C: The server validates the source IP address of incoming packets against a list of known trusted hosts before sending a response.",
            "D: The application sends a sticky broadcast intent that contains sensitive information intended for a specific receiver in the system."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecureCoding"
    },
    {
        "id": "703ef991-cfd8-4f14-83f7-8ca783b37302",
        "source": "owasp_wstg",
        "question": "A web application you are securing has a requirement to implement an account lockout mechanism to defend against brute force attacks. Considering the need for a balance between security and user convenience, which combination of factors should be implemented to provide a robust account lockout mechanism?",
        "choices": [
            "A: A lockout threshold of 3 unsuccessful attempts, followed by a mandatory 24-hour lockout period, and self-service unlock via security questions.",
            "B: A lockout threshold of 5 to 10 unsuccessful attempts, with accounts being unlocked manually by an administrator after user identification.",
            "C: Unlimited unsuccessful login attempts, but with a CAPTCHA after every attempt to mitigate brute force attacks.",
            "D: A lockout threshold of 1 unsuccessful attempt to maximize security, with a lockout duration of 5 minutes."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Account Lockout Mechanism"
    },
    {
        "id": "88616a82-7ba2-4c14-909a-0ed6aacfa83d",
        "source": "cs161_textbook",
        "question": "As the lead security architect in your organization, you are evaluating the implementation of a new firewall. Which of the following are advantages of deploying a firewall according to the security policies and needs of your organization?",
        "choices": [
            "A: Firewalls can significantly reduce the time required to propagate security policy changes across the organization.",
            "B: Since firewalls require individual configuration on each host, they offer fine-grained control over the security settings.",
            "C: Firewalls offer an easy deployment process that doesn't disrupt the operation of internal hosts.",
            "D: The deployment of firewalls obviates the need for any other form of security measures on internal machines."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "FirewallAdvantages"
    },
    {
        "id": "9f02a6d7-a1bf-4911-ae66-4bfed8cb8c99",
        "source": "owasp_wstg",
        "question": "A web application you are testing is built with GraphQL and reveals detailed error messages containing stack traces when unexpected data is sent. This could expose sensitive information about the application's configuration or data. What is the most effective strategy to prevent this security risk?",
        "choices": [
            "A: Enable verbose logging of all errors to monitor for potential attacks.",
            "B: Restrict access to the underlying API to authenticated users only.",
            "C: Send generic error messages that do not reveal details of the application.",
            "D: Increase the complexity of queries to make it harder for attackers to understand errors."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Error Handling"
    },
    {
        "id": "dd0b369a-47ae-4160-8234-e4c4da7edfbb",
        "source": "apple_platform_security",
        "question": "Consider a scenario where a company is designing a secure hardware platform inspired by Apple's approach to device security. They aim to incorporate various hardware features to enhance the security of their devices. From the following options, select the features that would both enhance security and are consistent with the principles applied in Apple's secure hardware design.",
        "choices": [
            "A: Adding a Boot ROM that serves as a hardware root of trust for secure boot processes.",
            "B: Implementing a CPU dedicated to system security features, including a Secure Enclave for biometric data processing and cryptographic operations.",
            "C: Designing a dedicated AES engine for performing inline encryption and decryption as files are written to or read from storage without exposing keying material.",
            "D: Incorporating a Page Protection Layer (PPL) that requires all platforms, including those not running macOS, to execute only signed and trusted code."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HardwareSecurity"
    },
    {
        "id": "1e9594f2-d16b-49c0-9da6-6ab04c81160f",
        "source": "apple_platform_security",
        "question": "In the context of macOS with Apple silicon, which of the following actions will directly result from the creation of a new Owner Identity Key (OIK) and subsequent LocalPolicy management?",
        "choices": [
            "A: The new OIK replaces any pre-existing OIK as part of the secure boot process initialization.",
            "B: A certification request for the public key corresponding to the OIK is sent to the Activation Lock server for validation.",
            "C: The User Identity Key (UIK) is initialized, and if the device can't get a UIK certified, it's unable to create a LocalPolicy.",
            "D: A new OIK creation will automatically enable System Integrity Protection (SIP) without requiring user authentication from recoveryOS."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "LocalPolicy"
    },
    {
        "id": "66246098-b5c8-4aff-9353-7834157006ef",
        "source": "apple_platform_security",
        "question": "An organization is evaluating the adoption of Apple devices for their secure operation. As a cybersecurity consultant, you are tasked with recommending security features that are inherently designed into Apple's platforms. Which of the following features should you highlight to demonstrate the multi-layered security approach of Apple devices?",
        "choices": [
            "A: Hardware-based device encryption that cannot be turned off accidentally",
            "B: Mandatory security training for all users before device activation",
            "C: User-configured security settings that require extensive IT department configuration",
            "D: Face ID and Touch ID that enhance user experience and security"
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Apple Security Features"
    },
    {
        "id": "1b56cd95-e2f7-40b9-b323-69aa26e91a60",
        "source": "cwe",
        "question": "Consider a scenario where a web application serves as a middleman between users and a third-party payment service. The application allows users to forward payment requests to the service without adequately ensuring that the user's identity is maintained throughout the transaction. What might be the consequence of this design flaw?",
        "choices": [
            "A: The payment service may process transactions as if they originated from the web application itself, potentially allowing unauthorized users to bypass access controls.",
            "B: The web application will become more efficient as it reduces the overhead of identity management in payment transactions.",
            "C: Users will be able to authenticate more easily since the web application automatically forwards the payment request without identity checks.",
            "D: The payment service will reject all transactions because the identity of the initiator is not preserved, leading to a denial of service."
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "ConfusedDeputy"
    },
    {
        "id": "a93c45b9-e1fe-46a0-84cd-04778c3b1856",
        "source": "cs161_textbook",
        "question": "Which of the following measures could prevent the stored XSS attack described, where an attacker is able to store malicious JavaScript on a web server that is then executed by a victim's browser?",
        "choices": [
            "A: Implementing server-side input validation to remove or encode HTML tags and JavaScript from user inputs before storing them.",
            "B: Restricting the length of the input that can be submitted in a Facebook post to prevent attackers from submitting scripts.",
            "C: Using HTTPS instead of HTTP to encrypt the data transmitted between the client and the server.",
            "D: Employing Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Stored XSS"
    },
    {
        "id": "65c26287-7bff-47b0-813a-ebc7cbe6af06",
        "source": "windows_security",
        "question": "During a security audit, a claim was made that a platform's firmware has improperly configured the TPM NV index. Which of the following would be a valid counterargument to show that the TPM NV index is set up correctly according to Windows security specifications?",
        "choices": [
            "A: The TPM NV index has a Handle of 0x01C101C1 and is designed to be accessible by the OS.",
            "B: The TPM NV index is configured with a policy that includes TPM2_PolicyAuthorize and TPM2_PolicyCommandCode without any logical operators.",
            "C: The platform firmware has set up a TPM NV index with attributes including TPMA_NV_POLICYWRITE and TPMA_NV_PLATFORMCREATE, among others, and a policy of TPM2_PolicyAuthorize OR TPM2_PolicyCommandCode.",
            "D: The TPM NV index uses a Handle of 0x01C101C0 but is only equipped with TPMA_NV_OWNERREAD attribute for exclusive read operations by the platform owner."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "TPM NV Index"
    },
    {
        "id": "4928ec1c-9388-4e48-8f53-808e55960136",
        "source": "android_sec_doc",
        "question": "You are tasked with ensuring the security of Android system images before deployment. Which of the following practices should you employ to manage the keys used for signing these images?",
        "choices": [
            "A: Sign the devices with a key that is publicly known to maintain transparency.",
            "B: Use hardware security modules (HSMs) to manage keys and provide limited, auditable access.",
            "C: Sign each system image with a unique one-time-use key to enhance security.",
            "D: Store the keys in a software repository with restricted access to developers only."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Hardware Security Module (HSM)"
    },
    {
        "id": "2df4501f-b222-4cee-95db-0abfa5fc6567",
        "source": "attck",
        "question": "A security analyst is investigating a potential breach in a company's network. The analyst discovers that multiple scheduled tasks were created to execute unknown scripts at system startup. Which of the following could be the reason an adversary would use this method?",
        "choices": [
            "A: To disrupt the system's time synchronization service.",
            "B: To establish persistence and potentially elevate privileges by executing malicious code with scheduled tasks.",
            "C: To encrypt the contents of the scheduled tasks for ransom.",
            "D: To create a backup of critical system files."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Scheduled Task/Job"
    },
    {
        "id": "45cab574-5360-4363-b934-d111ead278e3",
        "source": "android_sec_doc",
        "question": "Imagine you are designing an authentication system for an Android device that leverages a Trusted Execution Environment (TEE). You decide to implement a subsystem similar to Gatekeeper for device pattern/password authentication. Your design must include the following components: a service to handle platform-independent logic, a hardware abstraction layer interface, and a TEE-based implementation. Which of the following component sets correctly represents the necessary parts of the Gatekeeper-like subsystem, adhering to the roles and responsibilities specified in the architecture?",
        "choices": [
            "A: Authentication Service, Gatekeeper Hardware Abstractor (GHA), TEE Gatekeeper",
            "B: gatekeeperd, Gatekeeper Hardware Abstraction Layer (HAL), Gatekeeper (TEE)",
            "C: Authentication Daemon, Gatekeeper Hardware Integration Layer (GHIL), Secure Gatekeeper",
            "D: gatekeeperd, Gatekeeper Hardware Interface (GHI), Trusty Gatekeeper"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Trusted Execution Environment (TEE)"
    },
    {
        "id": "0352a144-7358-4191-9829-f41d78ed77ec",
        "source": "windows_security",
        "question": "After reviewing a security event log with ID 6144 on a Windows system, an administrator notes the GPO List contains an entry formatted as '8AB9311A-E5FB-4A5A-8FB7-027D1B877D6D DC Main Policy'. What can the administrator infer about the applied Group Policy Objects, and how can they verify the specific policy if further investigation is needed?",
        "choices": [
            "A: The GUID in the GPO List represents a Globally Unique Identifier that can be verified using the Get-GPO PowerShell cmdlet with the '-Name' parameter.",
            "B: The entry in the GPO List is a random string and does not relate to the actual policy applied, and thus no action is required.",
            "C: The administrator should trigger an alert as the GUID indicates an unauthorized modification to the DC Main Policy.",
            "D: The GUID in the GPO List must be cross-referenced with external security databases to verify the legitimacy of the applied policy."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "GUID"
    },
    {
        "id": "be3cea8e-9286-40ec-903e-48feafa540e7",
        "source": "cs161_textbook",
        "question": "Why is it not sufficient to rely solely on client-side JavaScript frameworks that automatically escape output to prevent stored XSS attacks like the one described involving malicious script storage on a web server?",
        "choices": [
            "A: Client-side frameworks cannot prevent malicious data that has already been stored on the server from being sent to the client's browser in the first place.",
            "B: All client-side JavaScript frameworks have known vulnerabilities that can be exploited by stored XSS attacks without exception.",
            "C: Client-side frameworks may increase page load times, which can be exploited by attackers to conduct XSS attacks.",
            "D: Server-side technologies are inherently more secure than client-side technologies and should be used exclusively."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Client-side Escaping"
    },
    {
        "id": "4f15ffdd-06c8-461b-b86e-03148d7a469d",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating a potential breach in an organization's cloud infrastructure. The analyst notices unusual patterns of access to various cloud services and suspects that an adversary may be attempting to enumerate these services. Which of the following actions would be LEAST effective in determining the extent of cloud service discovery by the adversary?",
        "choices": [
            "A: Reviewing logs for abnormal access patterns to services like AWS CloudTrail and Google Cloud Audit Logs.",
            "B: Monitoring the usage of Azure AD Graph API and Azure Resource Manager API for resource enumeration.",
            "C: Inspecting network traffic for signs of cloud service enumeration tools such as Stormspotter or Pacu.",
            "D: Increasing the frequency of vulnerability scans across the organization's on-premises network infrastructure."
        ],
        "answer": "D",
        "topics": [
            "PenTest"
        ],
        "keyword": "Cloud Service Enumeration"
    },
    {
        "id": "425f1a6d-b739-4553-b332-1dbe7d007d54",
        "source": "owasp_mastg",
        "question": "As an Android application developer, you are tasked with ensuring the security of your application's cryptographic features. Considering the evolution of Android Cryptographic APIs, which of the following actions should you take while targeting devices running different API levels?",
        "choices": [
            "A: For devices running Android 7.0 (API level 24) and above, ensure that you are using a patched security provider and avoid specifying a security provider unless required for the Android Keystore system.",
            "B: For devices running Android 8.1 (API level 27) and above, continue using the `IvParameterSpec.class` for GCM mode of operation due to its stable implementation over the years.",
            "C: For devices running Android 10 (API level 29), you can ignore network security changes as they do not significantly impact the cryptographic operations of the application.",
            "D: For devices running Android 9 (API level 28) and above, ignore warnings related to specifying a security provider using the `getInstance` method, as they are merely suggestions, not requirements."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Android Cryptographic APIs"
    },
    {
        "id": "32d310c1-925f-4a14-81d4-1187813f3e84",
        "source": "android_sec_doc",
        "question": "An Android device is experiencing a boot verification error due to a mismatch between the calculated hash and the expected hash on the boot partition. What is the most likely immediate consequence for the device according to the standard Android boot verification process?",
        "choices": [
            "A: The device enters a limited functionality mode allowing emergency calls only until the issue is resolved.",
            "B: The device cannot boot, and the user is required to perform recovery steps to restore device functionality.",
            "C: The device automatically corrects the hash mismatch by downloading the correct hash from a secure server.",
            "D: The device boots in a special maintenance mode that allows the user to bypass the error and access the device."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Boot Verification Error"
    },
    {
        "id": "47d37e9e-ef27-43b5-8433-f809d82b8028",
        "source": "owasp_wstg",
        "question": "A web application developer is implementing a secure session termination strategy. Which of the following components should be included to ensure a secure session termination? (Select two)",
        "choices": [
            "A: Providing a user interface control that allows users to manually log out.",
            "B: Maintaining server-side session state active after client-side session token has been invalidated.",
            "C: Automatically terminating the session server-side after a predefined period of user inactivity.",
            "D: Relying solely on session cookies to identify logged-on users without server-side session tracking."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Session Termination"
    },
    {
        "id": "22c185b0-6c0b-4fdc-aef8-b481eec19577",
        "source": "cwe",
        "question": "An engineer is tasked with designing a new web application that will handle sensitive user information. The application will communicate with remote servers across the internet. To comply with the best security practices for the transmission of this sensitive data, which of the following actions should the engineer take?",
        "choices": [
            "A: Encrypt data using reliable cryptographic protocols before transmission.",
            "B: Limit the use of SSL to the initial login page for performance optimization.",
            "C: Use custom, company-specific encryption algorithms to ensure unique security measures.",
            "D: Configure servers to reject all unencrypted communication channels."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Cleartext"
    },
    {
        "id": "d2c78265-42c8-4b5d-b615-33e8c899b6f3",
        "source": "attck",
        "question": "An organization is working to improve its web application security. As part of this initiative, they want to mitigate the risk of adversaries stealing web session cookies to gain unauthorized access. Which of the following measures could effectively decrease the risk of session cookie theft?",
        "choices": [
            "A: Implementing a physical second factor authentication that relies on the target login domain for protocol negotiation.",
            "B: Regularly updating user passwords to ensure they are complex and unique.",
            "C: Allowing users to stay logged in indefinitely to avoid frequent re-authentication and potential cookie theft during login.",
            "D: Disabling cookies entirely on the organization's web applications to prevent any possibility of theft."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Session Cookie"
    },
    {
        "id": "a7a8cb93-0a85-4748-a7ba-f32ca1d93c01",
        "source": "attck",
        "question": "As a security analyst reviewing Windows event logs, you come across several Event IDs that may be indicative of adversarial activity. Which of the following Event IDs would you consider least likely to be associated with an adversary's attempt to remove access to user accounts?",
        "choices": [
            "A: Event ID 4723 - An attempt was made to change an account's password.",
            "B: Event ID 4725 - A user account was disabled.",
            "C: Event ID 4726 - A user account was deleted.",
            "D: Event ID 4672 - Special privileges assigned to new logon."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "Vulnerability",
            "PenTest"
        ],
        "keyword": "Windows Event Log"
    },
    {
        "id": "2dd7c99c-9be2-47af-9c58-24f7f1f4d611",
        "source": "cs161_textbook",
        "question": "An organization is using an Ethernet LAN with a common network hub. As a security analyst, you are assessing the risks associated with this setup. Which of the following statements are accurate regarding the security implications of this configuration?",
        "choices": [
            "A: An adversary can easily capture all network traffic due to the broadcast nature of the hub.",
            "B: An adversary must compromise the network hub first to sniff packets.",
            "C: Devices on the network can avoid eavesdropping by refusing packets not addressed to them.",
            "D: An adversary can introduce traffic with a spoofed MAC address to masquerade as any machine on the network."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Ethernet"
    },
    {
        "id": "a6cb40b7-765b-4aab-999a-a615a8ed3843",
        "source": "cwe",
        "question": "A developer wrote a function to execute a file listing within a specified directory received from user input. The developer aims to prevent command injection vulnerabilities. Which of the following implementations of input validation would be the best practice to mitigate this risk?",
        "choices": [
            "A: Reject any input containing non-alphanumeric characters, including special symbols such as ';' or '/'.",
            "B: Perform strict input validation by only allowing characters that are strictly required for the operation, such as alphanumeric and underscore.",
            "C: Use a denylist approach and only filter out known dangerous characters like ';', '&', and '|'.",
            "D: Prepend a '--' to the list of arguments to ensure that any input starting with '-' is treated as a filename and not as an option."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Injection"
    },
    {
        "id": "32275276-6308-4d4a-8d07-40a4fc746c1f",
        "source": "owasp_mastg",
        "question": "In the development of an Android mobile application, you are evaluating the use of cryptographic APIs for securing sensitive data. What is a critical factor to consider when implementing cryptographic operations to ensure data security?",
        "choices": [
            "A: Cryptographic operations should be performed on the client-side to reduce server load and improve performance.",
            "B: Cryptographic operations must be offloaded to third-party libraries without reviewing their source code or security posture.",
            "C: Cryptographic primitives from reputable and up-to-date libraries should be used instead of creating custom encryption methods.",
            "D: Using deprecated cryptographic APIs as they are well-understood and have extensive historical usage data."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Cryptographic Primitives"
    },
    {
        "id": "eaac27a8-91a6-4769-af04-1e2bfa899a03",
        "source": "windows_security",
        "question": "In Windows security policy, why is it recommended to rename the administrator account, and what should be considered when applying this change?",
        "choices": [
            "A: Renaming the administrator account can help prevent unauthorized access by making it more difficult for attackers to guess the account name.",
            "B: Renaming the administrator account is advised to comply with international security standards that mandate unique identifiers for each user account.",
            "C: The administrator account should be renamed to avoid account lockout policies that may disrupt system operations.",
            "D: Renaming the administrator account is a mandatory requirement during Windows setup to ensure that each installation has a distinct administrator username."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Policy"
    },
    {
        "id": "49f60ea3-a121-4fc3-b0cc-34e04363dbc0",
        "source": "cwe",
        "question": "An online banking application includes functionality that allows users to customize certain elements of the interface, including the color scheme and font. The application then stores these preferences in HTTP headers for subsequent requests. Which of the following outcomes might occur if the application fails to properly neutralize user input before including it in these headers?",
        "choices": [
            "A: The application may suffer from decreased performance due to excessive storage of user preferences.",
            "B: Users could potentially inject malicious scripts that execute in other users' browsers when viewing their customized interface.",
            "C: The application may inadvertently reveal sensitive information about user preferences to third parties.",
            "D: Users may be unable to save their preferences if the storage limit of HTTP headers is exceeded."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ScriptInjectionRisk"
    },
    {
        "id": "f5b9f896-8442-4c98-8065-1f4954094939",
        "source": "apple_platform_security",
        "question": "Evaluate the effectiveness of the following macOS security features in mitigating potential threats:",
        "choices": [
            "A: Kernel extensions running in user space as opposed to kernel space to limit privileges.",
            "B: Sandboxing Option ROMs and restricting their capabilities to reduce the attack surface.",
            "C: Executing all UEFI firmware, including OROMs, at maximum CPU privilege level for compatibility.",
            "D: Requiring user consent for loading new kernel extensions installed after macOS 10.12."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "mitigation"
    },
    {
        "id": "801810d9-6c58-4146-9714-9cf8e6b62394",
        "source": "owasp_mastg",
        "question": "In a discussion about Android security testing, a colleague argues that using emulators is always preferable due to the convenience of snapshots and the ability to simulate various hardware configurations. How would you counter this argument?",
        "choices": [
            "A: Emulators cannot be rooted, making them less suitable for testing applications that require root access.",
            "B: Malware samples on emulators cannot be cleared by flashing a clean firmware, posing a persistent security risk.",
            "C: Emulators can offer convenience, but they are typically slow and may not represent realistic user environments, including root detection.",
            "D: Physical devices do not support API level changes, making them inflexible and unsuitable for comprehensive testing."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Android Emulator Limitations"
    },
    {
        "id": "05a61adf-de55-4abb-a96b-10c81b8f77b0",
        "source": "cs161_textbook",
        "question": "You receive a report from a user that their computer has become infected with malware. The user recalls running a recently downloaded application, after which they noticed unauthorized activities on their system. Based on this information, what type of malware has likely infected the user's system, and what action facilitated its spread?",
        "choices": [
            "A: A worm, because it infected the computer when the user ran a piece of stored code on their machine.",
            "B: A virus, because the user's action of running the application facilitated the spread of the malware.",
            "C: A worm, because the malware infected the computer without requiring any user action.",
            "D: A virus, because it altered already-running code on the user's computer."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Virus"
    },
    {
        "id": "fe2514cc-b0e1-4465-8759-b1ee0a7d354f",
        "source": "cwe",
        "question": "An application security architect is designing a new authentication system. Which of the following strategies should the architect consider implementing to enhance the security of the password system?",
        "choices": [
            "A: Store passwords in plain text to streamline the login process and reduce computational overhead.",
            "B: Implement a zero-knowledge password proof protocol to avoid password exposure during authentication.",
            "C: Enforce password strength by requiring passwords to be at least 10 characters long, without consideration for character diversity.",
            "D: Inform users about the importance of password security and the mechanisms in place to protect their credentials."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "ca65d3f2-0aa9-45d7-83fc-851e6b4632c8",
        "source": "cs161_textbook",
        "question": "You are configuring a local wired network and need to ensure that communication between devices is secure. One of the protocols you are considering is ARP. Which of the following statements accurately reflect ARP's characteristics and the security measures you could apply? (Select two)",
        "choices": [
            "A: ARP is used to resolve domain names to IP addresses and is most secure when combined with HTTPS.",
            "B: ARP operates at the Link Layer of the OSI model and can be protected against spoofing with the use of switches.",
            "C: A known vulnerability of ARP is that on-path attackers can intercept requests and provide spoofed replies; a defense against this is implementing arpwatch.",
            "D: ARP can be secured using encryption methods such as TLS to prevent man-in-the-middle attacks."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ARP"
    },
    {
        "id": "92cb9a09-366a-446a-acf8-4141393fd93d",
        "source": "cwe",
        "question": "A developer is attempting to execute a program from within a C++ application. Which of the following code snippets correctly mitigates the risk of executing an unintended program due to an unquoted search path vulnerability?",
        "choices": [
            "A: UINT errCode = WinExec(\"\\\"C:\\Program Files\\Foo\\Bar\\\"\", SW_SHOW);",
            "B: UINT errCode = WinExec(\"C:\\Program Files\\Foo\\Bar\", SW_SHOW);",
            "C: UINT errCode = WinExec(Concatenate(\"C:\\\", \"Program Files\\\", \"Foo\\\", \"Bar\"), SW_SHOW);",
            "D: UINT errCode = WinExec(\"C:\\\\Program Files\\\\Foo\\\\Bar.exe\", SW_SHOW);"
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "UnquotedSearchPath"
    },
    {
        "id": "b047f025-46db-4ea2-adb5-f40cbd3024de",
        "source": "attck",
        "question": "An organization's security team has been tasked with enhancing detection mechanisms to identify potential abuse of server application extensibility features by adversaries. Which data source should the security team focus on to detect suspicious installation of application software components?",
        "choices": [
            "A: Analyze the consistency of email communication patterns over the SMTP protocol.",
            "B: Monitor application logs for abnormal behavior indicating suspicious software component installation.",
            "C: Review firewall rules to ensure proper network perimeter defenses are in place.",
            "D: Examine user behavior analytics to detect potential insider threats."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Application Log Monitoring"
    },
    {
        "id": "8808e231-01c7-4088-aa52-d32492713b50",
        "source": "attck",
        "question": "An adversary group is planning to target a multinational corporation and is in the reconnaissance phase of their operation. They are considering various methods of gathering information about their target. Which of the following approaches aligns with the tactics and techniques observed in real-world scenarios, as per a structured knowledge base of adversary behavior?",
        "choices": [
            "A: Searching business databases and purchasing technical data from threat intel vendors.",
            "B: Infiltrating the corporation's physical premises to extract confidential documents.",
            "C: Deploying malware on public forums to solicit information from company employees.",
            "D: Conducting social engineering calls to the corporation's legal team to acquire trade secrets."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Reconnaissance"
    },
    {
        "id": "ae5f741c-e874-4d00-a49b-78379a7d0284",
        "source": "android_sec_doc",
        "question": "In what scenario would the `init` process of an Android system load a precompiled SELinux policy instead of compiling the policy files at runtime?",
        "choices": [
            "A: When the hashes of `/system/etc/selinux/plat_sepolicy_and_mapping.sha256` and `/{partition}/etc/selinux/precompiled_sepolicy.plat_sepolicy_and_mapping.sha256` are different, to ensure the latest policy updates are applied.",
            "B: If `/system_ext/etc/selinux/system_ext_sepolicy_and_mapping.sha256` does not exist, as this indicates that the system_ext partition has no policy changes.",
            "C: When the hashes of policy files on the `system`, `system_ext`, `product`, and the precompiled partition (`vendor` or `odm`) are identical, indicating no policy changes.",
            "D: If `/product/etc/selinux/product_sepolicy_and_mapping.sha256` exists and is different from the precompiled version, which triggers a check for potential policy updates."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Precompiled SELinux policy"
    },
    {
        "id": "e990d030-7a80-4c69-ac82-c0bc7226f9c3",
        "source": "owasp_wstg",
        "question": "In an application security audit, you discover that an application's Multi-Factor Authentication (MFA) mechanism can be bypassed by submitting a series of automated requests that sequentially test different passcodes. Which of the following vulnerabilities is most likely present in the MFA implementation?",
        "choices": [
            "A: The MFA mechanism lacks a lockout mechanism to prevent brute-force attacks.",
            "B: The MFA mechanism sends passcodes via email, which is considered insecure.",
            "C: The MFA uses an outdated encryption algorithm for passcode generation.",
            "D: The MFA requires three factors, making it more secure and therefore not vulnerable to automated requests."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Brute-force attacks"
    },
    {
        "id": "8b37dc0b-82ae-44cb-8955-2d02b8332c96",
        "source": "attck",
        "question": "A cybersecurity analyst is designing a secure boot process for a company's computing infrastructure to prevent persistent threats at the firmware level. Which combination of techniques and mitigations should the analyst implement to enhance the security of the Pre-OS Boot phase?",
        "choices": [
            "A: Enable a trusted boot process using TPM technology and frequently monitoring for firmware modifications.",
            "B: Disable all boot drivers to prevent adversaries from overwriting boot-related data.",
            "C: Limit the boot process to load only the operating system, bypassing all pre-OS mechanisms.",
            "D: Rely solely on host-based anti-virus defenses to detect and mitigate Pre-OS Boot threats."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Pre-OS Boot"
    },
    {
        "id": "ea06a7ac-06e2-425d-b1b0-9be0a1b0f30a",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, why would it not be advisable for a developer to rely on device-specific security features, like fingerprint authentication, as the sole method of protecting sensitive data at rest?",
        "choices": [
            "A: Device-specific features can be bypassed or spoofed by attackers, compromising the data's security.",
            "B: Fingerprint authentication provides a higher level of security than any other form of encryption.",
            "C: Device-specific security features like fingerprint authentication are universally compatible with all mobile devices.",
            "D: Relying on a single method of security does not adequately address the principle of defense in depth."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Defense in Depth"
    },
    {
        "id": "7f62d9d0-e532-4583-924d-b891555f8348",
        "source": "attck",
        "question": "In an incident response scenario, the responding team identifies a piece of malware designed to avoid detection by selectively scraping memory only from processes that are not related to security solutions. Which malware characteristic aligns with this behavior?",
        "choices": [
            "A: A malware that encrypts user files and demands a ransom.",
            "B: A malware that leverages spam emails as its primary propagation method.",
            "C: A malware that enumerates and excludes selected processes to speed execution of memory scraping.",
            "D: A malware that focuses on denial-of-service attacks against networked devices."
        ],
        "answer": "C",
        "topics": [
            "Vulnerability",
            "PenTest"
        ],
        "keyword": "Memory Scraping"
    },
    {
        "id": "540b7f93-1eed-40de-b086-0765a8a805d2",
        "source": "windows_security",
        "question": "In a security audit of a Windows 11 environment, you discover that the organization has employed several measures to protect against cyber threats. However, you notice two areas that could potentially weaken the system's security posture. Which of the following practices should be re-evaluated to prevent potential vulnerabilities? (Select two.)",
        "choices": [
            "A: The use of Windows Firewall to monitor incoming and outgoing network traffic",
            "B: The absence of Attack Surface Reduction Rules to minimize the system's exposure to threats",
            "C: Application of Virtualization-Based Protection of Code Integrity to prevent untrusted code execution",
            "D: Lack of Microsoft Defender SmartScreen to block malicious websites and downloads"
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Attack Surface Reduction Rules"
    },
    {
        "id": "4314579b-6757-4c8a-a194-49db3cef26e6",
        "source": "cs161_textbook",
        "question": "Consider a modified WPA2-PSK handshake process where the following changes are proposed for a new wireless network security protocol:\n\n1. The ANonce and SNonce values are exchanged but are not used in the derivation of the PTK.\n2. The GTK is no longer encrypted before being sent to the client.\n3. The MICs are replaced with simple checksums for faster processing.\n\nEvaluate the potential implications of these changes. Select all that apply.",
        "choices": [
            "A: The unique encryption key for each client would not be ensured, making the network more vulnerable to eavesdropping.",
            "B: Encryption of the GTK is unnecessary as it is the same for all clients, thus not encrypting it does not introduce additional risk.",
            "C: Replacing MICs with checksums compromises the integrity check of the nonces, potentially allowing for tampering and replay attacks.",
            "D: The omission of nonces in the derivation of the PTK could lead to predictable keys, increasing susceptibility to certain attacks."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "WPA2-PSK"
    },
    {
        "id": "9db3d589-5b01-4673-b335-8462b2f20dfa",
        "source": "cwe",
        "question": "In the design review of a new web application, you are tasked with evaluating statements about the use of reverse DNS resolution for authentication purposes. Which of the following statement(s) correctly reflect the security risks associated with reverse DNS resolution for determining trusted hosts?",
        "choices": [
            "A: Reverse DNS resolution is an effective standalone security measure for authenticating hosts because DNS records are well-protected against tampering.",
            "B: The possibility of DNS cache poisoning undermines the reliability of reverse DNS resolution as a security measure, leading to potential bypass of authentication.",
            "C: Reverse DNS resolution should be used in conjunction with other authentication methods, such as IP address verification, to enhance security.",
            "D: Security decisions should not be based on the outcome of reverse DNS resolution alone due to the potential for attackers to control or spoof DNS records."
        ],
        "answer": "BD",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Authentication_Risks"
    },
    {
        "id": "b5520015-9812-4a56-b113-d7d45f8c708b",
        "source": "attck",
        "question": "An adversary is in the reconnaissance phase of a targeted cyber attack against a corporate network. They are considering using active scanning techniques to gather information. Which of the following actions would likely be part of their active scanning efforts to successfully prepare for subsequent phases of the attack?",
        "choices": [
            "A: Scanning the IP blocks allocated to the corporate network to map out live hosts and open ports.",
            "B: Passively monitoring network traffic to identify patterns without sending any packets to the target network.",
            "C: Performing a dictionary attack against user accounts to attempt to gain unauthorized access.",
            "D: Executing a vulnerability scan to identify outdated software and misconfigurations that can be exploited."
        ],
        "answer": "AD",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Active Scanning"
    },
    {
        "id": "4afa9eff-3b8c-4cb0-a1a7-60dc215b0b7b",
        "source": "apple_platform_security",
        "question": "In the context of password security, iOS, iPadOS, and macOS systems flag certain passwords for user attention. What are the reasons for marking passwords as weak, reused, or leaked?",
        "choices": [
            "A: Passwords are marked reused if they are used across different domains with the same username.",
            "B: Passwords are marked weak if they contain patterns that can be easily guessed by attackers.",
            "C: Passwords are marked leaked if they have been found in a data leak, according to the Password Monitoring feature.",
            "D: Passwords are marked weak if they are longer than 16 characters to encourage users to create shorter, more manageable passwords."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Password Flags"
    },
    {
        "id": "a7def17b-3864-4a6f-b341-44289f82ee31",
        "source": "attck",
        "question": "As a security analyst, you are reviewing logs to detect potential adversarial System Service Discovery attempts within your network. Which of the following would be the least effective method of detection and why?",
        "choices": [
            "A: Monitoring for the execution of `sc query` and `net start` commands.",
            "B: Looking for the invocation of Windows Management Instrumentation and PowerShell scripts.",
            "C: Observing for unusual spikes in outbound network traffic to unknown external IP addresses.",
            "D: Analyzing API calls such as `EnumServicesStatusExA` and `QueryServiceStatusEx`."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Detection"
    },
    {
        "id": "c8aa36df-a37c-4276-bf19-16be5fced19a",
        "source": "android_sec_doc",
        "question": "In an Android Keymaster module, a developer is attempting to export a public key using the `exportKey` method. The key was generated without providing any `Tag::APPLICATION_ID`. What will be the result of this export attempt?",
        "choices": [
            "A: The method will export the key successfully as `Tag::APPLICATION_ID` is not required for exporting keys.",
            "B: The method will return ErrorCode::OK because the absence of `Tag::APPLICATION_ID` does not affect key export.",
            "C: The method will return ErrorCode::INVALID_KEY_BLOB because `Tag::APPLICATION_ID` was not provided during key generation.",
            "D: The method will return ErrorCode::KEYMASTER_NOT_CONFIGURED since `Tag::APPLICATION_ID` is a mandatory field for key export."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Keymaster exportKey"
    },
    {
        "id": "d56d9e8f-e8ea-49a5-a114-1552d731a149",
        "source": "cwe",
        "question": "In an effort to improve software security, a company is auditing their application to find design flaws that could contribute to vulnerabilities. They have identified a vulnerability related to the improper isolation of system-dependent functions. Which of the following approaches, if found during the audit, would NOT be a proper fix for the identified vulnerability?",
        "choices": [
            "A: Refactoring the code to define clear interfaces for system-dependent functionalities, separating them from the core logic of the application.",
            "B: Merging various system-dependent functionalities into a common utility class that is used throughout the application.",
            "C: Implementing a plugin architecture to allow system-dependent functionalities to be loaded and updated independently of the application core.",
            "D: Designing an abstraction layer that mediates between system-dependent functionalities and the application core, ensuring loose coupling."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ImproperIsolation"
    },
    {
        "id": "7daec725-2522-44c8-8ce7-37942b725dc1",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating a breach and discovers that a persistent threat actor has gained unauthorized access to a corporate network. The analyst finds evidence that event-triggered execution mechanisms were used to maintain access and potentially escalate privileges. Which of the following could the adversary have used to establish persistence? (Select TWO.)",
        "choices": [
            "A: Changed default applications to open media files with a malicious executable.",
            "B: Altered network configurations to reroute traffic through a threat actor-controlled gateway.",
            "C: Created a malicious Windows Management Instrumentation (WMI) event subscription.",
            "D: Implemented a new group policy to enforce stronger password requirements."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Event Triggered Execution"
    },
    {
        "id": "559b103c-7490-40d1-842c-8d91b5e3128c",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security testing, when using an Android emulator environment to simulate different device sensors and states, which of the following tools could be utilized to facilitate this testing process?",
        "choices": [
            "A: Magisk, a systemless rooting tool that allows hiding modifications from root-sensitive applications.",
            "B: MobSF, a framework that supports security analysis of mobile applications within an emulator.",
            "C: Nathan, a virtual mobile environment that has not been updated since 2016 but can be used for testing.",
            "D: Xposed Framework, a module that enables modifications on a system-wide level for customizing the OS."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Android Emulator"
    },
    {
        "id": "996af594-d37d-4cc3-b812-33087a007a10",
        "source": "windows_security",
        "question": "A Windows security event log entry is generated after an administrator modifies the Kerberos policy settings. Which details are most likely to be included in this log entry?",
        "choices": [
            "A: The specific settings that were changed, along with the old and new values.",
            "B: The usernames and passwords of all accounts that have used Kerberos authentication in the past 24 hours.",
            "C: Real-time performance metrics of the Kerberos Distribution Center (KDC) since the policy change.",
            "D: A list of all external systems that have interacted with the Kerberos service, including timestamps."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security Event Log"
    },
    {
        "id": "22b29a24-e05d-4e9a-ba76-ddeb6b2bccce",
        "source": "cs161_textbook",
        "question": "In a cryptographic system, security is paramount. An encryption method is considered insecure if an adversary can easily recover the original message without knowledge of the secret key. Given this premise, which of the following reasons justify the insecurity of the Caesar cipher?",
        "choices": [
            "A: The Caesar cipher relies on a short fixed key space that can be exhaustively searched.",
            "B: The Caesar cipher's algorithm for encryption and decryption is not publicly known, leading to obscurity but not security.",
            "C: The Caesar cipher uses quantum-resistant algorithms that are not yet proven to be secure against classical computers.",
            "D: The Caesar cipher maintains secure communication, as long as the shift value remains undiscovered by an unauthorized party."
        ],
        "answer": "A",
        "topics": [],
        "keyword": "Cryptography"
    },
    {
        "id": "00005b73-e086-4049-b91e-eb577924c6b1",
        "source": "apple_platform_security",
        "question": "An IT security professional is explaining the security features of recoveryOS and the software update process on Intel-based Mac computers. Which of the following statements accurately reflect the security measures or procedures implemented by Apple for these systems?",
        "choices": [
            "A: The Unified Extensible Firmware Interface (UEFI) firmware checks the signature of the BaseSystem.chunklist file and then validates each hash from the BaseSystem.dmg to prevent unauthorized booting from recoveryOS.",
            "B: During the software update process, the user's data volume is always mounted to ensure data integrity while preventing unauthorized access.",
            "C: The software update process uses a hardware-based root of trust to install only Apple-signed code and prevent downgrade attacks by not signing older operating system versions.",
            "D: For the software update personalisation, the nonce is used to ensure that the server's response can be reused for system software tampering or alteration."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "recoveryOS_security"
    },
    {
        "id": "31bc3069-da97-456d-96b9-272b7514c526",
        "source": "mozilla_security",
        "question": "A developer is considering using a CDN to serve static assets for a web application. What is a valid reason for ensuring that the CDN supports Cross-Origin Resource Sharing (CORS), and what is a common misconception about CORS in this context?",
        "choices": [
            "A: CORS support is necessary to allow the browser to execute scripts from the CDN, while a misconception is that CORS also encrypts the data in transit.",
            "B: CORS support is needed to validate the MIME type of the assets, and a misconception is that it prevents the CDN from caching content.",
            "C: Ensuring CORS support allows for the proper handling of fonts and other resources that might be subject to the Same-Origin Policy, while a misconception is that CORS provides integrity checks for the assets.",
            "D: CORS support is needed to compress assets served from the CDN, and a misconception is that it can prevent DDoS attacks on the application."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cross-Origin Resource Sharing (CORS)"
    },
    {
        "id": "c488d8e8-2505-43fe-90ee-e4a22611c153",
        "source": "attck",
        "question": "A penetration tester is simulating an advanced persistent threat (APT) to assess a client's network resilience. The tester has gained initial access to a host within the network. Which of the following types of information would the tester likely prioritize to collect from the compromised host to mimic typical APT behavior?",
        "choices": [
            "A: List of installed games and multimedia software.",
            "B: System configuration information, including OS version and computer name.",
            "C: Preferred language settings for installed productivity software.",
            "D: Hostname and disk space information."
        ],
        "answer": "BD",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "APT simulation"
    },
    {
        "id": "9272ea58-95a8-4530-84e9-b1e7751cbfb7",
        "source": "attck",
        "question": "In a network breach scenario, a security analyst observes that the malware present on the system has downloaded additional payloads. Which of the following actions would NOT align with the observed behavior of known malware families?",
        "choices": [
            "A: The malware used an embedded downloader to retrieve a payload from a hardcoded C2 server.",
            "B: The malware executed a script that used the 'certutil' tool to decode and execute a binary payload.",
            "C: The malware connected directly to a remote database to retrieve and execute a file placed on disk.",
            "D: The malware leveraged the system's software update mechanism to replace legitimate binaries with malicious ones."
        ],
        "answer": "D",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "malware payload execution"
    },
    {
        "id": "710ab3e2-be2e-49c0-b367-7af93d3f1089",
        "source": "cs161_textbook",
        "question": "A company has developed a software application without integrating security from the start. As a result, the company is facing difficulties in implementing security measures post-development. What are the likely challenges the company is encountering?",
        "choices": [
            "A: Inability to apply separation of privilege due to the rigid architecture.",
            "B: Increased ease of applying complete mediation due to established user roles.",
            "C: Struggling with backwards compatibility while introducing new security measures.",
            "D: Enhanced ability to decompose the system for better defense in depth."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "RetrofitSecurity"
    },
    {
        "id": "3437a585-16fb-428f-8cff-40f2973f8c7d",
        "source": "cs161_textbook",
        "question": "In a system that employs XOR-based symmetric-key encryption, a developer has written the following code snippet to manipulate a bit sequence (represented as 'y'). Identify which operation will not result in the expected outcome based on the properties of XOR.",
        "choices": [
            "A: y = y ^ 0; // Expectation: y remains unchanged.",
            "B: y = y ^ y; // Expectation: y becomes all 0s.",
            "C: y = y ^ 1; // Expectation: All bits of y are flipped.",
            "D: y = (y ^ 1) ^ 1; // Expectation: y becomes all 1s."
        ],
        "answer": "D",
        "topics": [],
        "keyword": "XOR_Code"
    },
    {
        "id": "11a742b8-4af8-4556-9b50-f233fdc1c606",
        "source": "apple_platform_security",
        "question": "An adversary is attempting to compromise the security of an Apple device. They are considering various attack vectors based on the understanding of certain security mechanisms described in the text. Which of the following statements represent incorrect assumptions or misunderstandings about the security features?",
        "choices": [
            "A: Mounting a sophisticated physical attack on the processor's silicon could potentially reveal the unique ID (UID) used in cryptographic operations.",
            "B: The tangling process, using the device's UID, allows for brute-force attacks to be performed in parallel on multiple devices.",
            "C: Address Space Layout Randomisation (ASLR) makes exploitation more challenging by ensuring memory addresses are unpredictable.",
            "D: AES-XTS is a mode of AES used for encrypting communication channels rather than storage media."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SecurityMechanisms"
    },
    {
        "id": "46f0684a-e1df-49e4-95c4-88e0eafd3305",
        "source": "d3fend",
        "question": "An organization's endpoint security solution has flagged a malicious artifact on a workstation. To mitigate the risk of further infection, which technique should the incident response team apply to remove this artifact from the system?",
        "choices": [
            "A: Credential Eviction",
            "B: File Removal",
            "C: Process Suspension",
            "D: Account Locking"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "File Removal"
    },
    {
        "id": "25dd51ea-7878-46e7-bf1f-bc65e7ed3d24",
        "source": "attck",
        "question": "A network engineer suspects that the operating system image on certain embedded network devices has been compromised. To confirm this suspicion, which of the following detection methods should be employed? (Select TWO)",
        "choices": [
            "A: Check the device's operating system version against the expected version and verify the integrity of the image file via checksum comparison.",
            "B: Increase the frequency of device reboots to reset any potential in-memory modifications by adversaries.",
            "C: Monitor the network traffic for unusual patterns that could indicate a compromised operating system.",
            "D: Contact the vendor for advanced debugging support to validate the integrity of the operating system running in memory."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "checksum comparison"
    },
    {
        "id": "566f478a-4f0b-4277-b757-db950dfca468",
        "source": "owasp_wstg",
        "question": "An organization is revamping its account recovery process and wants to implement security questions that are robust against common attack vectors. Which of the following examples represents the most secure approach to designing a security question for account recovery?",
        "choices": [
            "A: Using easily guessable questions like 'What is your favorite color?'",
            "B: Allowing users to create their own questions, such as 'What is 2+2?'",
            "C: Using questions with answers that are brute-force resistant and not publicly discoverable",
            "D: Using questions where answers are likely to be known by acquaintances, like 'What is your mother's maiden name?'"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Account Recovery Security"
    },
    {
        "id": "765e4132-e4e9-4be9-810e-7a7fbb120c20",
        "source": "cs161_textbook",
        "question": "Analyze the following function from a web application's backend written in C:\n\n    void handle_client_request() {\n        int request_size;\n        char request_buffer[256];\n\n        request_size = get_request_size();\n        if (request_size < 0 || request_size > 256) {\n            deny_request(\"Invalid request size\");\n            return;\n        }\n        memcpy(request_buffer, get_request_data(), request_size);\n    }\n\nWhich potential vulnerability does this code contain?",
        "choices": [
            "A: The code properly checks for a negative request size, preventing any possibility of integer conversion vulnerabilities.",
            "B: Using memcpy with request_size as the third argument is unsafe if request_size is negative, as it will be cast to an unsigned value, potentially causing a buffer overflow.",
            "C: The size check ensures that request_size is not larger than the buffer, which prevents any kind of buffer overflow vulnerability.",
            "D: The function get_request_data() is potentially unsafe as it does not perform any size checks on the data it retrieves."
        ],
        "answer": "B",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "Type Casting Vulnerability"
    },
    {
        "id": "02e3eb76-8e48-4059-bb81-f88ab382ec36",
        "source": "mozilla_security",
        "question": "Which of the following recommendations is least likely to reduce MIME type security risks?",
        "choices": [
            "A: Implementing strict Content Security Policy headers",
            "B: Restricting file uploads based on file extensions",
            "C: Enforcing HTTPS for all content transfers",
            "D: Allowing unrestricted file uploads without content-type verification"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "MIME Type Security"
    },
    {
        "id": "6a83b92a-6fbc-49be-8a66-ad438bd79733",
        "source": "cwe",
        "question": "As a developer, you are tasked with creating a temporary file for an application that requires a high level of security due to its sensitive data processing. Considering the security risks, which of the following practices should you employ to mitigate the risk of unintended actors accessing the temporary file?",
        "choices": [
            "A: Use legacy C temp file functions which are commonly available and well-tested for creating temporary files.",
            "B: Store temporary files in a directory with permissions set to allow only the user and required system processes to read and write.",
            "C: Create a shared directory for all temporary files to ensure centralized access control and monitoring.",
            "D: Implement an application-specific naming convention for temporary files to obscure their purpose from unintended actors."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "TemporaryFileSecurity"
    },
    {
        "id": "c444b089-7949-4bf3-8568-a9acdf7c54ed",
        "source": "cs161_textbook",
        "question": "Alice and Bob are communicating over an insecure channel and need to ensure confidentiality, integrity, and authentication of their messages. Which cryptographic primitives should they use to achieve these goals?",
        "choices": [
            "A: Symmetric-key encryption for confidentiality, MACs for integrity and authentication.",
            "B: Public-key encryption for confidentiality, digital signatures for integrity and authentication.",
            "C: Key exchange schemes for confidentiality, cryptographic hashes for integrity.",
            "D: Pseudo random number generator for confidentiality, key exchange schemes for authentication."
        ],
        "answer": "AB",
        "topics": [],
        "keyword": "Cryptography"
    },
    {
        "id": "86c1215b-9b9a-4a45-b213-a4d40f64ff60",
        "source": "windows_security",
        "question": "In a Windows Event Forwarding (WEF) system, when setting up event queries for subscription management, why would it be advisable to restrict access to the Targeted WEF subscription, and what criteria should dictate this access?",
        "choices": [
            "A: Access should be restricted to prevent all devices from overloading the server; access should be based on device type and role.",
            "B: Access should be open to all devices to ensure comprehensive event collection; criteria should include network location and user role.",
            "C: Access should be restricted to a limited set of hosts due to unusual activity; access should be based on specific criteria determined by an algorithm or analyst's direction.",
            "D: Access should be restricted because the Targeted subscription handles sensitive security information; access should be determined by the security clearance level of the user."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "WEF subscription management"
    },
    {
        "id": "106a9b13-cabe-41f5-92d4-6e25085bc5b6",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, what roles do governmental and standardization institutions typically play? Select the most appropriate roles from the following options. Choose all that apply.",
        "choices": [
            "A: They primarily focus on the development of entertainment software with minimal security features.",
            "B: They assist in the establishment of security standards, such as MASVS, and contribute to the cybersecurity framework.",
            "C: They solely provide funding for mobile app development without any emphasis on security aspects.",
            "D: They promote IT security by issuing guidelines and recommendations for secure mobile app development."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Institutional Contribution"
    },
    {
        "id": "ab227bb9-ddc1-49ba-9d0f-5c4d69aff23f",
        "source": "owasp_mastg",
        "question": "An Android developer is implementing a feature in their application that requires listening for certain system events. The developer is considering using either a broadcast receiver registered in the manifest or dynamically in the code. They are also exploring the use of LocalBroadcastManager for internal app communication. Which of the following statements accurately reflects the security considerations and best practices for implementing broadcast receivers in an Android application?",
        "choices": [
            "A: Registering a broadcast receiver in the manifest for implicit broadcasts is unrestricted, regardless of the Android version targeted by the application.",
            "B: Using LocalBroadcastManager can improve security by ensuring that intents are only received from the internal app, but it is deprecated and should be replaced with LiveData for inter-component communication.",
            "C: Implicit broadcasts received by dynamically registered broadcast receivers can contain the user's location or personally identifiable data.",
            "D: If a broadcast receiver is registered dynamically in code, there's no need to assign a priority since it does not affect the order in which broadcasts are received."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "LocalBroadcastManager"
    },
    {
        "id": "d0146cf3-f384-4c73-8f7d-c4ee6b7e90a2",
        "source": "cs161_textbook",
        "question": "In the context of mitigating SYN flood attacks, how do SYN cookies help to protect a server from being overwhelmed by fake connection requests? Choose all that apply.",
        "choices": [
            "A: SYN cookies encode the connection state within the sequence number, which is returned by the client, thus preventing the server from needing to allocate memory prematurely.",
            "B: SYN cookies encrypt the data transferred during the TCP handshake, ensuring that only legitimate clients can decrypt and continue the connection.",
            "C: SYN cookies restrict the number of SYN packets a single IP address can send, thus limiting the potential of flooding from a spoofed address.",
            "D: SYN cookies allow the server to verify the client's state using a secret before allocating state for the connection."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SYN_Cookies"
    },
    {
        "id": "d398f15b-e343-4377-818e-4b91d7c05343",
        "source": "owasp_wstg",
        "question": "A web application you are testing employs a highly structured username policy, which makes it susceptible to account enumeration. As part of the remediation process, how should the application handle error messages during the login process to best prevent account enumeration?",
        "choices": [
            "A: Return a unique error message when the username exists but the password is incorrect, and a different message when both are incorrect.",
            "B: Always return a generic 'Login failed' message regardless of whether the username exists or not.",
            "C: Display a 'Username does not exist' message for invalid usernames to prevent attackers from guessing valid usernames.",
            "D: Implement a delay after a certain number of failed login attempts to slow down automated enumeration attempts."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Account Enumeration"
    },
    {
        "id": "fcead14d-ea7b-44bd-9e6f-9f2f7d094693",
        "source": "owasp_mastg",
        "question": "A security analyst is assessing the configuration of a server running a Unix-like operating system and notices that IP forwarding has been enabled. The command used to enable IP forwarding was 'echo 1 > /proc/sys/net/ipv4/ip_forward'. Which of the following is a potential security implication of this configuration?",
        "choices": [
            "A: The server can act as a router, forwarding packets between networks, which may unintentionally expose internal networks.",
            "B: Enabling IP forwarding will encrypt all inbound traffic, ensuring data confidentiality across the server.",
            "C: This command sets up a firewall rule that blocks all incoming and outgoing traffic as a security measure.",
            "D: IP forwarding increases the server's performance by enabling asynchronous packet processing."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "IP forwarding"
    },
    {
        "id": "a1f7b7d0-5bda-4d5e-abc3-af6f63d68c3b",
        "source": "windows_security",
        "question": "In reviewing the security design for a large enterprise, you note that the network architects have relied solely on Windows Event Forwarding for intrusion detection across all devices. What are potential shortcomings of this approach that should be considered? (Select two)",
        "choices": [
            "A: WEF cannot forward events from non-Windows devices, limiting its effectiveness in a diverse network environment.",
            "B: WEF can result in excessive bandwidth usage due to the forwarding of all events, regardless of their significance.",
            "C: WEF eliminates the need for traditional antivirus software, which may lead to a false sense of security.",
            "D: WEF relies on predefined event collection policies, which may not cover all types of intrusion scenarios."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Intrusion Detection"
    },
    {
        "id": "e1363b03-2416-48d0-8524-203070f6c472",
        "source": "attck",
        "question": "An IT security team is investigating a potential security breach on their network. They suspect the presence of a rootkit on several systems. Which of the following would be potential locations or levels within a system where a rootkit could reside to evade detection?",
        "choices": [
            "A: User-level applications only",
            "B: Kernel-level or lower, including the hypervisor, Master Boot Record, or System Firmware",
            "C: Network routers and switches exclusively",
            "D: Anti-virus software databases"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "rootkit"
    },
    {
        "id": "96b550cd-10c8-4ca6-b37c-e8ab02c7a0ff",
        "source": "cs161_textbook",
        "question": "In a 64-bit system using pointer authentication, why would an attacker not benefit from knowing the PACs to generate a valid PAC for a chosen malicious address?",
        "choices": [
            "A: Knowing the PACs is useless without the corresponding addresses since the PAC is address-specific and generated using a secure, deterministic function.",
            "B: The CPU stores all the PACs, making it impossible for an attacker to access or use them without having control over the CPU.",
            "C: PACs are only used for addresses stored in the CPU's cache, which are not accessible by standard memory corruption attacks.",
            "D: The PACs are encoded using a one-time pad, which makes them indistinguishable from random data and impossible to reverse-engineer."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "PACGeneration"
    },
    {
        "id": "e0b79a48-7cb3-41a6-bbb3-7822c827b4b0",
        "source": "cs161_textbook",
        "question": "A company is setting up its internal network with IPv4 addressing and asks for your advice on network design and routing. Based on the networking background provided, which of the following statements are correct in the context of IP routing and subnetting?",
        "choices": [
            "A: A client on the same local network can use the Address Resolution Protocol (ARP) to obtain the MAC address of another client if it's within the same subnet.",
            "B: The IPv4 broadcast address '255.255.255.255' can be used to send packets to all computers globally.",
            "C: Packets destined for a remote IP on a different local network can be directly sent to the destination's MAC address without involving a gateway.",
            "D: The subnet '128.32.131/24' contains a smaller number of addresses compared to the subnet '128.32/16' due to its longer prefix."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Subnetting"
    },
    {
        "id": "76cdbbaa-5d8a-4986-a26b-def994325d36",
        "source": "mit6.858",
        "question": "When a browser receives an SSL certificate from a web server, it performs a series of checks before establishing a secure connection. Which of the following are among the checks that a browser conducts to authenticate the server's certificate?",
        "choices": [
            "A: Verifying that the subject name in the certificate matches the domain name in the URL.",
            "B: Ensuring the certificate is signed by a Certificate Authority whose public key is known to the browser.",
            "C: Checking that the certificate has a valid digital watermark.",
            "D: Confirming that the server has the private key corresponding to the public key in the certificate."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CertificateValidation"
    },
    {
        "id": "2506b47e-1fb5-4142-9f65-572083bca190",
        "source": "cs161_textbook",
        "question": "Considering the defense mechanisms against CSRF attacks involving CSRF tokens, why would an attacker not succeed if they create a malicious form on their website with the intent of performing a CSRF attack?",
        "choices": [
            "A: Because browsers have built-in mechanisms that automatically detect and block all cross-site scripting attempts.",
            "B: Because the malicious form would lack a valid CSRF token that maps to the victim's session token, as the victim did not request the form legitimately.",
            "C: Because all modern web servers are equipped with artificial intelligence that can distinguish between legitimate and malicious requests.",
            "D: Because users are typically trained to recognize and avoid submitting forms that originate from unknown sources."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSRF Defense"
    },
    {
        "id": "3d2656ab-8e41-4c90-a09d-2be91a1ce407",
        "source": "owasp_mastg",
        "question": "You are reviewing the security of an iOS application and encounter the following entitlement in its code signing entitlements file: `<key>com.apple.security.application-groups</key>`. Based on the application's requirement to share data between its extensions and the main app, which of the following statements are true?",
        "choices": [
            "A: The entitlement allows the application to share data with other applications installed on the device without user permission.",
            "B: The application must implement additional user prompts to ensure secure handling of data shared with its extensions.",
            "C: The entitlement is necessary to facilitate sharing data between the app and its extensions through a shared container.",
            "D: Using this entitlement, the application can directly communicate with other apps using traditional IPC techniques."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "iOS entitlements"
    },
    {
        "id": "dbfac871-5d4a-42f2-9fff-6607326d6bce",
        "source": "android_sec_doc",
        "question": "An Android application developer is designing a security feature that involves generating a key pair for digital signing and requires attestation of the new keys. The developer needs to ensure that the attestation process is secure and aligns with recommended practices. Which of the following steps would be considered secure and recommended for attestation of keys in an Android environment?",
        "choices": [
            "A: Using a nonce of at least 16 bytes for the attestation challenge to prevent replays of older attestation certificates.",
            "B: Reusing the attestation challenge for multiple requests to reduce computational overhead.",
            "C: Requesting attestation without specifying any hardware identifiers for improved privacy.",
            "D: Generating the key pair directly without a challenge, relying on the device's secure environment to ensure authenticity."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Key Attestation"
    },
    {
        "id": "140adc98-2db8-43a3-91a6-4b692af9dffe",
        "source": "cs161_textbook",
        "question": "In a DHCP handshake, why must the 'Client Discover' and 'Client Request' messages be broadcast instead of being sent directly to one server?",
        "choices": [
            "A: Broadcasting ensures that the client can receive multiple offers and select the best configuration based on the server's load.",
            "B: Broadcasting is necessary because the client does not know the IP address of the DHCP server when it joins the network.",
            "C: Broadcasting allows the client to establish a connection with multiple servers for redundancy and load balancing.",
            "D: Broadcasting is used to prevent other devices on the network from intercepting and tampering with the configuration details."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Broadcast"
    },
    {
        "id": "4fb30b08-07a5-45a7-accf-fa105a63e902",
        "source": "owasp_mastg",
        "question": "When performing security testing on an Android device, rooting is recommended to gain full control over the operating system. Which of the following statements are true regarding the consequences and process of rooting an Android device?",
        "choices": [
            "A: Rooting an Android device always voids the manufacturer's warranty and is irreversible.",
            "B: Rooting can allow for techniques such as code injection and function hooking due to elevated privileges.",
            "C: Magisk, a tool for rooting Android devices, makes system alterations that prevent root-sensitive applications from detecting modifications.",
            "D: Rooting an Android device is generally discouraged as it removes all built-in exploit mitigations, resulting in a device with no security measures."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Rooting Android devices"
    },
    {
        "id": "2bc0059d-f203-4f70-b3f3-a72c1cd08120",
        "source": "owasp_mastg",
        "question": "In a Unix-like operating system, the command 'echo 0 > /proc/sys/net/ipv4/ip_forward' was executed on a server that had previously enabled IP forwarding. What could be the primary purpose of this command?",
        "choices": [
            "A: To disable IP forwarding, reducing the risk of the server being used to route unauthorized network traffic.",
            "B: To configure the server to use IPv6 protocol instead of IPv4, as part of a network upgrade.",
            "C: To reset the server's network interfaces, a common troubleshooting step when facing network connectivity issues.",
            "D: To enable a strict firewall mode that logs all packet transfers for audit purposes."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Disable IP forwarding"
    },
    {
        "id": "6c6f3ff4-94cd-41fe-9b70-41b69b6eb6ef",
        "source": "owasp_wstg",
        "question": "Consider a web application that uses block cipher encryption to protect sensitive data in transit. One of the application's functionalities allows users to submit encrypted data, which the server decrypts and processes accordingly. An attacker observes that when malformed padding in an encrypted data block is submitted, the server responds with different error messages depending on the nature of the padding error. What kind of security vulnerability is the application likely exposing, and what potential risks does it introduce?",
        "choices": [
            "A: The application is likely exposing a padding oracle vulnerability, which could allow an attacker to decrypt data without the encryption key.",
            "B: The application is likely exposing a cross-site scripting (XSS) vulnerability, which could allow an attacker to inject malicious scripts.",
            "C: The application is likely exposing a SQL injection vulnerability, which could allow an attacker to access the backend database.",
            "D: The application is likely exposing a cross-site request forgery (CSRF) vulnerability, which could allow an attacker to perform actions on behalf of a user."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Padding Oracle Attack"
    },
    {
        "id": "20982aea-8f7c-4e05-b7e3-cfedd7c6c588",
        "source": "mozilla_security",
        "question": "An online banking website is implementing measures to secure their customer's session cookies. They have decided to set the 'SameSite' attribute to 'Strict'. What is a potential drawback of this decision that they should consider?",
        "choices": [
            "A: The 'SameSite=Strict' attribute may interfere with the website's analytics by not sending cookies along with requests initiated by third-party websites.",
            "B: The 'SameSite=Strict' attribute might allow cookies to be sent over non-HTTPS connections, weakening the security stance.",
            "C: Legitimate cross-origin requests initiated by the bank's other services or partners might fail because the 'SameSite=Strict' attribute prevents sending cookies.",
            "D: Users may be able to bypass login mechanisms since 'SameSite=Strict' does not require cookies to be set with the 'Secure' flag."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SameSite Cookie Attribute"
    },
    {
        "id": "e28f1088-c927-4303-a03c-f17dca841538",
        "source": "windows_security",
        "question": "Select the outcomes that would NOT be expected following the registration of a trusted logon process with the Local Security Authority:",
        "choices": [
            "A: Enhanced system security by allowing only recognized processes to request logon.",
            "B: Immediate lockout of all user accounts until the new logon process is verified.",
            "C: Potential for a new authentication mechanism to be used during user logon procedures.",
            "D: An increase in the number of failed logon attempts due to unrecognized logon processes."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Local Security Authority"
    },
    {
        "id": "210f8c0a-85db-483a-b60d-3e2d3f4513cc",
        "source": "cwe",
        "question": "You are reviewing the authorization controls of a web application. You discover that while the application properly authenticates users, it does not consistently enforce authorization checks when users attempt to perform different actions. Which of the following scenarios indicate an 'Improper Authorization' vulnerability?",
        "choices": [
            "A: A user can access administrative functions due to inadequate role-based access control enforcement at the server side.",
            "B: A user is unable to access their own resources due to overly restrictive access control lists implemented in the operating system.",
            "C: An authenticated user can view other users' private messages by manipulating input parameters, exploiting insufficient authorization checks.",
            "D: The application exposes sensitive information in error messages when a user attempts unauthorized actions."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Authorization"
    },
    {
        "id": "b65e83f6-bda1-4e26-b387-8721a484b997",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing a case where a sophisticated piece of malware has compromised a system within an organization. The malware is known to actively monitor for the insertion of removable media devices and selectively exfiltrates specific file types to a command and control server. Based on the analyst's knowledge of similar malware characteristics, which of the following malware types is most likely to exhibit such behavior?",
        "choices": [
            "A: A malware that encrypts data on fixed drives and demands ransom for decryption.",
            "B: A malware that establishes a backdoor and passively waits for commands from a remote server.",
            "C: A malware that actively monitors and collects data from removable media devices for exfiltration.",
            "D: A malware that only propagates itself through the local network without interacting with removable media."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Exfiltration"
    },
    {
        "id": "ea3c846b-0c5f-47c9-8b27-5e0e609adc67",
        "source": "android_sec_doc",
        "question": "Why does the implementation of file-based encryption (FBE) in Android devices use hardware-wrapped keys instead of solely relying on the keyslots of an inline crypto engine?",
        "choices": [
            "A: The number of keyslots in an inline crypto engine is limited, and it cannot be used for tasks such as filenames encryption or deriving key identifiers.",
            "B: Inline crypto engines are not capable of encrypting/decrypting full blocks of data on-disk.",
            "C: Hardware-wrapped keys are less secure than keyslots in inline crypto engines but are easier to implement.",
            "D: The inline crypto engine requires the raw encryption keys to be saved on the disk, which is a security risk."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "File-Based Encryption (FBE)"
    },
    {
        "id": "bab5f2bf-ab96-4e8e-a045-bbaab34abb5d",
        "source": "cs161_textbook",
        "question": "An online discussion suggests that modern browser frame isolation is sufficient to prevent all security vulnerabilities associated with embedding content from different sources. Analyze the statement and select the option that best refutes this claim, based on your understanding of web security and frame isolation.",
        "choices": [
            "A: Frame isolation completely prevents the outer page from accessing the inner page, eliminating all cross-site scripting risks.",
            "B: Frame isolation does not address the risk of clickjacking attacks, where a malicious iframe can trick users into clicking unintended elements.",
            "C: Modern browsers' frame isolation enforces same-origin policy, therefore no external content can be embedded, which negates the risk.",
            "D: Frame isolation protects against man-in-the-middle attacks, as the outer page is unable to modify the inner page content."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Frame Isolation"
    },
    {
        "id": "9edf17f6-1347-4c8e-8ede-5152ae97a410",
        "source": "cwe",
        "question": "A software module is updated to include a new function 'executeWorkflow' which throws a custom exception 'WorkflowException'. The existing error handling logic is designed to catch generic exceptions. Which of the following is a potential consequence of not updating the exception handling logic to specifically address 'WorkflowException'?",
        "choices": [
            "A: The generic catch block will handle 'WorkflowException' in a generic way, potentially missing specific cleanup or compensation logic required for 'WorkflowException'.",
            "B: The generic catch block will cause a compilation error, forcing the developer to handle 'WorkflowException' specifically.",
            "C: The 'WorkflowException' will be propagated up the call stack, triggering the default uncaught exception handler of the runtime environment.",
            "D: The generic catch block will automatically handle 'WorkflowException' with the most appropriate error handling logic predefined for it."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ErrorHandling"
    },
    {
        "id": "307c77bd-0281-491d-a1d4-b3883c74cc49",
        "source": "cwe",
        "question": "A developer is working on a web application that accepts text input for processing commands. To prevent security issues related to Improper Handling of Inconsistent Special Elements, which of the following measures should the developer implement? Choose all that apply.",
        "choices": [
            "A: Use a list of acceptable inputs that strictly conform to specifications and reject any input that does not.",
            "B: Encode special characters such as '<' and '>' into HTML entities to prevent script injection.",
            "C: Implement a denylist of known malicious inputs to filter out potential attacks.",
            "D: Decode and canonicalize inputs to the application's current internal representation before validation."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "75c5e96b-164d-40ac-ab53-d0d927ab4005",
        "source": "windows_security",
        "question": "In managing the lifecycle of virtual smart cards, an organization may choose to renew the virtual smart card credentials. What are the considerations and consequences associated with renewing credentials using the same key pair versus generating a new key pair?",
        "choices": [
            "A: Renewing with the same key pair requires additional steps to assure the strength of the credentials.",
            "B: Renewing with a new key pair should occur periodically to counter sophisticated long-term attempts by malicious users to infiltrate the system.",
            "C: Renewing with a new key pair does not require any additional steps since the same strong certificate was issued during the initial provisioning.",
            "D: Renewing with the same key pair is discouraged as it greatly increases the chances of certificate hijacking by former employees."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Virtual Smart Card Management"
    },
    {
        "id": "7b6bfc96-3aff-4ed1-9a88-3a33040d2b84",
        "source": "attck",
        "question": "Which of the following would NOT be an effective mitigation technique for preventing data exfiltration over web services?",
        "choices": [
            "A: Implementing data loss prevention mechanisms to detect and block sensitive data uploads.",
            "B: Deploying antivirus software on all endpoint devices.",
            "C: Using web proxies to enforce an external network communication policy.",
            "D: Reviewing application logs for SaaS services to detect the configuration of new webhooks."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Data Exfiltration Mitigations"
    },
    {
        "id": "f7d80e0c-0480-4e76-ba70-31a920b89584",
        "source": "windows_security",
        "question": "A security analyst is evaluating the risks associated with user accounts on a Windows network. Which of the following practices would diminish the risk of identity theft? (Select two.)",
        "choices": [
            "A: Enforcing user account lockout policies after multiple failed login attempts",
            "B: Requiring the installation of third-party antivirus software on all servers and workstations",
            "C: Utilizing multifactor authentication for remote access to the network",
            "D: Setting all user account passwords to expire after one year of use"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Account Lockout Policies"
    },
    {
        "id": "f04dafc5-00fc-4ddf-944c-baf6ffd102ec",
        "source": "apple_platform_security",
        "question": "Which sequence of events accurately describes the process of authenticating a user with Face ID or Touch ID on an Apple device?",
        "choices": [
            "A: The biometric sensor captures the image, transmits it to the Secure Enclave, where it's processed and compared against the stored templates for validation.",
            "B: The biometric image is stored in the device's main storage, then compared with the Secure Enclave's templates to unlock the device or validate the transaction.",
            "C: Face ID adapts to changes in appearance by updating stored templates in the Cloud, while Touch ID expands the fingerprint map with each use.",
            "D: The Secure Enclave sends the biometric template data to the sensor, which then captures the biometric image and matches it against the template."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "BiometricAuthentication"
    },
    {
        "id": "a212e74c-7001-4b0d-bf67-d17f4f2666f6",
        "source": "cwe",
        "question": "Consider a function 'processTransaction' that can throw multiple exceptions such as 'NetworkException', 'DatabaseException', and 'PaymentException'. A developer decided to streamline the exception handling using a single catch block. Which of the following catch block implementations can potentially lead to security vulnerabilities or logic errors in the application?",
        "choices": [
            "A: try { processTransaction(); } catch (Exception e) { logger.error('Transaction failed', e); }",
            "B: try { processTransaction(); } catch (NetworkException | DatabaseException | PaymentException e) { logger.error('Transaction failed', e); }",
            "C: try { processTransaction(); } catch (Throwable e) { logger.error('Transaction failed', e); }",
            "D: try { processTransaction(); } catch (Exception e) { if (e instanceof NetworkException || e instanceof DatabaseException) { logger.error('Transaction failed', e); } else { throw e; }}"
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ExceptionHandling"
    },
    {
        "id": "21c8cac6-2e25-4729-b15b-b4e8221ce3db",
        "source": "owasp_wstg",
        "question": "Which of the following code snippets, when included in a web application, would NOT effectively prevent a clickjacking attack?",
        "choices": [
            "A: Code that sets the X-Frame-Options HTTP header to 'DENY'.",
            "B: Code that sets the Content-Security-Policy header with the frame-ancestors directive to 'none'.",
            "C: Code that sets the X-Frame-Options HTTP header to 'SAMEORIGIN'.",
            "D: Code that sets a JavaScript function to check if the current frame is the topmost frame."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Clickjacking"
    },
    {
        "id": "fa76ffc9-73c4-415e-a1bc-cb9dbef0599c",
        "source": "android_sec_doc",
        "question": "Why is it not recommended to implement a custom Key Derivation Function (KDF) when the hardware uses a KDF that does not match the test expectation for Android device encryption?",
        "choices": [
            "A: A custom KDF can lead to compatibility issues with the expected key derivation during testing.",
            "B: Custom KDFs generally reduce the overall security of the device by introducing vulnerabilities.",
            "C: Hardware-wrapped keys are less secure when a custom KDF is used, as they can be easily extracted and used off-device.",
            "D: Using a custom KDF would prevent the usage of AES-256-GCM with random IVs, which is a strong AEAD required by Android."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Key Derivation Function (KDF)"
    },
    {
        "id": "0ff6e15e-2ff6-46e2-8733-38795462864d",
        "source": "attck",
        "question": "An adversary is attempting to gain initial access to a corporate network by targeting their public-facing infrastructure. Which of the following techniques would be most plausible for the adversary to exploit in this scenario?",
        "choices": [
            "A: Exploiting a software bug or misconfiguration in a web server",
            "B: Sending phishing emails to the company's general contact inbox",
            "C: Intercepting and decrypting internal SSL/TLS traffic",
            "D: Executing a distributed denial-of-service (DDoS) attack to overwhelm the public website"
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Exploit Public-Facing Application"
    },
    {
        "id": "f22e6494-0c5b-492e-9ec7-3c0529185f8b",
        "source": "apple_platform_security",
        "question": "An organization is preparing to deploy a fleet of Apple devices using an MDM solution. As an IT administrator, you need to ensure the security and efficient management of these devices throughout their lifecycle. Select the practices that should be implemented based on the information provided:",
        "choices": [
            "A: Enroll devices in Automated Device Enrolment to streamline their configuration without physical preparation.",
            "B: Implement a preliminary configuration with restricted access and require further configuration steps before granting access to sensitive data.",
            "C: Allow users to remove MDM profiles at their discretion to foster a flexible user experience.",
            "D: Use Managed Lost Mode to remotely enable Lost Mode on supervised devices that are reported lost or stolen."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "DeviceManagement"
    },
    {
        "id": "e5d69a43-4a50-48fa-acd0-7b44b41640b8",
        "source": "mozilla_security",
        "question": "A web application developer is working on enhancing the security of user session management. The application strictly requires cookies to be accessed only via HTTPS, have a limited lifespan, not be accessible from JavaScript, and restrict cross-origin requests to protect against CSRF attacks. Which of the following sets of cookie attributes would best meet these requirements?",
        "choices": [
            "A: Set-Cookie: sessionId=abc123; Secure; HttpOnly; SameSite=Strict; Expires=Wed, 09 Jun 2021 10:18:14 GMT",
            "B: Set-Cookie: sessionId=abc123; Secure; SameSite=Lax; Path=/; Domain=example.com",
            "C: Set-Cookie: __Host-sessionId=abc123; HttpOnly; SameSite=Strict; Max-Age=3600",
            "D: Set-Cookie: __Secure-sessionId=abc123; Secure; HttpOnly; SameSite=Strict; Max-Age=3600"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Cookie Security"
    },
    {
        "id": "5d0334d9-8c66-4218-9fc3-a46106d44a29",
        "source": "attck",
        "question": "A company's security team is reviewing their defense strategy against potential firmware corruption attacks on their network devices. Which of the following actions would be effective in both preventing firmware corruption and ensuring device availability, and what is a potential downside of this action?",
        "choices": [
            "A: Install a modified bootloader to prevent unauthorized boot-ups, but this may introduce compatibility issues with some legitimate software.",
            "B: Patch the BIOS and other firmware routinely to prevent exploitation of known vulnerabilities, though this may cause system downtime during the update process.",
            "C: Remove all firmware access from the network to prevent tampering, which could hinder necessary updates and maintenance tasks.",
            "D: Encrypt all firmware data to prevent unauthorized changes, but encryption may increase the boot time of the devices."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Firmware Corruption"
    },
    {
        "id": "dcf1eacf-2aa0-4b0b-962a-77304639f9ec",
        "source": "attck",
        "question": "An organization's security team has identified an incident where an adversary built a custom container image directly on a host, using a base image from a public registry to bypass standard image scanning defenses. Which of the following mitigation strategies would be most effective to prevent this type of activity? (Select two)",
        "choices": [
            "A: Implementing network segmentation to deny direct remote access to internal systems.",
            "B: Restricting image creation to only allow base images that have been pre-approved and scanned for vulnerabilities.",
            "C: Requiring all containers to run as root to ensure that adequate privileges are available for security monitoring tools.",
            "D: Auditing deployed images within the environment to ensure they do not contain any malicious components."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "72cc36d2-2d0f-4b66-a7a1-2c055293ecd7",
        "source": "owasp_wstg",
        "question": "Which of the following tools would NOT be suitable for vulnerability assessment of Oracle-based web applications that use the PL/SQL Gateway?",
        "choices": [
            "A: Orascan (Oracle Web Application VA scanner)",
            "B: Burp Suite (General web application security testing tool)",
            "C: NGS SQuirreL (Oracle RDBMS VA Scanner)",
            "D: Wireshark (Network protocol analyzer)"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Vulnerability Assessment"
    },
    {
        "id": "5449601b-bc8d-420b-88ee-70903af8d16d",
        "source": "attck",
        "question": "If an adversary successfully compromises the encryption capabilities of a network device, which of the following is a likely indirect consequence?",
        "choices": [
            "A: The network traffic throughput increases due to the enhanced performance of the device.",
            "B: Network traffic becomes susceptible to unauthorized disclosure and manipulation.",
            "C: The device begins to reject all incoming and outgoing network traffic automatically.",
            "D: The security of the device is enhanced because of the introduction of an unpredictable variable."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Encryption Compromise"
    },
    {
        "id": "21ff0c64-7c30-4114-b53f-5e19fe53fb21",
        "source": "attck",
        "question": "An attacker has gained access to a corporate network and intends to list all running processes on several compromised hosts to determine potential targets for further exploitation. Which of the following techniques or malware has NOT been documented as having the ability to enumerate running processes on a compromised system?",
        "choices": [
            "A: Using the tasklist command to enumerate processes.",
            "B: Employing the GetWindowThreadProcessId function to identify processes.",
            "C: Leveraging a custom-built kernel driver to hide running processes.",
            "D: Executing the CreateToolhelp32Snapshot function to list processes."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Process Enumeration"
    },
    {
        "id": "f23f4744-23c4-4459-9c6c-2ab981082f46",
        "source": "owasp_mastg",
        "question": "You are tasked with conducting a security review for a mobile banking application designed for iOS. To align with best practices, you need to ensure that the application adheres to robust authentication mechanisms. Which of the following strategies should you recommend to enhance the authentication security of the mobile application?",
        "choices": [
            "A: Implement biometric authentication using the iOS platform's native capabilities to reduce reliance on passcodes.",
            "B: Disable all local authentication methods and rely solely on server-side authentication to ensure security.",
            "C: Use a simple 4-digit PIN for authentication as it offers a balance between security and user convenience.",
            "D: Store user credentials locally in plaintext to facilitate faster login and improve user experience."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Biometric Authentication"
    },
    {
        "id": "309ff891-aae1-417b-8d52-9dae74337140",
        "source": "attck",
        "question": "During an incident response, a Linux system is suspected to be compromised. The response team finds a suspicious command in the system logs: `ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"`. What was the likely purpose of this command being executed on the system?",
        "choices": [
            "A: To delete critical configuration files from the system.",
            "B: To determine which Linux OS version is running on the system.",
            "C: To install a new kernel module for enhancing system performance.",
            "D: To prepare the system for a secure and clean shutdown."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Linux Command"
    },
    {
        "id": "7930812a-cc28-447f-855c-4143bfd43c7b",
        "source": "owasp_wstg",
        "question": "A financial institution is planning to conduct a penetration test to comply with industry requirements and ensure the security of their Cardholder Data Environment (CDE). They need to ensure that the penetration test covers both application-layer and network-layer testing, and that it is based on industry-accepted approaches. Which of the following methodologies should they consider for their penetration test?",
        "choices": [
            "A: OWASP Firmware Security Testing Methodology",
            "B: PCI DSS Penetration Testing Requirements",
            "C: OSSTMM's Telecommunications Security Testing",
            "D: NIST 800-115's Target Vulnerability Validation Techniques"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "PCI DSS Requirement 11.3"
    },
    {
        "id": "a5815a72-47d8-4598-aa83-30a7ac47aae6",
        "source": "attck",
        "question": "An application developer is implementing security measures to prevent unauthorized plist file modification on a macOS application. Which of the following code examples would NOT contribute to preventing such modifications?",
        "choices": [
            "A: Implementing file access permissions that restrict plist file modification to only authorized users.",
            "B: Using Apple's hardened runtime as recommended in the developer guidance.",
            "C: Enabling unrestricted access to plist files for all system processes.",
            "D: Monitoring for plist file modifications through the use of file integrity checks."
        ],
        "answer": "C",
        "topics": [
            "PenTest",
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Hardened Runtime"
    },
    {
        "id": "da4ece90-b3a0-4fe5-891d-76240553a154",
        "source": "cs161_textbook",
        "question": "An online banking system has recently been targeted by phishing attacks aiming to steal user credentials. Which of the following authentication methods would not be effective at preventing credential theft in the context of phishing attacks?",
        "choices": [
            "A: Two-factor authentication",
            "B: One-time PINs",
            "C: Public-key cryptography",
            "D: Mandatory security questions"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Phishing"
    },
    {
        "id": "9b2566ee-9066-4024-bdbc-4fba3c6b482a",
        "source": "apple_platform_security",
        "question": "In the context of iOS and related operating systems, what are the correct associations between Data Protection classes or keybags and their characteristics or functionalities?",
        "choices": [
            "A: The user keybag contains wrapped class keys that are unwrapped when the passcode is entered and is stored in a binary property list file in the No Protection class.",
            "B: The escrow keybag contains the same class keys used on the device and requires the user to enter the passcode for the first backup with the Finder or iTunes after a reboot.",
            "C: The device keybag is used to wrap per-file keys in a cryptographic separation of per-user file system content.",
            "D: NSFileProtectionCompleteUntilFirstUserAuthentication is the default Data Protection class for volumes that don’t correspond to a booted operating system in macOS."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DataProtection"
    },
    {
        "id": "577dda45-a10e-48f5-8e7d-276fc1e7644c",
        "source": "cwe",
        "question": "Consider the following function in a program that processes numerical data. Identify the potential vulnerabilities that might arise due to the use of signed and unsigned integers. Select all that apply.",
        "choices": [
            "A: When a signed integer is implicitly cast to an unsigned integer during a failure condition, it might result in a large positive value that can lead to buffer overflow.",
            "B: A negative signed integer used in a size calculation for memory allocation could, upon conversion to an unsigned size_t type, result in a very large value, causing memory allocation failure or excessive memory consumption.",
            "C: Using a signed integer to restrict the size of user input can inadvertently allow large memory copies if the negative value is implicitly cast to a large unsigned integer during processing.",
            "D: A function that returns a signed integer indicating the size of a memory chunk could cause an underflow when the return value is directly used in a memory copy operation without checking for errors."
        ],
        "answer": "ABCD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "Integer Conversion"
    },
    {
        "id": "a4242b47-3b29-407d-9459-8f1d87f0470e",
        "source": "windows_security",
        "question": "If an organization chooses to disable the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting on their Windows 10 devices, which of the following would not be a direct consequence?",
        "choices": [
            "A: Anonymous users would be unable to enumerate the names of domain accounts and network shares.",
            "B: The administrator would be able to assign specific permissions for anonymous connections.",
            "C: There would be an impact on the security configuration of domain controllers.",
            "D: Anonymous connections to the device would rely on default permissions."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "SAM accounts enumeration"
    },
    {
        "id": "741a8d9e-049e-4acd-9dfb-d14ae5b0faa1",
        "source": "mozilla_security",
        "question": "A web administrator decides to implement HTTP Public Key Pinning (HPKP) to enhance the security of their maximum risk site. The administrator is aware of the potential risks associated with HPKP and is cautious to avoid any missteps. Which of the following actions would be prudent to take before fully enabling HPKP on the production domain?",
        "choices": [
            "A: Deploying HPKP with a long 'max-age' directive to ensure maximum protection.",
            "B: Testing HPKP on a non-production domain with `Public-Key-Pins-Report-Only` before full implementation.",
            "C: Using a single key pin and avoiding backup pins to simplify the configuration process.",
            "D: Implementing HPKP without testing since most modern browsers automatically handle the associated risks."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Public Key Pinning (HPKP)"
    },
    {
        "id": "d41e7487-9fb3-4bd8-976a-d9dee258857f",
        "source": "attck",
        "question": "If an adversary successfully performs peripheral device discovery on a targeted system, what could be the potential implications for the organization? Choose the most relevant outcomes.",
        "choices": [
            "A: The adversary may enhance their awareness of the system and network environment, which could facilitate further malicious actions.",
            "B: The adversary could cause a denial-of-service attack by overloading the peripheral device drivers with excessive requests.",
            "C: Peripheral device discovery could lead to an immediate leak of all stored data without the need for additional exploitation techniques.",
            "D: The organization may experience performance degradation due to the introduction of benign but resource-intensive software."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Adversarial Awareness"
    },
    {
        "id": "dfdcea54-2f5e-4db3-8ec8-55a3fca0df72",
        "source": "apple_platform_security",
        "question": "Which of the following reasons explain why the statement 'Apple devices' hardware-based encryption can be easily disabled to accommodate different user requirements' is incorrect?",
        "choices": [
            "A: Apple devices use developer kit security frameworks that do not support hardware-based encryption.",
            "B: Apple's hardware-based encryption is tied to the Secure Enclave, which is not accessible to end-users.",
            "C: Apple's design philosophy ensures that key security features cannot be disabled by mistake, including hardware-based encryption.",
            "D: Hardware-based encryption on Apple devices only applies to system files and not to user data, making it less critical."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "HardwareEncryption"
    },
    {
        "id": "2a7356da-6c14-4680-8bb6-f4123960cf95",
        "source": "cwe",
        "question": "Examine the following code snippets and determine which ones may potentially lead to improper null termination vulnerabilities. Select all that apply.",
        "choices": [
            "A: char input[256]; fgets(input, 256, stdin); input[strlen(input) - 1] = '\\0';",
            "B: char *src = \"example text\"; char dest[12]; strncpy(dest, src, 12);",
            "C: char buffer[128]; snprintf(buffer, sizeof(buffer), \"%s\", user_input);",
            "D: char path[PATH_MAX]; ssize_t len = readlink(\"/usr/bin/app\", path, sizeof(path)); path[len] = '\\0';"
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "null-termination"
    },
    {
        "id": "e264375f-fbfd-48f7-be67-391599cc8246",
        "source": "owasp_mastg",
        "question": "An iOS application developer is tasked with implementing a feature that requires hashing user passwords securely before storing them. Considering the best practices for iOS security, which of the following approaches should the developer adopt?",
        "choices": [
            "A: Use CommonCrypto's `CommonDigest.h` for hashing with SHA-2 512-bit digest.",
            "B: Implement a custom hashing algorithm to ensure unique application-specific security.",
            "C: Hash the passwords with CryptoKit's MD5 to benefit from its speed and efficiency.",
            "D: Store the passwords in plaintext and rely on iOS's secure storage mechanisms."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "SHA-2 512-bit"
    },
    {
        "id": "659f2ee2-ad2f-4d42-8499-fbac3580ef82",
        "source": "windows_security",
        "question": "A company is planning to enhance the security of its devices by enabling a feature called memory integrity, which is known to protect against certain types of attacks by isolating kernel and driver code execution. The company uses a mix of operating systems across their devices. Which of the following operating systems are compatible with the memory integrity feature?",
        "choices": [
            "A: Windows 11",
            "B: Windows XP",
            "C: Windows Server 2016",
            "D: Windows 8"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "MemorySafety"
        ],
        "keyword": "Memory Integrity"
    },
    {
        "id": "381772f9-b4ad-4a36-ad5d-c66e7b73a4d0",
        "source": "cwe",
        "question": "A software engineer is tasked with securing an IOCTL operation that utilizes the METHOD_NEITHER I/O control code. To prevent the exploitation of the IOCTL by attackers who might supply arbitrary memory addresses, which of the following measures should the engineer implement?",
        "choices": [
            "A: Utilize ProbeForRead and ProbeForWrite routines to validate user-space addresses before accessing them.",
            "B: Restrict the IOCTL to be accessed only by users with administrative privileges.",
            "C: Replace METHOD_NEITHER with a more secure method like METHOD_BUFFERED, if possible.",
            "D: Ensure that the security measures are applied during the maintenance phase after the product release."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "IOCTL"
    },
    {
        "id": "3e963424-6553-4ff4-961f-f8e1ea9c60d1",
        "source": "mit6.858",
        "question": "Consider a scenario where Service A needs to securely communicate with Service B within a large organization's network infrastructure. Select the mechanisms that Service A can employ to ensure that its request to Service B is both authentic and confidential:",
        "choices": [
            "A: Service A signs the RPC with its private key to prove its identity to Service B.",
            "B: Service A encrypts the RPC with Service B's public key to ensure confidentiality during transit.",
            "C: Service A sends the RPC in plaintext but includes a secret passphrase known only to Services A and B.",
            "D: Service A encrypts the RPC with its own public key to prevent third parties from impersonating Service B."
        ],
        "answer": "AB",
        "topics": [
            "Cryptography"
        ],
        "keyword": "Cryptography"
    },
    {
        "id": "0e1d80ed-3738-4de0-bbac-87a504a7f0ba",
        "source": "owasp_mastg",
        "question": "In the context of security testing within an SDLC, what are the primary reasons for distinguishing between tests performed by an internal team and tests performed by an independent third party?",
        "choices": [
            "A: Internal tests are typically more frequent and less expensive, focusing on daily operations, while third-party tests offer more organizational benefits and are mandated by many regulations.",
            "B: Third-party tests eliminate the need for internal tests due to their comprehensive nature.",
            "C: Internal tests are often considered untrustworthy and are only used for preliminary assessments.",
            "D: Third-party tests are performed daily to ensure continuous compliance with development standards."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Internal Testing"
    },
    {
        "id": "c6e8f5ac-fa39-4ee7-aeee-eba3822c2abf",
        "source": "apple_platform_security",
        "question": "In the context of a device's security system that utilizes biometric authentication methods such as Face ID and Touch ID, under which of the following circumstances would the system require the entry of a passcode or password for user authentication?",
        "choices": [
            "A: When the user hasn't unlocked the device with a passcode or password for 156 hours and hasn't used biometrics in the last 4 hours.",
            "B: After the device has received five unsuccessful biometric match attempts.",
            "C: Immediately after the user has successfully unlocked the device with a biometric method.",
            "D: When the user needs to change the security settings of the device."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "9f93ab09-4860-4074-a836-65ecc103181a",
        "source": "attck",
        "question": "In the context of mitigating the risk of adversaries using direct volume access to evade detection, which of the following would be an effective approach and why? (Select TWO)",
        "choices": [
            "A: Regularly update antivirus definitions to detect new malware variants",
            "B: Limit privileges to manage backups to only required accounts and monitor for unauthorized activity",
            "C: Implement full disk encryption to prevent unauthorized data access",
            "D: Monitor for the creation of volume shadow copy and backup files to detect irregular activity"
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "User Account Management"
    },
    {
        "id": "4a20a25f-6683-44a7-862e-ad137d8901b3",
        "source": "owasp_wstg",
        "question": "You are conducting a security test on a web application to identify privilege escalation vulnerabilities. Your objective is to ensure that users cannot access resources or functionalities beyond their given permissions. Which of the following steps would be most effective in achieving your objective?",
        "choices": [
            "A: Identify and target injection points related to privilege manipulation, employing tools such as Zed Attack Proxy to fuzz and bypass security measures.",
            "B: Implement role-based authentication checks at the application's frontend only, assuming the backend is secure.",
            "C: Assume all users will follow the intended application flow and, therefore, only test the application's main functionality without considering privilege manipulation.",
            "D: Focus solely on external threats and disregard the possibility of internal users attempting to escalate their privileges."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Privilege Escalation"
    },
    {
        "id": "786c4af9-bb48-4e5c-a143-15846a0f3d94",
        "source": "apple_platform_security",
        "question": "An organization is planning to deploy a fleet of iOS devices to its employees. As an IT security specialist, you are tasked with securing the device management process. Which of the following methods can be applied to ensure secure management of these iOS devices?",
        "choices": [
            "A: Implementing passcode requirements that enforce complex passcode composition.",
            "B: Enrolling devices using Automated Device Enrolment to prevent the MDM profile from being removed by the user.",
            "C: Disabling USB-based diagnostic services to prevent unauthorized data access.",
            "D: Allowing users to install configuration profiles without MDM enrolment."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DeviceManagement"
    },
    {
        "id": "95e5de9a-2198-4e77-8456-00802479e016",
        "source": "owasp_mastg",
        "question": "You are tasked with setting up an environment for Android application security testing. Considering the factors such as speed, cost, ease of root detection, and hardware interaction, which setup would you recommend and why?",
        "choices": [
            "A: Use a physical Android device due to its faster operation, easier interaction with hardware features, and more challenging root detection.",
            "B: Opt for an emulator because it offers faster operation and is typically rooted by default, providing a more realistic testing environment.",
            "C: Prefer a commercial emulator like Genymotion, as it is the official Android emulator that offers enhanced features appropriate for app testing.",
            "D: Employ an Android Virtual Device (AVD) for its ability to easily change SDK versions and create multiple devices, despite its typically slow operation."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Android Security Testing"
    },
    {
        "id": "9f26a7a1-4951-4c03-a97b-8ce0422885ae",
        "source": "cs161_textbook",
        "question": "You are tasked with securing the transport layer of a web application. To mitigate potential threats, you consider various strategies. Which of the following strategies would effectively defend against the identified vulnerabilities of the transport layer?",
        "choices": [
            "A: Implementing stateful packet inspection at the network layer to filter out malicious packets.",
            "B: Relying on cryptography at a higher layer such as employing Transport Layer Security (TLS) for data encryption.",
            "C: Decreasing the TCP window size to reduce the rate at which packets are sent and acknowledged.",
            "D: Using randomly generated sequence numbers to prevent off-path attackers from successfully injecting packets."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TransportLayerSecurity"
    },
    {
        "id": "f0272950-f10e-4993-ad51-055f53e725e8",
        "source": "apple_platform_security",
        "question": "As a security analyst, you are tasked with evaluating the pros and cons of the security design for the Tap to Pay on iPhone service. Which of the following are accurate statements about the security components and their roles in the service?",
        "choices": [
            "A: The NFC controller is responsible for securing the contactless payment card data within the Secure Element.",
            "B: The Secure Element hosts payment kernels and ensures the integrity and authenticity of payment acceptance applets.",
            "C: The Tap to Pay on iPhone servers collect payer's names, addresses, and phone numbers during transactions for security purposes.",
            "D: Tap to Pay on iPhone does not require additional hardware for merchants to accept contactless payments, which reduces potential points of compromise."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Tap to Pay Security"
    },
    {
        "id": "06e9bd67-33a0-40eb-aec8-9da3a59da19f",
        "source": "owasp_wstg",
        "question": "In a scenario where an application's user account names are easily guessable due to a highly structured naming convention, which of the following error handling strategies would not effectively mitigate the risk of account enumeration?",
        "choices": [
            "A: Randomizing error codes for both invalid and valid but incorrect login attempts.",
            "B: Using a CAPTCHA challenge after several failed login attempts.",
            "C: Providing detailed error messages to guide users about incorrect usernames or passwords.",
            "D: Locking out accounts temporarily after consecutive failed login attempts."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "User Authentication"
    },
    {
        "id": "b1ed7662-1171-4b13-9dd3-f888833c104b",
        "source": "apple_platform_security",
        "question": "Consider the security features of macOS, such as code signing, notarisation, and runtime protection. Select the reasons why these features are beneficial for maintaining the security of the macOS environment.",
        "choices": [
            "A: Code signing allows users to validate the integrity of apps, ensuring that the software hasn't been tampered with since the developer signed it.",
            "B: Notarisation is a malware scanning service provided by Apple to check for known malware in apps distributed outside the App Store.",
            "C: Runtime protection allows all apps, regardless of their source, to freely access data stored by other apps to promote interoperability.",
            "D: Gatekeeper verifies the identity of software developers and ensures that only notarised software runs on the user's Mac."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "macOSSecurity"
    },
    {
        "id": "890542ed-74bc-4e18-b413-f06fe6dd362d",
        "source": "mit6.858",
        "question": "In a multi-tenant environment where each tenant's workload runs in a shared kernel space, what are the potential limitations or challenges associated with relying on the following isolation mechanisms?",
        "choices": [
            "A: Linux containers may not provide sufficient isolation due to the shared kernel, potentially allowing kernel vulnerabilities to affect all containers.",
            "B: Seccomp-bpf filters can effectively limit the system calls a process can invoke, fully mitigating the issue of a wide kernel attack surface.",
            "C: Using a mandatory access control system can prevent many types of unauthorized actions, but it may not address all kernel-level vulnerabilities.",
            "D: Language runtimes offer complete isolation from kernel vulnerabilities by not relying on the Linux kernel for execution."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "kernel-isolation"
    },
    {
        "id": "a22f0614-c5a6-4833-a7f0-91af34e24276",
        "source": "windows_security",
        "question": "An administrator is creating a script to manage file and directory permissions in a Windows environment. The script needs to enable a user to list the contents of a directory and to read the extended file attributes of files within that directory. Which access rights hexadecimal values should be included in the script? (Choose two.)",
        "choices": [
            "A: 0x1",
            "B: 0x8",
            "C: 0x10",
            "D: 0x20"
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Hexadecimal Access Rights"
    },
    {
        "id": "373000bc-d746-4c4b-a423-76d179f010e2",
        "source": "windows_security",
        "question": "An enterprise is evaluating different system integrity solutions for its new Windows-based IT infrastructure. The IT manager has heard about a solution that consolidates various system integrity features into a unified framework. This framework is designed to provide robust protection against rootkits and bootkits by validating the boot sequence, ensuring the integrity of the Core System, and preventing unauthorized firmware updates. Which solution best fits this description?",
        "choices": [
            "A: Windows Defender Exploit Guard",
            "B: Windows Defender System Guard",
            "C: Windows Defender Credential Guard",
            "D: Windows Defender Antivirus"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "System Integrity"
    },
    {
        "id": "054d6d88-615a-4d34-ba6d-bf29a7d2527e",
        "source": "cs161_textbook",
        "question": "In reviewing the security posture of a web application, you are evaluating the use of logging as an intrusion detection mechanism. Which of the following points would you raise as potential weaknesses in relying solely on logging?",
        "choices": [
            "A: Logging ensures the immediate blocking of suspicious activities, thereby preventing potential damage.",
            "B: Logs may not capture the full scope of an attack if the attacker uses evasion techniques that are not accounted for in the logging system.",
            "C: Logging cannot provide insights into the system's behavior before or during an attack as it only records events after they have occurred.",
            "D: The implementation of logging significantly reduces the web server's performance due to the high computational overhead."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Weaknesses"
    },
    {
        "id": "fe68ea2f-a08b-43ff-8144-285035b69699",
        "source": "owasp_mastg",
        "question": "In an environment where mobile applications are at risk of memory dumping attacks, which of the following strategies would most effectively protect cryptographic keys used within the application?",
        "choices": [
            "A: Storing keys in a remote server and using an orchestration layer to retrieve them when needed.",
            "B: Hardcoding the keys into the application's source code to prevent them from being dumped from memory.",
            "C: Using simple obfuscation techniques to hide keys in the application's memory space.",
            "D: Storing keys inside Secure Hardware-backed Storage, such as Android Keystore or Apple's Secure Enclave."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Hardware-backed Storage"
    },
    {
        "id": "98201358-d385-45af-b314-9678312f473c",
        "source": "android_sec_doc",
        "question": "When dealing with an A/B device that has undergone a platform update, what is the correct sequence of actions that must be taken to ensure proper system functionality and security?",
        "choices": [
            "A: Update the Rollback Protection metadata followed by marking the slot as 'SUCCESSFUL' with the Boot Control HAL.",
            "B: Mark the slot as 'SUCCESSFUL' using the Boot Control HAL before updating the Rollback Protection metadata.",
            "C: Ignore the Rollback Protection metadata if the update seems successful and only mark the slot as 'SUCCESSFUL'.",
            "D: Perform a factory reset immediately after updating the platform to avoid any conflicts with the Rollback Protection metadata."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Rollback Protection"
    },
    {
        "id": "df9a3882-a663-47f5-aec9-a666c85ab51a",
        "source": "cs161_textbook",
        "question": "In the context of DNSSEC, when a trust anchor delegates trust by signing a public key of a name server, which of the following statements are true regarding the trust validation process for subsequent communications?",
        "choices": [
            "A: The root's endorsement is sufficient for all subsequent levels of domain name servers to be considered trusted, allowing for a chain of trust.",
            "B: Each child name server must independently establish trust with the trust anchor before its public key can be considered trusted.",
            "C: A name server's public key, once signed by its immediate parent, is trusted by all entities that trust the parent, forming a cascading trust relationship.",
            "D: The trustworthiness of a message signed by a name server is independent of the trust anchor's endorsement of the name server's public key."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNSSEC"
    },
    {
        "id": "29bc59ee-21d7-4dc9-aa76-f5e98ca1033b",
        "source": "cwe",
        "question": "You are reviewing the security of a web application and come across a segment of code designed to update user profiles. You recognize the potential for Cross-Site Request Forgery (CSRF) attacks and are considering various mitigation strategies. Which of the following strategies would be effective in preventing CSRF attacks, taking into account the need for both server and client-side protections?",
        "choices": [
            "A: Implement a same-origin policy on the server side to ensure that only requests originating from the same domain are processed.",
            "B: Generate a unique nonce for each form, verify the nonce upon form submission, and ensure the nonce is not predictable.",
            "C: Use the GET method for state-changing operations to simplify the request handling process.",
            "D: Store a pseudorandom value as a cookie and require it to be included in form submissions, comparing it against the cookie value."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "1c76c085-7d5e-45c6-8dd3-53b27a86c033",
        "source": "owasp_wstg",
        "question": "Why might a developer choose to use the wss:// URI scheme instead of the ws:// URI scheme when implementing WebSockets in a web application?",
        "choices": [
            "A: To avoid the overhead of handling the initial upgrade handshake over HTTP.",
            "B: Because ws:// guarantees better performance by utilizing a faster, unencrypted TCP connection.",
            "C: To ensure that the communication is encrypted and the confidentiality and integrity of the data are maintained.",
            "D: As a means to bypass the need for verifying the Origin header in the WebSocket handshake."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "URI Scheme"
    },
    {
        "id": "720da598-d60c-431d-aff2-5baad3f4bb4f",
        "source": "windows_security",
        "question": "In a Windows environment, an administrator has made changes to the Kerberos authentication policy. Which of the following could be a direct consequence of this action?",
        "choices": [
            "A: The default ticket-granting ticket (TGT) expiration time may be modified, affecting session durations.",
            "B: Changes to file system permissions on target resources will be immediately applied to all users.",
            "C: The system will perform automatic updates more frequently to ensure compliance with the new policy.",
            "D: Network protocols other than Kerberos, such as NTLM, will be disabled as a result of the policy change."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Kerberos Policy"
    },
    {
        "id": "5005e8be-0d28-44d1-9ea0-90cf99350460",
        "source": "owasp_wstg",
        "question": "Consider the following Java code snippets from a web application using an ORM layer for database operations. Select the code examples that correctly implement prepared statements to mitigate ORM Injection risks:",
        "choices": [
            "A: List results = session.createQuery(\"from Orders as orders where orders.id = \" + currentOrder.getId()).list();",
            "B: Query hqlQuery = session.createQuery(\"from Orders as orders where orders.id = ?\");\nList results = hqlQuery.setString(0, currentOrder.getId()).list();",
            "C: List results = session.createQuery(\"Select * from Books where author = '\" + book.getAuthor() + \"'\").list();",
            "D: List results = session.createSQLQuery(\"Select * from Users where username = :username\")\n.setParameter(\"username\", user.getUsername()).list();"
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "ORM Injection"
    },
    {
        "id": "21d5dd57-d1c0-4cea-a08b-192e6d4c4063",
        "source": "cs161_textbook",
        "question": "A development team is implementing a password storage system for their high-traffic web application. Considering the concepts of secure password hashing, which of the following approaches should the team implement to ensure both the security of hashed passwords and efficient performance during user authentication?",
        "choices": [
            "A: Use a unique salt for each user's password hash and store it in plaintext along with the hash in the database to prevent amortized guessing attacks.",
            "B: Choose a cryptographic hash function that is inherently slow, such as SHA256, to ensure that offline password guessing is less efficient.",
            "C: Iteratively apply a fast cryptographic hash function a number of times to create a slow hash function, tuning the number of iterations for an optimal balance between security and performance.",
            "D: Increase the complexity of passwords required by users to include a mix of upper and lower case letters, numbers, and special characters, thereby making the password hashing process slow."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "password hashing"
    },
    {
        "id": "9a80376e-b326-4f9d-ba42-f48f9b4097c1",
        "source": "windows_security",
        "question": "In a Windows environment, modifying security policy settings can have significant impacts on system security. What could be a potential consequence of enabling the 'Interactive logon: Display user information when the session is locked' policy?",
        "choices": [
            "A: It may increase the risk of shoulder surfing attacks as it provides user information on a locked screen.",
            "B: It will disable the requirement for users to enter their passwords when unlocking their sessions.",
            "C: It will hide all user information on the sign-in screen, including the last signed-in user name.",
            "D: It will encrypt the user name displayed on the locked screen, providing added security."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Shoulder surfing attack"
    },
    {
        "id": "f81c42b9-9d55-43d0-8682-6abc2509a98d",
        "source": "attck",
        "question": "A cybersecurity analyst observes unusual network traffic indicative of a potential compromise on a company's server. Upon closer inspection, the analyst discovers that an unauthorized entity is attempting to gather information about the server's environment. Which of the following actions is the entity MOST likely trying to perform based on known adversary techniques?",
        "choices": [
            "A: Attempting to obtain the server’s MAC address, OS version, and CPU information.",
            "B: Trying to install a new, legitimate version of the server's operating system.",
            "C: Establishing a new user account with administrative privileges for later use.",
            "D: Encrypting server files to prepare for a ransomware demand."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Information Gathering"
    },
    {
        "id": "97109a9e-c909-48ba-926a-d0a5d4d2311e",
        "source": "owasp_mastg",
        "question": "A developer is working on an Android application that requires storing files with sensitive data. Which of the following code practices should be avoided to ensure the security of the stored data?",
        "choices": [
            "A: Using `openFileOutput(FILENAME, Context.MODE_PRIVATE)` to write sensitive data to internal storage.",
            "B: Saving sensitive data in external storage without additional security measures due to its world-readable nature.",
            "C: Encrypting the Realm database contents with a key obtained from the server or a password-derived KeyStore.",
            "D: Storing sensitive information using `MODE_WORLD_READABLE` or `MODE_WORLD_WRITEABLE` modes, which are deprecated and insecure."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "MODE_WORLD_READABLE"
    },
    {
        "id": "73cd727b-6889-4a5e-a00f-c89617305a74",
        "source": "cwe",
        "question": "A Java class 'BankAccount' has methods 'deposit' and 'withdraw' which are not synchronized. Multiple threads are accessing these methods concurrently. Which of the following options best ensures that race conditions are prevented when modifying the account balance?",
        "choices": [
            "A: Declare the 'accountBalance' variable as volatile to ensure visibility of its updates.",
            "B: Use a synchronized block within the 'deposit' and 'withdraw' methods to lock the 'accountBalance' object.",
            "C: Apply the synchronized modifier to the method signatures of 'deposit' and 'withdraw'.",
            "D: Introduce a ReentrantLock and use it to wrap the code that modifies the 'accountBalance' in the 'deposit' and 'withdraw' methods."
        ],
        "answer": "CD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Synchronization"
    },
    {
        "id": "4e38d090-4e50-49e4-b447-a00e45a213b3",
        "source": "windows_security",
        "question": "In the context of system administration, you are tasked with using PowerShell to retrieve a list of XML data name elements from <EventData> in Windows Event logs. Which PowerShell command would you use to accomplish this task, and what is a common misstep to avoid?",
        "choices": [
            "A: Use the Get-EventLog cmdlet with the -List parameter and avoid using the -Newest parameter as it does not target XML data elements specifically.",
            "B: Employ the Get-WinEvent cmdlet with the -FilterXml parameter while ensuring not to use the Select-Xml cmdlet as it is not intended for event log analysis.",
            "C: Invoke the Select-Xml cmdlet on the event log files and ensure you do not confuse it with the Get-WinEvent cmdlet, which cannot parse XML data.",
            "D: Utilize the ConvertTo-Xml cmdlet directly on the <EventData> section and be cautious not to use the Export-Clixml cmdlet as it is used for exporting PowerShell objects into XML files."
        ],
        "answer": "",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Get-WinEvent"
    },
    {
        "id": "30cfae98-b024-49b0-8676-595d03799f78",
        "source": "cs161_textbook",
        "question": "A security engineer is evaluating a pseudorandom number generator (pRNG) for use in a cryptosystem that will generate both secret keys and initialization vectors (IVs) for symmetric encryption. Which of the following properties should the engineer ensure the pRNG possesses to prevent an attacker, who might learn the internal state after some output has been generated, from deducing the value of previously generated secret keys?",
        "choices": [
            "A: Deterministic output",
            "B: Rollback resistance",
            "C: High entropy source",
            "D: Stateless output generation"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "rollback resistance"
    },
    {
        "id": "250924e2-7f95-4c34-afa5-53aa9676a569",
        "source": "cwe",
        "question": "In the process of software development, maintaining multiple functions with identical code can have several impacts on security maintenance. Which of the following best explains why this practice may negatively affect the security of a software product?",
        "choices": [
            "A: Redundant code can make the codebase easier to read, thereby increasing the chances of detecting and fixing vulnerabilities.",
            "B: Having multiple copies of the same code can lead to inconsistencies if a vulnerability is fixed in one location but not in others.",
            "C: Duplicate code blocks can improve performance by distributing the computational load, indirectly enhancing security by reducing processing time.",
            "D: Identical functions across the codebase ensure uniform behavior, which simplifies security testing and reduces the likelihood of vulnerabilities."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "RedundantCodeImpact"
    },
    {
        "id": "f7fc8a67-ce56-4449-8734-7b7ecf0ef662",
        "source": "apple_platform_security",
        "question": "A developer is implementing a digital key system for vehicles, utilizing secure communication protocols and key management processes. Which of the following statements are correct regarding the security measures and protocols used in such a system?",
        "choices": [
            "A: The secure pairing channel is established using the SPAKE2+ protocol with the NIST P-256 curve during the owner pairing process.",
            "B: For NFC transactions, a secure channel is established by generating ephemeral key pairs on both the reader and the iPhone.",
            "C: During key sharing, the owner’s paired iPhone uses the Apple IDentity Service to send an encrypted invitation, ensuring end-to-end encryption.",
            "D: Keys on lost or stolen devices can be permanently restored on a new device without requiring new pairing or sharing."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Digital Key Security"
    },
    {
        "id": "b9d8faf0-a1ab-4c6a-b493-1ef59cf35eb4",
        "source": "cwe",
        "question": "Considering the operational technology (OT) vulnerabilities discovered in the OT:ICEFALL study, what could be the potential consequences of using hard-coded cryptographic keys in OT products? Select all applicable answers.",
        "choices": [
            "A: Hard-coded cryptographic keys may allow adversaries to decrypt sensitive data, leading to a breach of confidentiality.",
            "B: Using hard-coded cryptographic keys could result in a more secure system as the key is never transmitted over the network.",
            "C: Adversaries could exploit hard-coded keys to alter the behavior of OT products, potentially causing physical harm.",
            "D: Hard-coded cryptographic keys can streamline system maintenance by reducing the complexity of key management."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "OTVulnerability"
    },
    {
        "id": "64147f43-fab2-4d78-bcc9-a47d5266fdac",
        "source": "owasp_mastg",
        "question": "In an OAuth 2.0 implementation, what is the recommended practice for handling access tokens and client secrets within a mobile application to enhance security?",
        "choices": [
            "A: Access tokens should be stored in secure local storage and have unlimited duration to ensure uninterrupted service to the user.",
            "B: Client secrets should be widely used to prove the client's identity and should be embedded in the application code for easy access.",
            "C: Access tokens must be kept in transient memory and transmitted over an encrypted connection, and client secrets should not be used to prove the client's identity.",
            "D: Refresh tokens should be kept in transient memory, while access tokens should be stored permanently to prevent frequent re-authentication."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Access Token"
    },
    {
        "id": "ea569ad5-39e2-4506-8baa-58c16e265e72",
        "source": "cs161_textbook",
        "question": "Why would a decentralized digital cryptocurrency like Bitcoin ensure that a user cannot impersonate another and perform transactions as them, without involving a centralized authority?",
        "choices": [
            "A: Because a decentralized system inherently prevents any form of identity theft or impersonation.",
            "B: Because Bitcoin uses cryptographic techniques to verify the identity of users and the authenticity of transactions.",
            "C: Because all users must physically meet to confirm each other's identities before transacting.",
            "D: Because a centralized cryptocurrency exchange monitors and prevents unauthorized access to user accounts."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "Identity Verification"
    },
    {
        "id": "ce4bbd31-e142-4f80-a29b-9b992cf656ce",
        "source": "android_sec_doc",
        "question": "Why is it necessary for ConfirmationUI to work in conjunction with Keymaster when generating confirmation tokens in the Android Protected Confirmation process?",
        "choices": [
            "A: Because ConfirmationUI alone cannot guarantee the cryptographic security of the confirmation tokens without the hardware-backed security provided by Keymaster.",
            "B: Because ConfirmationUI is responsible for the user interface, while Keymaster is only used to store and manage encryption keys unrelated to confirmation tokens.",
            "C: Because Keymaster generates the messages for user confirmation, while ConfirmationUI only displays them without creating any cryptographic statements.",
            "D: Because ConfirmationUI and Keymaster are redundant systems, and only one of them is actually necessary for the generation of confirmation tokens."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Confirmation Token"
    },
    {
        "id": "30f114d9-f96d-4297-973d-9458cf3521c1",
        "source": "apple_platform_security",
        "question": "Considering the security mechanisms described for iMessage's encryption and key management, which of the following actions are performed when a user begins a new conversation on iMessage? Select all that apply.",
        "choices": [
            "A: The device contacts Apple IDentity Service (IDS) to retrieve the public keys and APNs addresses for all devices associated with the recipient.",
            "B: The message is encrypted using the recipient's public RSA 1280-bit key before being sent.",
            "C: A new set of encryption and signing keys are generated on the sender's device for each message.",
            "D: The sender's private signing key is used to sign a SHA-1 hash of the message and the encrypted message key."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "iMessage"
    },
    {
        "id": "7163c99a-419c-4183-aee7-ba9014b6171a",
        "source": "apple_platform_security",
        "question": "What are the intended security benefits and potential consequences of setting a Firmware Password on Intel-based Mac computers that are equipped with an Apple T2 Security Chip?",
        "choices": [
            "A: It prevents booting from unauthorized volumes or into alternative boot modes like Single User Mode.",
            "B: It is designed to prevent rollback attacks by ensuring that only signed versions of macOS can be installed.",
            "C: A firmware password reset mechanism requires AppleCare assistance, ensuring that only authorized users can reset it.",
            "D: Setting the -disable-reset-capability option may lead to the cost of logic board replacement if the password is forgotten."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "FirmwarePassword"
    },
    {
        "id": "bf6293ee-4ac1-42eb-a12d-1e7759a65270",
        "source": "windows_security",
        "question": "A company is planning to enhance their data security by utilizing cloud security features of their Windows-based systems. Which of the following features should they consider implementing to improve their security posture?",
        "choices": [
            "A: Automated patch management for cloud-based services",
            "B: Physical biometric locks for data center access control",
            "C: Real-time threat intelligence and analytics",
            "D: Decentralized file storage with blockchain technology"
        ],
        "answer": "",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Patch Management"
    },
    {
        "id": "4ce932e9-3a7b-436c-95c2-e7117e63e876",
        "source": "cs161_textbook",
        "question": "You are designing a secure system to mitigate buffer overflow attacks. Considering the defense mechanism of non-executable pages, which of the following strategies would effectively prevent an attacker from executing injected code? Select all that apply.",
        "choices": [
            "A: Implementing a W^X policy to ensure that any writable page in memory is not executable.",
            "B: Allowing certain pages to be both writable and executable if they are used frequently by the program.",
            "C: Enforcing Data Execution Prevention (DEP) to stop execution of code in non-designated areas of memory.",
            "D: Setting the NX bit to 'no-execute' on all pages to completely prevent the execution of any code."
        ],
        "answer": "AC",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "Non-executable pages"
    },
    {
        "id": "a1c55e1a-4c9e-4434-9841-7354aeda3586",
        "source": "owasp_wstg",
        "question": "You are conducting a security test on a new web application that has implemented role-based access control (RBAC). The application includes roles such as administrator, auditor, support engineer, and customer. During your testing, you find that a support engineer is able to modify user permissions, a task typically reserved for administrators. Which of the following findings is likely to be true?",
        "choices": [
            "A: The granularity of the roles is appropriate, and the support engineer requires this permission to perform their job effectively.",
            "B: There is a potential misconfiguration in the RBAC setup that allows the support engineer more permissions than necessary.",
            "C: The application does not have an RBAC implementation, and role permissions are not defined.",
            "D: The support engineer's ability to modify permissions is an intended functionality for all users, indicating flat access control rather than RBAC."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Role-Based Access Control (RBAC)"
    },
    {
        "id": "fa48e00e-72cf-4d13-8f14-2baec109355e",
        "source": "apple_platform_security",
        "question": "In an e-commerce mobile application that supports Apple Pay, the development team is tasked with implementing a payment system that adheres to Apple's security protocols. Which of the following steps should the team take to ensure transaction security and data integrity based on Apple Pay's described mechanisms?",
        "choices": [
            "A: Encrypt the payment credential with an Apple-specific key to ensure that only Apple servers can decrypt and process the payment information.",
            "B: Store the full credit or debit card numbers on the device to facilitate faster transaction processing and improve user convenience.",
            "C: Use a transaction-specific dynamic security code along with the Device Account Number when processing payments, without sharing full card numbers with merchants.",
            "D: Implement a system that allows the payment to be authorized without user authentication to streamline the payment process and enhance user experience."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "PaymentSecurity"
    },
    {
        "id": "736d01a1-635c-4e13-b20f-83b3a8c3336f",
        "source": "cwe",
        "question": "Review the following code snippets and identify which one appropriately handles encryption of sensitive data to prevent unauthorized access. (Select all that apply.)",
        "choices": [
            "A: function saveUserData($username, $password) { $encryptedPassword = encryptPassword($password); $data = array('username' => $username, 'password' => $encryptedPassword); saveToSecureStorage($data); }",
            "B: persistLogin($username, $password) { $data = json_encode(array('username' => $username, 'password' => $password)); setcookie('userdata', base64_encode($data)); }",
            "C: try { SSLContext sc = SSLContext.getInstance('TLS'); sc.init(null, null, new java.security.SecureRandom()); urlConnection = (HttpsURLConnection) new URL('https://api.example.com').openConnection(); urlConnection.setSSLSocketFactory(sc.getSocketFactory()); //... } catch (Exception e) { // Handle exception }",
            "D: writeUserData($user) { file_put_contents('/secure/location/userdata.txt', serialize($user)); }"
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CodeEncryption"
    },
    {
        "id": "f5b58659-3b6c-4011-9372-c2d504367aa0",
        "source": "owasp_wstg",
        "question": "A software development team is working on a containerized microservice that will be deployed on a Kubernetes cluster. They need to choose an appropriate naming scheme for identifying the vulnerabilities and configurations of this microservice. Which vulnerability naming schemes would be most suitable for this scenario?",
        "choices": [
            "A: Package URL (PURL) or Software Identification Tag (SWID)",
            "B: Common Platform Enumeration (CPE) or Common Vulnerabilities and Exposures (CVE)",
            "C: Software Identification Tag (SWID) or Common Vulnerabilities and Exposures (CVE)",
            "D: Common Platform Enumeration (CPE) or Package URL (PURL)"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Vulnerability Naming Schemes"
    },
    {
        "id": "d97a4d69-da40-41b6-aaff-ebeabd6248f9",
        "source": "apple_platform_security",
        "question": "How does Apple Watch maintain secure operations when it is out of Bluetooth range of the paired iPhone?",
        "choices": [
            "A: It connects directly to iCloud and Gmail servers to fetch Mail without syncing data over the internet with the paired iPhone.",
            "B: It uses a local cache of previously accessed data to function until the iPhone is back in range.",
            "C: It automatically joins Wi-Fi networks that have been previously joined on the paired iPhone using credentials synced while both devices were in range.",
            "D: The Apple Watch switches to an offline mode where only local apps and data can be accessed until reconnection."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "ConnectivitySecurity"
    },
    {
        "id": "2e4273a6-0178-4c96-a29c-de5954857e3f",
        "source": "attck",
        "question": "A cybersecurity team has identified an incident where an adversary gained initial access and maintained communication with a victim's system by manipulating network traffic to deliver malicious payloads. The adversary injected content by intercepting legitimate client-server communications and sending fake responses to the client's requests. Which of the following best describes the tactics employed by this adversary?",
        "choices": [
            "A: Initial Access and Command and Control",
            "B: Privilege Escalation and Defense Evasion",
            "C: Credential Access and Discovery",
            "D: Exfiltration and Impact"
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Content Injection"
    },
    {
        "id": "cca7be5c-42b8-4e47-b7ee-90ce342a4bcd",
        "source": "cwe",
        "question": "A system architect is designing a new embedded system. To simplify the code and improve execution speed, they propose hard-coding the addresses of frequently used functions into the system's firmware. As a security consultant, you are tasked with evaluating this design decision. What arguments could you put forward against using fixed memory addresses for function pointers in the system's firmware?",
        "choices": [
            "A: Hard-coding addresses can make the system's firmware more efficient by reducing lookup times.",
            "B: Using fixed addresses in firmware may result in incompatibility with future hardware revisions or different models.",
            "C: Fixed addresses simplify the debugging process by providing a consistent reference for error reporting.",
            "D: Assigning static addresses in firmware could be exploited by attackers to execute arbitrary code if they gain access to those memory locations."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Firmware"
    },
    {
        "id": "a4f9f371-24df-44e5-9477-f518c29ff2e8",
        "source": "apple_platform_security",
        "question": "An IT administrator at a software company is tasked with migrating their macOS-based infrastructure from kernel extensions (kexts) to system extensions built with DriverKit. What are the expected advantages of completing this migration?",
        "choices": [
            "A: System extensions and drivers built with DriverKit run in user space, enhancing system stability.",
            "B: Drivers built with DriverKit require administrator privileges for installation.",
            "C: System extensions are automatically removed when the app is uninstalled, improving security and maintenance.",
            "D: Kernel extensions greatly reduce the possibility of kernel panics compared to system extensions."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Migration"
    },
    {
        "id": "fc98dcbd-fd14-4c6a-a007-90d4722e6d07",
        "source": "apple_platform_security",
        "question": "An administrator is using Apple Configurator for Mac to manage various devices within their organization. Considering the security protocols entailed by the application, identify the rationale behind specific procedures:",
        "choices": [
            "A: Files containing the latest minor updates are deleted after a successful revive or restore to prevent unauthorized access and tampering.",
            "B: Users have a 30-day provisional period to release the device from Apple School Manager, Apple Business Manager, or Apple Business Essentials to allow for flexibility in device management.",
            "C: Apple Configurator allows inspection and usage of operating system files post-restore to facilitate custom configurations by the administrator.",
            "D: Activation Lock requirements can be bypassed for convenience during large-scale device setups."
        ],
        "answer": "AB",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "SecurityMeasures"
    },
    {
        "id": "419eaba4-9bb4-4fdc-b9d0-b807c4a7cb44",
        "source": "mit6.858",
        "question": "In the OKWS system, each service is identified with a unique 20-byte token to communicate with the dbproxy. Analyze the security design related to these 20-byte tokens. Which of the following statements accurately reflect the pros and cons or potential vulnerabilities associated with this token system?",
        "choices": [
            "A: If a service's token is disclosed, an attacker can immediately make unauthorized queries to the database using the compromised service's identity.",
            "B: The tokens are supplied in RPC when services communicate with dbproxy, mitigating the risk of SQL injection by limiting direct SQL query access.",
            "C: A disclosed token does not pose an immediate problem, but if any service is compromised, the attacker can exploit the token to access users' data related to that service.",
            "D: The token system is ineffective because an attacker can easily guess the 20-byte token due to its insufficient length and complexity."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "TokenSystem"
    },
    {
        "id": "c6e4411d-56c5-4f0c-a0c0-3153cca22e4e",
        "source": "cs161_textbook",
        "question": "When evaluating the use of AES-EMAC versus alternative MAC algorithms for securing a web application's communications, which of the following considerations are valid? Select all that apply.",
        "choices": [
            "A: AES-EMAC's use of two different AES keys might complicate key management compared to algorithms that use a single key, potentially increasing the risk of key mismanagement.",
            "B: The simplified nature of AES-EMAC compared to AES-CMAC suggests that it may have a reduced security level, which could be a concern for highly sensitive data transactions.",
            "C: Due to the provably secure nature of AES-EMAC when assuming AES is a secure block cipher, it provides a strong guarantee against tag forgery, desirable for preventing message tampering.",
            "D: The computational efficiency of AES-EMAC could be less than that of other schemes that do not use block ciphers, which might affect the performance in high-throughput scenarios."
        ],
        "answer": "ACD",
        "topics": [],
        "keyword": "Design Considerations"
    },
    {
        "id": "f2960f08-2d06-4861-bb99-8c19c01a1c49",
        "source": "apple_platform_security",
        "question": "What are the advantages of the security measures employed by Apple for iOS and iPadOS applications, and which counterargument can be presented against the claim that iOS and iPadOS apps could compromise system security? (Select all that apply)",
        "choices": [
            "A: Sandboxing increases security by isolating apps, preventing them from accessing system resources and other apps' data.",
            "B: Mandatory app code signing may limit the diversity of apps, as it requires developers to obtain an Apple-issued certificate.",
            "C: App notarisation by Apple for internet-downloaded apps on macOS but not on iOS and iPadOS can be seen as a less restrictive approach.",
            "D: The App Store review process for iOS and iPadOS apps ensures that they operate as intended and do not contain malicious code."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "iOS/iPadOS App Security"
    },
    {
        "id": "4086a8ad-f5b4-4d25-a243-3e52d801f878",
        "source": "apple_platform_security",
        "question": "A healthcare organization is planning to implement an encryption strategy to protect patient data. Which of the following actions should be taken to ensure effective encryption and data protection? (Select all that apply)",
        "choices": [
            "A: Use of strong, industry-standard encryption algorithms to safeguard data at rest and in transit.",
            "B: Implementing encryption only for data classified as sensitive, leaving other data unencrypted to save on resources.",
            "C: Ensuring that encryption keys are stored securely and access to them is strictly controlled.",
            "D: Using the same encryption key across all systems to simplify key management."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "30743e53-b9e9-421f-8f99-0dc49fe2e905",
        "source": "attck",
        "question": "An adversary is attempting to execute a malicious payload within a company's network undetected. The adversary decides to use a technique that involves allocating and executing payloads directly within the memory of a legitimate process, avoiding the creation of any files on disk. Which of the following best describes the technique the adversary is using to execute the payload and its primary benefit?",
        "choices": [
            "A: Reflective code loading to avoid anti-virus detection by executing payloads in memory rather than on disk.",
            "B: Cross-site scripting to exploit web application vulnerabilities and steal session cookies.",
            "C: SQL injection to execute arbitrary SQL commands and manipulate database contents.",
            "D: Phishing attack to deceive employees into providing sensitive information."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Reflective Code Loading"
    },
    {
        "id": "da9aed39-5ffb-4f59-8c8c-b6c4cb2ddf4b",
        "source": "apple_platform_security",
        "question": "You are setting up a secure environment for a company's macOS and iOS devices. Your task is to configure data protection settings to ensure security and accessibility according to the company's policy. The company requires that file encryption keys must be accessible when any user is logged in, data must remain protected after a reboot until the user first logs in, and the system should support fast remote wipe capabilities. Which of the following configurations should be applied?",
        "choices": [
            "A: Use NSFileProtectionCompleteUnlessOpen for macOS and NSFileProtectionCompleteUntilFirstUserAuthentication for iOS devices.",
            "B: Apply NSFileProtectionCompleteUntilFirstUserAuthentication for all third-party app data on macOS devices.",
            "C: Implement NSFileProtectionNone for data that requires fast remote wipe capabilities.",
            "D: Configure the default data protection class to NSFileProtectionComplete for all macOS volumes not corresponding to a booted operating system."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Data Protection"
    },
    {
        "id": "45303985-3079-47a1-bea7-c2b7c02cafa9",
        "source": "apple_platform_security",
        "question": "Consider a scenario where an app developer is implementing Apple Pay for in-app purchases. The developer needs to ensure that the payment process is secure and that the payment information is correctly handled and transmitted. Which of the following steps should the developer follow to ensure a secure transaction? (Select all that apply)",
        "choices": [
            "A: The developer must obtain a cryptographic nonce from Apple Pay servers when the user authorizes the payment.",
            "B: The app must pass the encrypted payment credential to the merchant's system without any form of decryption or re-encryption.",
            "C: The developer should specify supported Merchant IDs in the app entitlements to ensure that the APIs are correctly entitled.",
            "D: The app can include additional data (e.g., customer identity) that is not hashed or signed, as it has no impact on transaction security."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "ApplePay"
    },
    {
        "id": "6e982709-2d89-4711-b50d-4174a18555fd",
        "source": "attck",
        "question": "A penetration tester is analyzing a compromised system to determine which type of malware may have been used based on the information gathered. The system shows evidence of the hostname, domain, IP address, operating system version, and system volume information being transmitted to an unrecognized external command and control server. Which of the following malware types has the capability to collect and exfiltrate this specific set of system information?",
        "choices": [
            "A: BoomBox and build_downer",
            "B: Caterpillar WebShell and DEATHRANSOM",
            "C: CaddyWiper and Ferocious",
            "D: CharmPower and CARROTBAT"
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "malware enumeration capabilities"
    },
    {
        "id": "17fea1ac-e986-493f-8f2d-ecb922c75adf",
        "source": "apple_platform_security",
        "question": "What are the security implications of Sealed Key Protection (SKP) on an Apple device with an Apple-designed SoC when faced with brute-force attacks or unauthorized operating system manipulations?",
        "choices": [
            "A: SKP prevents the KEK from being accessed on another medium in the event of brute-force attacks by sealing it with measurements of the system's software.",
            "B: If an attacker modifies measured firmware, software, or security configurations, it leads to a different SMRK value and breaks the seal on the key hierarchy.",
            "C: SKP is supported by the Secure Enclave and prevents manipulation of operating system versions or security settings without appropriate user authorization.",
            "D: SKP ensures that the SMDK is accessible only when the hardware registers' measurements match those of a normal boot, thwarting unauthorized system changes."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "SealedKeyProtection"
    },
    {
        "id": "a34bfa90-5116-48c7-a78c-5b703720c376",
        "source": "owasp_wstg",
        "question": "A web application allows users to customize page styles by submitting their own CSS code snippets. Which of the following scenarios represents a potential security vulnerability that should be mitigated?",
        "choices": [
            "A: A user provides a CSS snippet that changes the color scheme of their user profile page using standard CSS properties.",
            "B: A user submits a CSS snippet that includes a `background-image` URL, which is used to try to exfiltrate CSRF tokens.",
            "C: The application restricts users to a predefined set of CSS classes to style their content, without allowing custom CSS properties.",
            "D: A user supplies a CSS snippet that uses the `::after` pseudo-element to add cosmetic content after certain elements."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSS Injection"
    },
    {
        "id": "3d4e2788-8952-47c0-9c96-c7185c5c3416",
        "source": "android_sec_doc",
        "question": "In Android Keymaster, a private key is configured with the `TAG::USER_SECURE_ID` but without additional authentication tags. What does this indicate about the key's usage and what are the potential trade-offs?",
        "choices": [
            "A: The key can be used without user authentication, and the trade-off is increased usability at the expense of security.",
            "B: User authentication is required for every use of the key, offering higher security but potentially reducing convenience.",
            "C: The key is restricted to a single user but does not require authentication, which simplifies access but may allow unauthorized use if the device is compromised.",
            "D: The key will only operate during a specified timeout period after user authentication, balancing security with usability."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "User Authentication"
    },
    {
        "id": "fd8a9dac-a3d5-491e-90d4-73274548e409",
        "source": "attck",
        "question": "An organization's security team is reviewing its network monitoring strategy to improve the detection of command and control (C2) communications. They are considering the risks associated with not actively monitoring certain types of network traffic. Given the known techniques employed by adversaries, which of the following protocols should the security team prioritize for monitoring to effectively detect C2 activity? (Select TWO.)",
        "choices": [
            "A: Internet Control Message Protocol (ICMP)",
            "B: Hypertext Transfer Protocol Secure (HTTPS)",
            "C: User Datagram Protocol (UDP)",
            "D: Simple Mail Transfer Protocol (SMTP)"
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "C2 communications"
    },
    {
        "id": "4a0e751e-8afa-46d5-9017-b224a55ea16c",
        "source": "attck",
        "question": "Which of the following scenarios best illustrates an ADVANTAGE of using the `Arp` command over `ping` for discovering remote systems in a network?",
        "choices": [
            "A: When the adversary needs to distinguish between active and inactive devices through response analysis.",
            "B: To display a host's ARP cache, including address resolutions for remote systems, without generating additional network traffic.",
            "C: For probing external networks where the adversary does not have local network access.",
            "D: To execute a stealthy port scanning against a target machine to discover open ports."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "ARP Cache"
    },
    {
        "id": "da4d38d7-72e5-4820-bae6-5fcd75929b05",
        "source": "android_sec_doc",
        "question": "You are configuring a new Android device and want to ensure the security of SUID programs. Which of the following practices should you apply? (Select two)",
        "choices": [
            "A: SUID programs should be made writable by system UID to allow system processes to modify them when necessary.",
            "B: SUID processes must not offer a shell or backdoor that could be used to bypass the Android security model.",
            "C: SUID programs must be executable by all users to prevent privilege escalation issues.",
            "D: SUID programs should not be world readable or executable and access should be limited to a specific group."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SUID Security"
    },
    {
        "id": "0a9cf3d0-7c14-42ec-ba3b-2604670594eb",
        "source": "windows_security",
        "question": "A company is implementing Windows Hello for Business to enhance their authentication processes. In which scenario would this form of authentication NOT be the optimal choice?",
        "choices": [
            "A: The company requires strong, multi-factor authentication for accessing sensitive financial records.",
            "B: Employees need to authenticate on shared devices without the necessity of carrying physical tokens or smart cards.",
            "C: The organization's policy mandates the use of hardware-backed credentials for remote desktop sessions.",
            "D: The organization has a legacy infrastructure that solely relies on traditional username and password authentication with no capacity for biometric or PIN-based credentials."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Authentication Methods"
    },
    {
        "id": "31c82208-d599-4ff1-98cd-08a1e61d7711",
        "source": "android_sec_doc",
        "question": "Consider an encrypted Android device where `vold` detects an error during the decryption process and `vold.decrypt` property is not successfully set to `trigger_restart_framework`. What is the NEXT step that `vold` is expected to take according to the encryption process?",
        "choices": [
            "A: `vold` waits indefinitely for the property `vold.decrypt` to change, ensuring that no further actions are taken without proper decryption.",
            "B: `vold` sets the property `vold.post_fs_data_done` to 1, assuming the decryption process was completed successfully.",
            "C: `vold` sets the property `vold.encrypt_progress` to `error_reboot_failed` and expects the UI to display a reboot message to the user.",
            "D: `vold` sets the property `vold.decrypt` to `trigger_default_encryption` to bypass the decryption process and boot the device."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "vold.encrypt_progress"
    },
    {
        "id": "b2d86a9f-a977-46fc-b7b2-a170aab49b9c",
        "source": "attck",
        "question": "A cybersecurity analyst suspects that an adversary may have installed a malicious browser extension on several company computers to maintain persistence. What methods should the analyst use to detect the presence of unauthorized browser extensions? (Choose two.)",
        "choices": [
            "A: Monitor for unusual outbound network traffic patterns to untrusted hosts.",
            "B: Scan for the presence of unauthorized mobile apps on user devices.",
            "C: Review the Windows Registry for unexpected keys that correlate with browser extension installation.",
            "D: Examine the system logs for unauthorized use of data encryption tools."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Malicious Extension Detection"
    },
    {
        "id": "473fc1eb-e53e-4f51-89a4-2488104fffe0",
        "source": "cwe",
        "question": "You are tasked with securing an application that executes external programs. Which of the following strategies would be most effective in preventing an unquoted search path vulnerability, and why?",
        "choices": [
            "A: Using a denylist to filter out known bad paths and inputs before executing a program.",
            "B: Implementing allowlist input validation to ensure only pre-approved paths and inputs are accepted.",
            "C: Encoding all input paths before execution without further validation.",
            "D: Applying strict type constraints on all input fields without considering the path structure."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "74534f48-9c84-475b-b9f4-1ac4217775a8",
        "source": "attck",
        "question": "In a given scenario, a penetration tester has identified a series of malware infections on a network. Which of the following methods of data exfiltration is least likely to be employed by the malware, considering the prevalent tactics of data exfiltration to C2 servers as observed in real-world incidents?",
        "choices": [
            "A: Utilizing HTTP POST requests to send stolen data over C2 channels.",
            "B: Sending stolen data over a dedicated FTP channel, separate from the C2 communication.",
            "C: Exfiltrating data using DNS queries to transfer files to the C2 server.",
            "D: Uploading stolen files to SMB shares that are also used in the C2 process."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Data Exfiltration"
    },
    {
        "id": "d9c5a048-da75-4cb4-9ab8-0b9e02d59a13",
        "source": "attck",
        "question": "Which of the following scenarios does NOT typically involve the use of Windows Management Instrumentation (WMI) by adversaries?",
        "choices": [
            "A: Remotely executing files as part of lateral movement.",
            "B: Launching a denial-of-service attack by flooding a network with excessive traffic.",
            "C: Gathering information about installed antivirus products on a host system.",
            "D: Executing backdoors at a preset time."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "WMI"
    },
    {
        "id": "0c887746-723c-4626-be56-34c3b9fb74fc",
        "source": "attck",
        "question": "Which of the following is an ineffective mitigation strategy against the interception of multi-factor authentication (MFA) mechanisms and why?",
        "choices": [
            "A: Educating users to remove smart cards when not in use, as it does not protect against real-time interception during usage.",
            "B: Using hardware token-based MFA without additional protections, assuming it is immune to interception.",
            "C: Encrypting SMS or email communications to secure one-time codes sent via out-of-band channels.",
            "D: Monitoring for unusual patterns in API calls associated with polling to intercept keystrokes."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "MFA Interception"
    },
    {
        "id": "ec39b6b0-00f0-41e9-9b71-974b85c8679f",
        "source": "apple_platform_security",
        "question": "In the context of iOS and iPadOS devices, why does the strength of a user's passcode or password directly impact the strength of encryption keys used for Data Protection? Select all that apply.",
        "choices": [
            "A: A stronger passcode provides more entropy for certain encryption keys, making them more resistant to brute-force attacks.",
            "B: The passcode is entangled with the device’s UID, which increases the complexity of brute-force attempts.",
            "C: Stronger passcodes allow for quicker device unlocking, which enhances the encryption algorithm's performance.",
            "D: Using Face ID and Touch ID enables a user to establish a stronger passcode without affecting the user experience."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "EncryptionStrength"
    },
    {
        "id": "503377b3-5649-42c3-84bb-349d3154aaeb",
        "source": "apple_platform_security",
        "question": "Consider you are a security researcher with access to an Apple Security Research Device (SRD). Which of the following actions and characteristics are true about your ability to interact with the device and the differences between an SRD and a normal user device?",
        "choices": [
            "A: The SRD allows you to sideload executable code with arbitrary entitlements at the same permission level as Apple operating system components.",
            "B: The SRD can start up even when not charging, and it will not enter Recovery mode if not connected to a power source during startup.",
            "C: The SRD displays 'Security Research Device' on the Lock Screen and in the Settings app.",
            "D: The SRD allows the use of the 'research.com.apple.license-to-operate' entitlement to debug any system process but does not permit debugging of user-installed apps."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Apple Security Research Device"
    },
    {
        "id": "93cf69fb-76c1-4ece-8efc-d057969df93f",
        "source": "apple_platform_security",
        "question": "You are tasked with disabling System Integrity Protection (SIP) on a Mac with Apple silicon for development purposes. What steps must you acknowledge or take to ensure that you are able to disable SIP while understanding the security implications?",
        "choices": [
            "A: You need to enter recoveryOS and authenticate as a user with access to the LocalPolicy signing key to disable SIP.",
            "B: Disabling SIP will automatically move your Mac to the Full Security policy, ensuring maximum security despite SIP being turned off.",
            "C: You must downgrade the system to Permissive Security to disable SIP, which can only be done using command-line tools from Terminal in recoveryOS.",
            "D: To disable SIP, you can use Startup Security Utility without entering recoveryOS, as it does not require user authentication."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DisablingSIP"
    },
    {
        "id": "c140cbb2-2813-4720-83e3-5b55d72b2fef",
        "source": "attck",
        "question": "An organization experienced a cybersecurity incident where several user accounts were reported to have unauthorized password changes and status modifications. The incident response team observed multiple user log-offs and system reboots during the event. As a cybersecurity analyst, which of the following techniques would you primarily suspect the adversary implemented to disrupt the availability of system and network resources?",
        "choices": [
            "A: Performed unauthorized software installation to gain persistent access.",
            "B: Infiltrated the network to intercept and manipulate data in transit.",
            "C: Deleted or locked legitimate user accounts and manipulated credentials.",
            "D: Injected malicious code into the system's firmware."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "Vulnerability",
            "PenTest"
        ],
        "keyword": "Account Access Removal"
    },
    {
        "id": "6030da4c-c2e4-486c-80f1-492d730ed386",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating a security breach where the adversary used Microsoft Office applications for persistence. Which of the following techniques could have been utilized by the adversary for persistence, and what mitigation measure would be most effective against this specific technique?",
        "choices": [
            "A: The adversary used Office Template Macros for persistence, and enabling Attack Surface Reduction (ASR) rules would be an effective mitigation.",
            "B: The adversary employed the Office Test method for persistence, and setting Registry permissions to 'Read Control' would be an effective mitigation.",
            "C: The adversary exploited Outlook Home Page for persistence, and removing all administrative privileges from users would be an effective mitigation.",
            "D: The adversary leveraged Outlook Rules for persistence, and updating software to ensure KB3191938 is applied would be an effective mitigation."
        ],
        "answer": "ABD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Persistence Mechanisms"
    },
    {
        "id": "369b13e8-abfa-49ad-b566-2b16263e435b",
        "source": "cs161_textbook",
        "question": "Given a 32-bit system with ASLR implemented, an attacker is attempting to exploit a memory-safety vulnerability. They can either guess or leak the address required to bypass ASLR. Which of the following statements are correct concerning the attacker's strategies and the system's defenses?",
        "choices": [
            "A: An attacker can guess the correct address with a 1 in 65536 probability, as 32-bit systems often have around 16 bits of entropy for address randomization.",
            "B: ASLR randomizes both absolute and relative addresses of variables, which prevents attackers from deducing other memory addresses even if one is leaked.",
            "C: In a scenario where each attempt to guess an address takes exponentially longer after a crash, making 65536 attempts becomes infeasible.",
            "D: By leaking the absolute address of the sfp on the stack, the attacker could deduce the address of the rip, as the relative address between them is not randomized by ASLR."
        ],
        "answer": "ACD",
        "topics": [
            "MemorySafety",
            "WebSecurity"
        ],
        "keyword": "ASLR"
    },
    {
        "id": "fb0d169e-7be5-4a4e-b370-383872346b4f",
        "source": "windows_security",
        "question": "A security consultant claims that setting the 'HypervisorEnforcedCodeIntegrity' registry value to 1 on a Windows 10 version 1511 machine will enable memory integrity with UEFI lock by default. As a Windows security expert, which statement best counters this claim?",
        "choices": [
            "A: The 'HypervisorEnforcedCodeIntegrity' value does not control memory integrity; it is related to Credential Guard.",
            "B: Setting 'HypervisorEnforcedCodeIntegrity' to 1 does enable memory integrity, but it does not enforce a UEFI lock by default.",
            "C: The 'HypervisorEnforcedCodeIntegrity' registry value must be set to 3 to enable memory integrity with UEFI lock.",
            "D: On Windows 10 version 1511, the 'HypervisorEnforcedCodeIntegrity' registry setting is not available and therefore cannot be used to enable memory integrity."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "UEFI lock"
    },
    {
        "id": "ab980528-333e-49e7-8a36-5adf785bc5d3",
        "source": "mit6.858",
        "question": "Select the actions that contribute to the goals of security architecture, which include defending against a broad class of attacks, preventing as-yet-unknown attacks, and containing damage from successful attacks.",
        "choices": [
            "A: Implementing a perimeter defense with firewalls for internal network security.",
            "B: Utilizing virtual machines to provide isolation between different activities.",
            "C: Applying patches reactively to known vulnerabilities.",
            "D: Enforcing access control lists (ACLs) and capabilities for authorization."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "security architecture"
    },
    {
        "id": "7e736966-289e-4133-9262-e81969f2bcca",
        "source": "apple_platform_security",
        "question": "As a developer, you are updating an existing iOS application to enhance its network communication security. You need to ensure the application adheres to Apple's recommended standards for network security and secure data transmission. Which of the following actions should you take? (Select all that apply)",
        "choices": [
            "A: Implement support for TLS 1.3 using Network.framework and NSURLSession APIs.",
            "B: Enable RC4 cipher suites in your application to ensure compatibility with older network services.",
            "C: Disallow SSL 3 connections in line with Apple's security standards for apps using WebKit.",
            "D: Ensure all certificates issued after 15 October 2018 are logged in a trusted Certificate Transparency log for TLS connections."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "NetworkSecurity"
    },
    {
        "id": "715663af-a01e-40c5-be22-91e98f4f237e",
        "source": "windows_security",
        "question": "In a Windows environment, a security event log indicates that a device was disabled. What could be a possible reason for this event to be logged?",
        "choices": [
            "A: A user with administrative privileges has manually disabled a device.",
            "B: The device has automatically entered sleep mode due to inactivity.",
            "C: A system error occurred, leading to an unexpected reboot of the device.",
            "D: A scheduled task has triggered the removal of temporary files from the system."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Event Log"
    },
    {
        "id": "65474e82-848d-4ab8-a77e-132883717644",
        "source": "cwe",
        "question": "As a security consultant, you are evaluating different design strategies for a new software deployment process. Which of the following strategies should be flagged for NOT preventing the risk of insecure preserved inherited permissions?",
        "choices": [
            "A: Implementing an access control policy that requires manual review of permissions before deployment.",
            "B: Using a script that automatically sets permissions based on a predefined least-privilege model.",
            "C: Extraction of files with default permissions followed by an automated permissions normalization process.",
            "D: Maintaining the original archive's permissions during deployment without any user notification."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DeploymentSecurity"
    },
    {
        "id": "ca83945d-955a-49bd-a017-7162004ff442",
        "source": "owasp_wstg",
        "question": "When testing a web application's login feature, which of the following parameter placements could potentially increase the application's attack surface?",
        "choices": [
            "A: Sending the 'user' and 'pass' parameters in the body of a POST request.",
            "B: Including a session identifier as an HTTP-only, secure cookie.",
            "C: Embedding a predictable session token in the query string of a URL.",
            "D: Using a custom header to transmit a one-time use token."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Attack Surface"
    },
    {
        "id": "a64e9aff-9368-4947-8e1a-26d48d1d3c71",
        "source": "mit6.858",
        "question": "Consider the design of Keybase as a plan to reduce trust in a key server. Which of the following statements accurately reflect the advantages and potential weaknesses of Keybase's approach?",
        "choices": [
            "A: Keybase clients pin others' public keys to reduce the frequency of identity checks after initial verification.",
            "B: Keybase's use of identity proofs from various services prevents the key server from forging key-to-identity records.",
            "C: Keybase ensures users never have to pay attention to 'is this the Alice you meant?' questions after the setup.",
            "D: An attacker gaining control of a user's 'proof' accounts is a potential attack vector that could undermine Keybase's security."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Keybase_Security"
    },
    {
        "id": "855c165f-b3b5-4eeb-8689-141511af8064",
        "source": "attck",
        "question": "A cybersecurity analyst observes suspicious activity on a network and identifies the use of the `ipconfig /all` command to gather network configuration information. Which of the following malware is known to use this specific command for reconnaissance?",
        "choices": [
            "A: Dtrack",
            "B: Elise",
            "C: Kessel",
            "D: Machete"
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Network Reconnaissance"
    },
    {
        "id": "7ba50534-39cb-45c9-ae5f-eb2194e6be17",
        "source": "attck",
        "question": "When configuring a security monitoring tool to detect abnormal behaviors that may indicate a software exploitation attempt, which of the following would be considered a relevant behavior to monitor?",
        "choices": [
            "A: A Command and Scripting Interpreter spawning from an office productivity application like Microsoft Word or an internet browser.",
            "B: Consistent and repetitive saving of documents within an office productivity suite.",
            "C: Increased network traffic during regular business hours.",
            "D: Routine scheduled tasks executing batch files for system backups."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Process Creation"
    },
    {
        "id": "25eb025e-29d6-4ed8-9d1a-c1faf01483e6",
        "source": "cwe",
        "question": "A developer is working on a financial application that processes highly sensitive user data. In order to enhance the security of the application, the developer must decide on a strategy to handle sensitive information in memory. Which of the following strategies would be the most secure for handling such sensitive data?",
        "choices": [
            "A: Encrypting sensitive data in memory and ensuring it is only decrypted when necessary.",
            "B: Storing all sensitive data in cleartext in memory for quick access and ease of use.",
            "C: Writing sensitive data to a temporary file on disk, then reading it back into memory when needed.",
            "D: Allocating a separate memory segment for sensitive data and scrubbing it clean after use."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "SensitiveDataMemory"
    },
    {
        "id": "b8cb36ab-fc8c-4904-9671-8d86c89a442c",
        "source": "owasp_wstg",
        "question": "A web developer is attempting to secure their site against clickjacking attacks. They decide to employ a method that would prevent the site from functioning when loaded inside a frame. Which of the following techniques would best accomplish this without relying on JavaScript, which the user may have disabled?",
        "choices": [
            "A: Using the 'X-Frame-Options' HTTP header to deny framing.",
            "B: Employing double framing to encapsulate the web page.",
            "C: Implementing a sandbox attribute in the iframe tag.",
            "D: Enabling 'designMode' in the framing page."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "X-Frame-Options"
    },
    {
        "id": "355c08d4-4ab2-4ca4-b559-4369439a1dc5",
        "source": "android_sec_doc",
        "question": "You are tasked with updating an Android app to use the new APK Signature Scheme v3.1. Your app currently targets Android 12 but intends to support future versions. You decide to rotate the app's signing key. Which of the following statements correctly describe the behavior of the app's signatures on different Android versions and the use of the `apksig` library?",
        "choices": [
            "A: Android 13 devices will use the original signer in the v3.1 block, while older versions will use the rotated signer in the v3 block.",
            "B: The `apksig` library will default to using the v3.1 signing block if the `minSdkVersion` is set to Android 13 or higher and a rotated key is provided.",
            "C: Devices running Android 12 or lower will not recognize the block ID of v3.1 and will therefore use the original signer from the v3 block, ignoring the rotated signer.",
            "D: If the app's `minSdkVersion` is set below Android 13, the `apksig` library requires a rotated key without the need for specifying the original signing key."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "APK Signature Scheme v3.1"
    },
    {
        "id": "9a76be1c-a4c0-478c-9a64-3f5ad8bd92e9",
        "source": "cwe",
        "question": "In a system design intended to securely transfer data between a public-facing web application and an internal network, which of the following features would not prevent a vulnerability associated with incorrect resource transfer between spheres?",
        "choices": [
            "A: Implementing strict input validation on the public-facing web application.",
            "B: Using an application-level gateway to mediate and monitor data transfer.",
            "C: Applying the principle of least privilege to user roles and data access.",
            "D: Storing logs of all data transferred between the public-facing application and the internal network."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Prevention"
    },
    {
        "id": "288a65c5-4c09-4e45-b8a0-82a82fa3c336",
        "source": "attck",
        "question": "In the context of a security breach, an attacker has used malware to collect the hostname and OS version of a company's servers. What could be the reason for gathering this specific information? (Select TWO.)",
        "choices": [
            "A: To tailor subsequent attack vectors that exploit specific vulnerabilities related to the OS version.",
            "B: To prepare an accurate inventory for asset management to assist the company’s IT department.",
            "C: To conduct targeted phishing attacks using personalized information such as the server's hostname.",
            "D: To improve the malware's performance by optimizing its code for the specific CPU architecture detected."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Adversary Tactics"
    },
    {
        "id": "690ce3ec-f2d0-442d-b47a-be8d1147f7be",
        "source": "windows_security",
        "question": "After a CrashOnAuditFail event, an administrator claims that the system's security posture is not compromised since the event simply indicates a routine system reboot. Which of the following is the best counterargument to this claim?",
        "choices": [
            "A: The event may indicate that the system's audit log was full, preventing further recording of auditable activities, which is a security concern.",
            "B: Such an event is routine and does not reflect on the system's security, as all systems must reboot periodically for updates.",
            "C: The event is an indication of a potential hardware malfunction, which should be the focus rather than security implications.",
            "D: This event must be ignored as it is a false positive, often triggered by benign activities and poses no real threat."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Audit Security State Change"
    },
    {
        "id": "b2ccc4b1-ef9d-4f70-a49b-871bbcc36637",
        "source": "owasp_wstg",
        "question": "A new social media platform is being developed, and the security team is tasked with designing the user registration process. The platform will be open to the public and expects a large volume of users. The security team wants to ensure that the registration process aligns with both business needs and security requirements. Given the following options, which aspects should the security team consider to ensure a secure and efficient user registration process?",
        "choices": [
            "A: Allowing multiple registrations with the same identity information to accommodate users with multiple accounts.",
            "B: Requiring proof of identity that goes beyond basic contact information, such as government-issued ID or biometric verification.",
            "C: Automatically granting system access upon meeting registration criteria to streamline the process.",
            "D: Implementing a manual vetting process for each registration to prevent fraudulent accounts, despite the expected large user base."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Identity Verification"
    },
    {
        "id": "2cad7156-2758-4eb6-9a96-7a790ed637dd",
        "source": "attck",
        "question": "An incident responder is analyzing a suspected multi-stage command and control attack. Which of the following network traffic analysis techniques would be most effective in identifying the presence of a multi-stage C2 channel? (Select TWO.)",
        "choices": [
            "A: Monitoring network traffic for repeated connections to the same trusted hosts over a short period.",
            "B: Monitoring network data for uncommon data flows, such as processes that do not normally have network communication.",
            "C: Checking for increased volumes of encrypted traffic, as it may indicate the presence of a VPN used by internal employees.",
            "D: Looking for newly constructed network connections that are sent or received by untrusted hosts."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "d979d27f-c384-4aa6-a739-e0767df9f788",
        "source": "attck",
        "question": "A company's internal audit revealed that certain certificate templates allowed users to authenticate as privileged accounts, leading to unauthorized access and potential privilege escalation. Which certificate attribute's misconfiguration is MOST likely responsible for this security breach?",
        "choices": [
            "A: The certificate's file extension being set to .pfx instead of .cer.",
            "B: The certificate’s extended key usage (EKU) values being too permissive.",
            "C: The lack of a strong encryption algorithm like AES for the certificate.",
            "D: The absence of a timestamp within the certificate's properties."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Certificate Extended Key Usage"
    },
    {
        "id": "cebad99a-395c-4436-8623-4e71342b17c0",
        "source": "attck",
        "question": "Why might simply applying more restrictive permissions to files and directories not always be an effective mitigation against adversaries modifying ACLs for malicious purposes?",
        "choices": [
            "A: Restrictive permissions can be bypassed if adversaries have physical access to the hardware.",
            "B: It could interfere with legitimate system functionality and user access requirements.",
            "C: More restrictive permissions increase the complexity of the file system, leading to performance degradation.",
            "D: This mitigation can be effective, and there are no drawbacks to implementing it."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Restrict File and Directory Permissions"
    },
    {
        "id": "90f2b0f4-d6ab-4284-8876-d95630371162",
        "source": "attck",
        "question": "You are tasked with developing a penetration testing plan against a malware sample that is known to employ anti-debugging techniques. Based on your knowledge of common practices in the field, which Windows API function would be the most secure choice for the malware to use to hinder debugging efforts during its execution?",
        "choices": [
            "A: CreateProcess",
            "B: OutputDebugStringW",
            "C: ShellExecuteW",
            "D: LoadLibrary"
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "OutputDebugStringW"
    },
    {
        "id": "e2306e2c-94d9-4c43-9e69-a427a42df9a3",
        "source": "attck",
        "question": "An organization has identified a breach where sensitive data was exfiltrated using an alternative protocol to the main command and control channel. As a security analyst, which two of the following mitigation strategies would you primarily recommend to prevent such incidents in the future?",
        "choices": [
            "A: Implement strict network segmentation to allow only necessary traffic and ports, reducing the attack surface for exfiltration attempts.",
            "B: Enforce mandatory multi-factor authentication for all user accounts to ensure that only authenticated users can access network resources.",
            "C: Configure data loss prevention tools to detect and block sensitive data being uploaded via web browsers or other exfiltration channels.",
            "D: Increase the frequency of data backups to ensure quick recovery in case data is exfiltrated or compromised."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "327c650f-cf7d-4379-bed7-1a93ac1124d2",
        "source": "apple_platform_security",
        "question": "A company is deploying Apple devices for its executive team and is considering using biometric authentication to enhance security and convenience. As a security consultant, identify which of the following statements are correct regarding the security features and processes associated with Face ID and Touch ID on these devices.",
        "choices": [
            "A: The Secure Enclave processes, encrypts, and stores the biometric template data during enrollment.",
            "B: Face ID and Touch ID sensors store biometric templates and perform biometric matching.",
            "C: Face ID's TrueDepth camera system includes attention detection to confirm user intent before unlocking the device.",
            "D: Touch ID's sensor communicates with the Secure Enclave using a public Wi-Fi network for data transmission."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Biometric"
    },
    {
        "id": "db4b5fc8-c886-46ff-9105-e058e14ffbcf",
        "source": "apple_platform_security",
        "question": "A business is considering the use of Apple Messages for Business and FaceTime for internal and client communications. What security features of these services should they be informed about when making their decision? (Choose all that apply.)",
        "choices": [
            "A: Apple Messages for Business uses a user's phone number and email address as identifiers for conversations with the business.",
            "B: Messages sent to businesses through Apple Messages for Business are encrypted in transit and never stored in unencrypted form.",
            "C: FaceTime calls establish a peer-to-peer connection after the initial connection and security setup if possible.",
            "D: Group FaceTime calls do not provide forward secrecy, meaning past calls could be compromised if a user's device is compromised."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Apple_Communication_Security"
    },
    {
        "id": "eb8aab2e-e40f-4791-9f57-5dce269a6143",
        "source": "android_sec_doc",
        "question": "You are developing an Android application that requires storing sensitive user data securely. Your application needs to access this data even when the device has not been unlocked by the user after a reboot. Considering the security measures provided by Android's file-based encryption (FBE), which storage locations should you utilize for this requirement, and what are the advantages and disadvantages of your choice?",
        "choices": [
            "A: Use Device Encrypted (DE) storage because it is available during Direct Boot, but it might expose less sensitive data to services before user authentication.",
            "B: Use Credential Encrypted (CE) storage as it is the default and more secure, but the data will only be available after the user has unlocked the device.",
            "C: Use external storage media as it is always accessible, but this approach is less secure due to the potential physical removal of the media.",
            "D: Use adoptable storage with FBE, which combines the security of internal storage encryption with the flexibility of external media, but is not compatible with Android versions before 9."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "File-Based Encryption (FBE)"
    },
    {
        "id": "040272c6-a6c6-448e-8170-f246b71ff22c",
        "source": "attck",
        "question": "A company's containerized infrastructure is facing threats from adversaries who are attempting to discover resources within their container environment. As a security consultant, you are tasked with recommending mitigations to prevent such unauthorized resource discovery. Which of the following would be effective measures to implement?",
        "choices": [
            "A: Limit access to the container service to managed and secured channels and require secure port access for API communication over TLS.",
            "B: Enable unrestricted API access to ensure full visibility and the ability to monitor all incoming and outgoing traffic.",
            "C: Use network segmentation to prevent direct remote access to internal systems without the use of proxies or firewalls.",
            "D: Grant all users wildcard permissions for ease of container management and to reduce the complexity of access controls."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Container Security"
    },
    {
        "id": "61678a40-e3ae-40bb-a9f2-18be137fef9b",
        "source": "windows_security",
        "question": "Which of the following is NOT a typical behavior associated with the event log entry for the Windows Firewall Service being stopped, with ID 5025(S)?",
        "choices": [
            "A: The event is logged after the firewall service is manually stopped by an administrator.",
            "B: The event is logged during regular system operation without any shutdown process.",
            "C: The event appears in the log as part of the regular operating system shutdown sequence.",
            "D: The event is recorded when the system undergoes a scheduled reboot for maintenance."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "EventID 5025(S)"
    },
    {
        "id": "dc814850-f840-41e7-88e7-d8ce8af41786",
        "source": "cwe",
        "question": "In a code review session, a developer claims that their code is secure because they have applied a check for NULL pointers at every usage point. As a security analyst, you need to provide a counterargument that addresses potential issues this approach might fail to mitigate. Which of the following would be the most effective counterargument?",
        "choices": [
            "A: While checking pointers before use mitigates the risk, potential race conditions could still lead to a NULL pointer dereference in a multithreaded environment.",
            "B: Checking pointers before use is ineffective, and it is better to rely on tools that prevent the use of uninitialized variables instead.",
            "C: Input validation on external data is unnecessary if all pointers are checked for NULL because it would not impact the dereference.",
            "D: The use of automated static analysis tools during the testing phase is the only way to ensure that NULL pointer dereferences do not occur."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Race Condition"
    },
    {
        "id": "33814255-45ce-4b8c-9c5c-71bffbafe10a",
        "source": "owasp_mastg",
        "question": "An Android application developer is considering whether to implement full-disk encryption (FDE) for a new enterprise messaging app targeting devices with Android 5.0 (API level 21) and above. From a security best practices perspective, what should the developer take into account?",
        "choices": [
            "A: FDE is the recommended encryption method for all Android versions as it uses a single key protected by the user's device password.",
            "B: FDE is deprecated and file-based encryption (FBE) should be used whenever possible to allow for independent encryption of files.",
            "C: FDE should be implemented to ensure that alarms and calls are operational after a reboot without user intervention.",
            "D: FDE is essential for Direct Boot to function, which is a feature that allows access to certain device features without user authentication."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "File-Based Encryption (FBE)"
    },
    {
        "id": "6f929d36-f833-4157-a8be-f6fa1b0f6793",
        "source": "attck",
        "question": "A cybersecurity analyst is tasked with improving the security of an organization's email system. Given the threat of adversaries targeting user emails to collect sensitive information through methods such as auto-forwarding rules, which of the following measures would be most effective in mitigating this threat?",
        "choices": [
            "A: Implementing multi-factor authentication for public-facing webmail servers.",
            "B: Forcing password changes for email accounts every 30 days.",
            "C: Disabling all email forwarding functionalities.",
            "D: Regular audit of auto-forwarding rules and monitoring for specific detectable artifacts in the header of forwarded emails."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "8de6c752-43fb-4df2-a26e-1cb205767e6f",
        "source": "cwe",
        "question": "In a review of a Struts-based web application, a developer argues that calling super.validate() is unnecessary since custom validation has been thoroughly implemented for each form. What is the most compelling counterargument to this claim?",
        "choices": [
            "A: Custom validation could overlook some generic validation rules that are provided by the Struts framework, which would be enforced by calling super.validate().",
            "B: Calling super.validate() is an outdated practice and modern Struts applications rely solely on JavaScript-based client-side validation.",
            "C: Custom validation is always preferable as it is tailored to the application's specific requirements and super.validate() would add unnecessary overhead.",
            "D: Omitting the call to super.validate() simplifies the codebase, making the application easier to maintain and reducing the likelihood of bugs."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "StrutsValidation"
    },
    {
        "id": "db2685fc-2eea-4acc-a6f8-1e97424453d5",
        "source": "attck",
        "question": "Which of the following scenarios is an example of an adversary maintaining persistent access to a system through the compromise of client software binaries?",
        "choices": [
            "A: An adversary replaces the legitimate SSH client with a trojanized version to capture user credentials.",
            "B: An attacker conducts a brute-force attack to guess user passwords and gain unauthorized access.",
            "C: A threat actor performs a DDoS attack to disrupt services on a company's web server.",
            "D: An adversary sends phishing emails to employees in an attempt to install ransomware on the network."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Trojanized SSH Client"
    },
    {
        "id": "28531070-f48e-49f9-a797-241ad1d76f6c",
        "source": "windows_security",
        "question": "A security administrator is planning to enhance the security of the organization's Windows infrastructure. To prevent sophisticated attacks that compromise system boot integrity and firmware, the administrator is looking for a solution that performs hardware-based root of trust validation and runtime system integrity checks. Which Windows security feature should the administrator implement?",
        "choices": [
            "A: Windows Secure Boot",
            "B: BitLocker Drive Encryption",
            "C: Windows Defender System Guard",
            "D: Windows Information Protection"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Hardware-Based Root of Trust"
    },
    {
        "id": "31398b3a-babe-4b5f-a8d4-19f06ad2659f",
        "source": "attck",
        "question": "Based on observed patterns of adversary behavior, which of the following types of applications is least likely to be targeted for initial network access exploitation?",
        "choices": [
            "A: Standard services such as SMB or SSH",
            "B: Network device administration protocols such as SNMP",
            "C: Proprietary internal messaging applications",
            "D: Databases such as SQL"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Exploitation Target Selection"
    },
    {
        "id": "859819dd-dc71-4033-aa00-116071ffba22",
        "source": "windows_security",
        "question": "A system administrator is reviewing the Windows Security event logs and comes across an event with ID 5058. The log entry indicates that an operation was performed on a file containing a cryptographic key. Which of the following pieces of information should the administrator expect to find in the details of this event log? (Select all that apply.)",
        "choices": [
            "A: The account domain of the user who performed the key file operation.",
            "B: The amount of data encrypted or decrypted using the key during the operation.",
            "C: The return code indicating the success or failure of the operation.",
            "D: The type of cryptographic algorithm used during the key operation."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Windows Security Event Log"
    },
    {
        "id": "cb6f73dc-3713-4610-a706-2453349658bb",
        "source": "apple_platform_security",
        "question": "John is setting up accounts on various apps and websites across his iOS, iPadOS, and macOS devices. He wants to ensure that his passwords are strong, unique, and synced across all devices. Based on the security features provided by Apple, which of the following actions can John perform to manage his passwords securely?",
        "choices": [
            "A: Opt out of using strong passwords when creating an account on a website in Safari.",
            "B: Enable iCloud Private Relay to protect his passwords during DNS resolution requests.",
            "C: Use Sign in with Apple to avoid creating and managing additional accounts or passwords.",
            "D: Rely on Password AutoFill to suggest credentials for apps that have a trusted relationship with the same website."
        ],
        "answer": "ACD",
        "topics": [],
        "keyword": "Password"
    },
    {
        "id": "1af16c4e-b82d-40aa-8e9f-3679e9f7bd79",
        "source": "mozilla_security",
        "question": "An online shopping platform has a legacy system that extensively uses inline scripts for dynamic content generation. The security team is considering an update to the Content-Security-Policy header to better protect against XSS without completely refactoring the existing codebase. What would be the primary security consequence of including 'unsafe-inline' in the Content-Security-Policy header in this scenario?",
        "choices": [
            "A: It will enhance the security of the site by allowing inline scripts which are essential for legacy systems.",
            "B: Including 'unsafe-inline' will maintain the status quo, neither increasing nor decreasing security.",
            "C: It would introduce significant security risks by allowing the execution of inline scripts, which can be exploited for XSS attacks.",
            "D: Adding 'unsafe-inline' will automatically sandbox all inline scripts, thus providing additional protection against XSS."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "unsafe-inline"
    },
    {
        "id": "be166c38-6ace-4b4d-9b77-3171550c05dd",
        "source": "attck",
        "question": "A security team is tasked with preventing adversaries from establishing persistence through the implantation of malicious images within their cloud infrastructure. Which of the following strategies would be effective in mitigating this threat? (Select two.)",
        "choices": [
            "A: Implementing a periodic integrity check of cloud images and containers to identify unauthorized modifications.",
            "B: Requiring that all container images are signed by trusted sources as supported by several cloud service providers.",
            "C: Disabling the user permission to create any images or containers within the cloud environment.",
            "D: Encrypting all data at rest within the cloud infrastructure to prevent the execution of malicious code."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Image Integrity"
    },
    {
        "id": "1d4533fa-c386-42e0-a338-3d7d155cddda",
        "source": "cwe",
        "question": "A developer has written the following code snippet to call a privileged API:\n\npython\nprivileged_function(user_input)\n\n\nThe privileged_function is known to perform operations requiring elevated privileges. What vulnerability does this code most likely introduce?",
        "choices": [
            "A: Buffer overflow due to unvalidated user input",
            "B: Privilege escalation by exploiting the incorrect call to the privileged function",
            "C: Denial of Service (DoS) by overwhelming the privileged function with input",
            "D: Cross-site scripting (XSS) by injecting malicious scripts through user_input"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "PrivilegeEscalation"
    },
    {
        "id": "5a76a206-0903-4b74-b8e8-b0b1756fe068",
        "source": "apple_platform_security",
        "question": "If the UID and GID keys of the Secure Enclave were to be compromised, which of the following scenarios would likely occur? Select all applicable outcomes.",
        "choices": [
            "A: Files encrypted with the device-specific UID would remain secure, as the UID is designed to be immutable and independent of other device identifiers.",
            "B: The compromised GID could potentially allow attackers to access data common to all devices using the same SoC, as the GID is shared among such devices.",
            "C: Face ID or Touch ID data could be at risk since these use the UID for device-specific secret protection.",
            "D: External storage devices connected over USB to the compromised device would be exposed, as the UID encryption extends to all connected peripherals."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "KeyExposure"
    },
    {
        "id": "8bbcd18c-9cf7-4dde-a211-9a9345ce4716",
        "source": "cs161_textbook",
        "question": "Alice uses onion routing to send a message to Bob via intermediaries Frank, Dan, and Charlie to maintain her anonymity. Choose the statements that correctly describe the security features of onion routing based on the given scenario:",
        "choices": [
            "A: Charlie, as the final proxy, is the only one in the chain who knows both the final message and the final recipient.",
            "B: It is secure to assume that the message Alice sends can be traced back to her by Bob if Frank and Charlie collude.",
            "C: The message could have been encrypted with Bob's public key for additional security, which would prevent any intermediary from reading the contents of the message.",
            "D: If all intermediaries besides one are malicious and colluding, they can still easily determine that Alice is communicating with Bob."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OnionRouting"
    },
    {
        "id": "8dfefdda-0cc7-439f-a2ac-650f9e28752b",
        "source": "attck",
        "question": "An adversary has compromised a system and intends to exfiltrate sensitive data. Which of the following methods is least likely to be used by the adversary to exfiltrate data over a C2 channel without raising immediate suspicion?",
        "choices": [
            "A: Encoding the data within the protocol of normal C2 communications.",
            "B: Sending data as an unencrypted attachment in an email to a public email server.",
            "C: Using steganography to hide data within image files sent over the C2 channel.",
            "D: Transmitting data in small, periodic bursts to mimic normal traffic patterns."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Steganography"
    },
    {
        "id": "b22b26c1-ca62-40a5-ac12-c8a0f0957e2a",
        "source": "windows_security",
        "question": "You are configuring security monitoring for a Windows-based system. You need to ensure that you receive alerts for security events involving sensitive file system objects. Which actions should you monitor to achieve this, especially for Failure events?",
        "choices": [
            "A: ChangePermissions",
            "B: WriteData (or AddFile)",
            "C: ExecuteFile",
            "D: WriteAttributes"
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Security Monitoring Recommendations"
    },
    {
        "id": "9d034266-a90d-48b8-bade-e4fcd31301d7",
        "source": "owasp_wstg",
        "question": "If a web application is prone to a security vulnerability that allows an attacker to manipulate HTTP requests made by the client, which of the following tools would not be suitable for identifying and mitigating this vulnerability?",
        "choices": [
            "A: Wireshark",
            "B: Charles Web Debugging Proxy",
            "C: TCPDUMP",
            "D: Load Balancer"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "HTTP request manipulation"
    },
    {
        "id": "fe5dfa44-fef1-4115-b52b-a9bccfd970c6",
        "source": "windows_security",
        "question": "If an administrator suspects that a Windows Firewall rule designed to block an outdated protocol is not being enforced, what actions should the administrator take to confirm and rectify the situation?",
        "choices": [
            "A: Verify the rule's properties for correctness and review the Event Viewer for Event 4957(F) to check if the rule was not applied.",
            "B: Increase the rule's priority in the Windows Firewall settings to ensure it overrides any conflicting rules.",
            "C: Reinstall the Windows Firewall component to reset all rules and ensure the outdated protocol is blocked.",
            "D: Disable and re-enable the network interface to force all rules to reapply, including the one blocking the outdated protocol."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Firewall Rule Enforcement"
    },
    {
        "id": "b1972f40-9e77-40b2-a8a8-9e5938dd3f62",
        "source": "cs161_textbook",
        "question": "Which of the following statements accurately reflect the properties and functionalities of the cryptographic primitives used in Bitcoin?",
        "choices": [
            "A: A cryptographic hash maps a variable-length input to a fixed-length output and is collision-resistant, meaning it is computationally infeasible to find two distinct inputs that produce identical outputs.",
            "B: A digital signature ensures confidentiality of a message by allowing only the holder of a secret signing key to reveal the message content.",
            "C: A digital signature allows anyone with the public verification key to confirm the authenticity of a message and the identity of the sender, ensuring the message has not been altered.",
            "D: Cryptographic hashes in Bitcoin serve as a proof of work, demonstrating that a significant amount of computational effort has been expended."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cryptographic Primitives"
    },
    {
        "id": "58add164-3543-46d4-837f-bd10e0997966",
        "source": "windows_security",
        "question": "Your organization is setting up additional logging for certificate pinning rules by configuring the 'PinRulesLogDir' registry setting. A colleague suggests that only administrators require full access to the pin rule log folder. What is the most appropriate counterargument to this claim based on the described setup process?",
        "choices": [
            "A: Full access permissions are unnecessary because the log folder is only used for read operations by Windows.",
            "B: All users and applications must have full access to the folder to ensure proper logging of pin rules.",
            "C: Only applications require full access, while users should be provided with read-only permissions to the log folder.",
            "D: The 'PinRulesLogDir' should be set to a read-only folder to prevent unauthorized modifications to the logs."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PinRulesLogDir"
    },
    {
        "id": "8a079166-f15e-4436-bc6a-3fd195a1b47d",
        "source": "attck",
        "question": "A penetration tester discovers that adversaries have obtained information about files and directories on a host system. Which of the following actions might the adversaries take next, based on this information?",
        "choices": [
            "A: Decide whether to fully infect the target based on the discovered information.",
            "B: Immediately launch a Distributed Denial of Service (DDoS) attack.",
            "C: Correlate the file timestamps to determine the physical location of the server.",
            "D: Disable the network interface card to prevent further file discoveries."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "File and Directory Discovery"
    },
    {
        "id": "2f379ec5-7623-4709-86a0-aaece90a2086",
        "source": "attck",
        "question": "A cybersecurity analyst is tasked with improving the detection of rootkits within the organization's network. Which of the following data sources and components should the analyst focus on to enhance the detection of rootkit presence?",
        "choices": [
            "A: Drive: Monitor for unexpected drive modifications",
            "B: CPU Load: Regularly check the CPU load for inconsistencies",
            "C: Email Logs: Analyze email logs for phishing attempts",
            "D: File: Monitor for unrecognized DLLs, drivers, and services"
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "rootkit detection"
    },
    {
        "id": "a49b1c8f-f5e6-4c74-a362-6941b834bdae",
        "source": "attck",
        "question": "A company has recently granted elevated access to an external IT services contractor for managing their internal systems. The contractor's account was compromised, leading to unauthorized access to the company's network. Which of the following measures would be MOST effective in both preventing future incidents and detecting unauthorized access resulting from compromised third-party accounts?",
        "choices": [
            "A: Implementing Multi-factor Authentication (MFA) for all delegated administrator accounts and monitoring for anomalous login sessions.",
            "B: Disabling all third-party provider accounts immediately after they have completed their tasks to prevent unauthorized access.",
            "C: Installing antivirus software on all network devices to automatically detect and prevent breaches from third-party providers.",
            "D: Requiring third-party providers to only use email for communication, thus avoiding the need for direct network access."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "29566525-453c-4a9b-967e-93ac472a57d0",
        "source": "owasp_wstg",
        "question": "In designing an HTTP agent to handle incoming requests, what aspect should be given particular attention to mitigate the risk of HTTP smuggling attacks?",
        "choices": [
            "A: The agent should be configured to prioritize GET requests over POST requests to ensure a clear request queue.",
            "B: Consistent parsing and interpretation of HTTP messages should be enforced across the entire communication chain.",
            "C: The agent should reject all requests containing encrypted data to avoid any misinterpretation of the message content.",
            "D: Enable stateful session management to track the sequence of requests and responses."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "HTTP Message Parsing"
    },
    {
        "id": "516bb064-882f-4154-b3c8-5767fd80a40f",
        "source": "windows_security",
        "question": "A corporation recently experienced a security breach and discovered that the attackers were able to execute unauthorized code during the startup of their Windows 10 systems. If the startup process was not properly secured, which misconfiguration might be responsible for this type of breach?",
        "choices": [
            "A: Disabling Secure Boot, allowing non-trusted operating systems to be loaded.",
            "B: Failure to configure System Guard Secure Launch, allowing firmware vulnerabilities to be exploited.",
            "C: Turning off Windows Defender, preventing detection of malicious software during startup.",
            "D: Incorrectly setting up SMM protection, leading to code execution in System Management Mode."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "System Guard Secure Launch"
    },
    {
        "id": "8b6fc654-701e-445d-bd0f-38de8b841a84",
        "source": "attck",
        "question": "A security architect is designing a new cloud-based application that handles sensitive credential data. To mitigate the risk of credential theft via software exploitation, which of the following techniques should be considered? Furthermore, what could be a potential limitation of the chosen technique?",
        "choices": [
            "A: Utilizing exploit protection tools like Windows Defender Exploit Guard (WDEG), with the limitation that they may not work for software targeted for defense evasion.",
            "B: Applying network segmentation to restrict lateral movement, potentially limiting the ease of administrative tasks across the network.",
            "C: Enforcing mandatory access controls on all system operations, which could potentially lead to a higher rate of false positives.",
            "D: Requiring biometric authentication for all users, which could be limited by the physical presence requirement for user authentication."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Windows Defender Exploit Guard"
    },
    {
        "id": "fa9abe0a-4d91-49fc-9abd-ec7c41e0b996",
        "source": "android_sec_doc",
        "question": "As an Android OS developer, you are explaining the importance of rollback protection in the context of Verified Boot to a team of junior developers. How does rollback protection contribute to the security of an Android device?",
        "choices": [
            "A: Rollback protection ensures that users can downgrade to previous versions of Android in case they encounter issues with the new updates.",
            "B: Rollback protection helps to maintain system integrity by ensuring that devices can only update to newer versions of Android, preventing the persistence of possible exploits.",
            "C: Rollback protection allows for easier recovery from system failures by enabling the installation of older, more stable OS releases.",
            "D: Rollback protection is designed to protect user data by creating backups before an update is applied."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Rollback Protection"
    },
    {
        "id": "75492370-ca7d-44a9-9ffd-18de1c35f96d",
        "source": "attck",
        "question": "In a corporate network environment, what measure would be least effective in mitigating the risk of adversaries performing System Owner/User Discovery?",
        "choices": [
            "A: Disabling unnecessary user enumeration commands",
            "B: Restricting the use of OS Credential Dumping tools",
            "C: Implementing strict file/directory ownership permissions",
            "D: Monitoring and filtering outbound traffic to known adversary-controlled C2 servers"
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Network Security Monitoring"
    },
    {
        "id": "dbbbd198-c5a7-46aa-bb74-f934d481ce51",
        "source": "cwe",
        "question": "In designing a system that processes various types of data inputs, which of the following strategies might inadvertently allow attackers to bypass validation mechanisms if not implemented carefully? (Select all that apply)",
        "choices": [
            "A: Implementing a denylist to block known malicious or malformed inputs.",
            "B: Validating input based on the full range of acceptable values, types, and consistency with business rules.",
            "C: Assuming a default encoding when not specified by the input source.",
            "D: Decoding an input twice before validation."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ValidationBypass"
    },
    {
        "id": "d36b40ca-3436-4f1e-a830-f7535ab660b3",
        "source": "owasp_mastg",
        "question": "A mobile banking app is being designed with a high priority on security, especially concerning the establishment of secure connections to its servers. The app development team is considering implementing Identity Pinning to restrict the number of CAs that the app trusts. Which of the following statements are true regarding the use of Identity Pinning in this context? (Select two)",
        "choices": [
            "A: Identity Pinning will prevent any attacker from accessing the backend and exploiting server-side vulnerabilities, ensuring complete protection.",
            "B: Identity Pinning will protect against a compromised CA or a malicious CA installed on the device by only allowing connections to servers with identities included in the pinset.",
            "C: Identity Pinning should be avoided as it has been deprecated due to its complexity and operational challenges, with no security benefits.",
            "D: In the scenario of a CA breach, even if rare, Identity Pinning can help reduce the app's attack surface by trusting only specific CAs or certificates."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Identity Pinning"
    },
    {
        "id": "12b81400-3f25-448b-919b-d4cfa759baac",
        "source": "owasp_mastg",
        "question": "As a security analyst reviewing the manifest file of an Android application, which of the following elements should you carefully evaluate to mitigate potential security risks?",
        "choices": [
            "A: <uses-sdk> tag specifying the range of compatible SDK versions.",
            "B: Declaration of the app's version number.",
            "C: <provider> tag with the attribute 'android:exported'.",
            "D: Listing the app's icon and theme."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "android:exported"
    },
    {
        "id": "253432b5-d7cc-4994-bfd1-6853b5d1272c",
        "source": "cs161_textbook",
        "question": "Alice and Bob are using a symmetric block cipher to encrypt their communications. They are considering the security implications of various attributes of the block cipher in use. Which of the following attributes would they need to consider ensuring the confidentiality of their messages? (Select all that apply)",
        "choices": [
            "A: The block cipher should allow for multiple plaintext inputs to be mapped to the same ciphertext output to confuse potential attackers.",
            "B: The block cipher should be deterministic so that it always produces the same ciphertext output for a given plaintext input and key.",
            "C: The block length and key length must be chosen appropriately to prevent brute-force attacks by increasing the number of possible keys.",
            "D: The block cipher should use a different key for encryption and decryption to enhance the security of the communication."
        ],
        "answer": "BC",
        "topics": [
            "Cryptography"
        ],
        "keyword": "EncryptionSecurity"
    },
    {
        "id": "8f346f36-3182-4269-9b85-83c9b574649d",
        "source": "owasp_wstg",
        "question": "You are reviewing the security of a web application and find that user authentication is managed via cookies. The application contains a page with functionality to modify user settings, which is triggered through a GET request. You want to assess the risk of Cross-Site Request Forgery (CSRF) attacks. Which of the following conditions would increase the risk of a CSRF attack being successful?",
        "choices": [
            "A: The application employs strong encryption for data in transit.",
            "B: The application uses HTTP-only and Secure cookie attributes.",
            "C: The application does not verify the source of incoming requests.",
            "D: The application has a strict Content Security Policy (CSP)."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "6675c9d9-401f-4aa7-b641-dc0d3a1eb93c",
        "source": "apple_platform_security",
        "question": "Consider an organization that uses various Apple devices and is evaluating the security benefits of the OTA software update process. Which of the following statements accurately reflect the advantages or limitations of using OTA updates and the associated security features on Apple devices?",
        "choices": [
            "A: OTA updates enhance network efficiency by only downloading the components required for the update, rather than the entire operating system.",
            "B: The authorisation server's use of a nonce in the personalised update process helps prevent replay attacks during software updates.",
            "C: During the OTA update process, the user's data volume is mounted to ensure integrity checks against the current user data.",
            "D: Kernel Integrity Protection locks the hardware used to prevent modification of kernel and driver code after the boot process is complete."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "OTA_updates"
    },
    {
        "id": "d5d19138-8e19-4469-9857-f06aa1afce44",
        "source": "owasp_mastg",
        "question": "In an open-source mobile application security project, contributors are recognized based on the quality and quantity of their contributions. What would typically qualify a contributor to be recognized as a co-author, and what should be taken into consideration regarding the project's licensing terms for reuse and distribution?",
        "choices": [
            "A: Contributors with a significant number of quality contributions, and the project's work must clearly state the licensing terms under which it can be reused or distributed.",
            "B: All contributors are automatically considered co-authors, and the project's work can be reused without attributing the original source.",
            "C: Only the initial creators are recognized as co-authors, and the project's work is proprietary and cannot be legally reused or distributed by others.",
            "D: Contributors who provide financial support, and the project's work is in the public domain and can be reused without any restrictions."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Creative Commons License"
    },
    {
        "id": "5d35c8c8-0f4a-45f7-befe-ff27b9719a0e",
        "source": "owasp_mastg",
        "question": "When designing an application that handles sensitive data, such as user credentials or financial information, which of the following data types and practices should be preferred to minimize the exposure of sensitive data in memory?",
        "choices": [
            "A: Utilize immutable data types like `String` or `BigInteger` to store sensitive information as they are secure by default.",
            "B: Centralize the handling of sensitive data using primitive, mutable data structures like `byte[]` and `char[]` and overwrite them with dummy data after use.",
            "C: Rely on `StringBuffer` and `StringBuilder` for modifying sensitive data and ensure the buffer is not copied when it exceeds capacity.",
            "D: Use third-party services and SDKs without review since they are commonly equipped to handle sensitive data securely."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Memory management"
    },
    {
        "id": "51c5c6b4-dabe-40b0-add9-5e89375e3f61",
        "source": "windows_security",
        "question": "In the context of a Zero Trust security model, how would you ensure that the health of a Windows device is accurately attested before granting it access to sensitive resources?",
        "choices": [
            "A: Implement health attestation services to verify the integrity of the device's security features before access is granted.",
            "B: Require multi-factor authentication for all users, irrespective of device health, to ensure secure access.",
            "C: Only devices with the latest Windows version installed are considered healthy and granted access.",
            "D: Use a static list of approved device identifiers to determine device health and grant access."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Zero Trust"
    },
    {
        "id": "3a6cf71b-2c6b-4729-89b6-ff2a7128b81a",
        "source": "cwe",
        "question": "When reviewing the security aspects of a software system's design, you notice that file permissions during installation are not properly configured, potentially allowing unauthorized modifications. Which of the following is least likely to be an effective mitigation strategy to prevent this issue?",
        "choices": [
            "A: Instituting a policy where the system's files are set to read-only for all users except for a select group of administrators.",
            "B: Employing an access control mechanism that requires multi-factor authentication for modifying key files.",
            "C: Configuring all installation files with open permissions as a means to simplify maintenance and troubleshooting.",
            "D: Implementing user roles within the system and assigning file modification permissions based on role requirements."
        ],
        "answer": "C",
        "topics": [
            "Vulnerability",
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "MitigationStrategies"
    },
    {
        "id": "c3d8fb38-79f9-4385-972d-6297c8a5d92a",
        "source": "owasp_wstg",
        "question": "Which of the following is an incorrect assumption about the patch-and-penetrate model for maintaining application security?",
        "choices": [
            "A: Patching software can potentially interfere with its normal operations.",
            "B: All users are immediately aware of and apply newly released patches.",
            "C: Patching is an effective method for long-term security strategy.",
            "D: The window of vulnerability provides sufficient time for patch installation."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Patch-and-Penetrate Model"
    },
    {
        "id": "fef4103e-ad79-41e3-af74-a717a0a7a625",
        "source": "windows_security",
        "question": "Which of the following statements about the Windows Firewall Service event ID 5024 is accurate? (Select two)",
        "choices": [
            "A: Event ID 5024 indicates a critical security breach and immediate action is required.",
            "B: This event is logged every time the Windows Firewall Service starts successfully, typically during the operating system startup process.",
            "C: Event ID 5024 is only relevant to Windows operating systems prior to Windows Vista.",
            "D: The event is inconsequential and should be ignored in all instances as it merely indicates a routine service start."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Event ID 5024"
    },
    {
        "id": "888053ac-44db-4b44-bb34-b7fed5d3b56c",
        "source": "apple_platform_security",
        "question": "A user is adding their state ID to their Apple Wallet on their iPhone and Apple Watch. Which of the following steps are part of the security process to ensure the user's identity and protect their personal information during this process?",
        "choices": [
            "A: The user must scan the front and back of their physical ID, and the images are encrypted and sent to the state issuing authority.",
            "B: To prevent fraud, a ten-digit value based on the user's device use patterns is sent to the state issuing authority.",
            "C: The user's device ties a matched Face ID or Touch ID biometric to the state ID to confirm that only the rightful owner can present it.",
            "D: A key pair is generated in the Secure Element by the paired Apple Watch that anchors the user's ID to the Apple Watch."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Biometric"
    },
    {
        "id": "e1f1e0df-3c8f-4bf8-b3a7-0ddb613ac72a",
        "source": "owasp_wstg",
        "question": "A web application uses an XML database to authenticate users, where an XPath query checks for a matching username and password. Which of the following user inputs could potentially exploit an XPath Injection vulnerability in the application's login process?",
        "choices": [
            "A: Username: admin' --\nPassword: ' OR '1' = '1",
            "B: Username: ' or '1' = '1\nPassword: ' or '1' = '1",
            "C: Username: *admin*\nPassword: *password*",
            "D: Username: 'admin'\nPassword: 'password' or 'x'='x"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "XPath Injection"
    },
    {
        "id": "3ff1643f-630b-41b9-aa4d-7645f6cda437",
        "source": "apple_platform_security",
        "question": "In a discussion about the security features of macOS, a cybersecurity expert is comparing native capabilities with their third-party equivalents. Which of the following pairings between native capabilities and third-party equivalents are correctly matched? (Select all that apply)",
        "choices": [
            "A: Plug-in unapproved list and Safari extension unapproved list with Virus/Malware definitions",
            "B: File Quarantine with Endpoint protection",
            "C: Gatekeeper with Virus/Malware definitions",
            "D: eficheck with Rootkit detection"
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "macOSSecurityFeatures"
    },
    {
        "id": "42476626-ba96-4e41-8474-18fb68fdb52b",
        "source": "cs161_textbook",
        "question": "The 'e' prefix in the names of x86 registers such as eip, ebp, and esp stands for 'extended'. What is the historical significance of this terminology in the context of CPU architecture evolution?",
        "choices": [
            "A: It indicates the evolution from 8-bit to 16-bit register sizes.",
            "B: It signifies the transition from 16-bit to 32-bit systems.",
            "C: It represents the expansion from 32-bit to 64-bit address space.",
            "D: It denotes a doubling of the clock speed compared to previous CPU generations."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "extended"
    },
    {
        "id": "f79c6c74-976c-41d2-b560-6be89fe6bbc0",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing network traffic logs and notices multiple instances of data packets being transferred at regular intervals, all of the same size below the usual threshold that usually triggers alerts. The analyst suspects this could be a data exfiltration technique employed by an adversary. Which of the following best describes the adversary's likely strategy and a potential method to detect this activity?",
        "choices": [
            "A: The adversary is exfiltrating data in fixed size chunks to avoid triggering alerts, and the analyst should monitor for newly constructed network connections that send fixed size data packets at regular intervals.",
            "B: The adversary is using a standard file transfer method without alteration to evade detection, and the analyst should focus on the file metadata for anomalies.",
            "C: The adversary is likely encrypting the data to bypass size-based detection, and the analyst should examine SSL/TLS handshake inconsistencies to detect the exfiltration.",
            "D: The adversary is employing a fast flux DNS technique to rapidly change IP addresses associated with data transfers, and the analyst should look for anomalies in DNS traffic patterns."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Data Exfiltration"
    },
    {
        "id": "dcabb8e6-1568-4a4a-ba81-45e68dd35d33",
        "source": "android_sec_doc",
        "question": "An Android application developer is designing a security-sensitive application that requires cryptographic key storage. The developer is considering the use of Tag::BLOB_USAGE_REQUIREMENTS for key generation to ensure the key can be used without file system support, which is critical for devices with encrypted disks. Assess the implications of setting the Tag::BLOB_USAGE_REQUIREMENTS with the value KeyBlobUsageRequirements::STANDALONE for the application's cryptographic key storage design.",
        "choices": [
            "A: It allows the key to be used even when the file system is not available, such as during early device boot processes.",
            "B: It enforces that the key can only be used when the device is connected to a network to ensure higher security.",
            "C: It ensures that the key can only be used within the Android system and not by the bootloader.",
            "D: It requires the key to be stored in a dedicated hardware module separate from the device's main processor."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "KeyBlobUsageRequirements"
    },
    {
        "id": "c01cc562-c94a-4e84-8387-94f5218ddd1a",
        "source": "cwe",
        "question": "Which of the following code snippets adheres to good source code style and formatting practices?",
        "choices": [
            "A: A snippet that uses varying indentation levels inconsistently throughout the code.",
            "B: A snippet that has no comments, making the code difficult to understand.",
            "C: A snippet with well-indented code, consistent naming conventions, and clear comments.",
            "D: A snippet where lines of code are excessively long, exceeding standard readability lengths."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "FormattingPractices"
    },
    {
        "id": "d14e02fa-e3c8-438c-8bc8-d053d5aec13d",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing logs from a host-based intrusion detection system and notices unusual activity indicative of a malware infection. The system has reported multiple instances of file and directory enumeration as well as specific search patterns for documents within file systems. Based on typical adversary behaviors, which of the following actions could the malware be performing?",
        "choices": [
            "A: The malware is using a brute force attack to guess user passwords.",
            "B: The malware is attempting to exfiltrate data by searching for documents with particular file extensions.",
            "C: The malware is patching system binaries to maintain persistence.",
            "D: The malware is manipulating environmental variables to disrupt process execution."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "File and Directory Enumeration"
    },
    {
        "id": "fa543433-0721-40a8-83a7-7061fa3ac395",
        "source": "attck",
        "question": "As a cybersecurity specialist, you are tasked with mitigating the threat of hijack execution flow in your organization's network. Which of the following strategies could effectively reduce the risk of such attacks? (Select TWO.)",
        "choices": [
            "A: Disallow the execution of remote DLLs and enable Safe DLL Search Mode to prioritize system directories for library loading.",
            "B: Remove restrictions on file and directory permissions to ensure all users have write access, enhancing troubleshooting and auditing capabilities.",
            "C: Use auditing tools to detect and resolve hijacking opportunities, such as insecure path configurations and correct them.",
            "D: Permit user accounts to interact with service changes and service binary target path locations to increase transparency and accountability in user activities."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Hijack Execution Flow"
    },
    {
        "id": "eb341719-d15e-411b-b2f5-b0a7e33df9e8",
        "source": "windows_security",
        "question": "A company is reviewing its security policies for Windows 10 and Windows 11 workstations. To enhance security during the user sign-in process, they are considering the implications of requiring CTRL+ALT+DEL before login. What is a significant security benefit of enforcing this requirement?",
        "choices": [
            "A: It simplifies the login process for users with physical impairments.",
            "B: It ensures users are communicating through a trusted path when entering passwords.",
            "C: It allows users to sign in using a smart card without pressing CTRL+ALT+DEL.",
            "D: It enables a sign-in dialog box that captures user passwords to prevent unauthorized access."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Interactive logon"
    },
    {
        "id": "64080609-9908-472f-8d17-6aa0f3a53d32",
        "source": "apple_platform_security",
        "question": "An information security consultant is tasked with explaining the features and functions of the Secure Enclave in Apple devices to a client. Which of the following statements should the consultant include in their explanation?",
        "choices": [
            "A: The Secure Enclave includes its own storage for sensitive data, separate from the NAND flash storage utilized by the Application Processor.",
            "B: The Secure Enclave Processor is dedicated solely for Secure Enclave use, helping to prevent side-channel attacks that depend on shared execution cores.",
            "C: The Secure Enclave's Memory Protection Engine uses a nonce for each memory block, providing replay protection for Secure Enclave memory.",
            "D: The Secure Enclave runs an Apple-customized version of the Linux kernel to ensure compatibility with a wide range of applications and services."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecureEnclave"
    },
    {
        "id": "120a71f2-085c-42c4-b686-25b6323a1fdf",
        "source": "android_sec_doc",
        "question": "Consider a scenario where an Android device manufacturer is planning to implement a new SELinux policy for their vendor partition. Which of the following strategies would be the most appropriate for avoiding labeling collisions between the platform and vendor policies while adhering to best practices?",
        "choices": [
            "A: All vendor declarations should have a unique prefix such as 'np_', but file labeling within the vendor partition should not adhere to any specific guidelines.",
            "B: Vendor services in init rc files should have 'vendor.' as a prefix, and all file labeling within the vendor partition should default to 'vendor_file'.",
            "C: Platform policy should provide labels for '/system' components, and vendor policy should avoid labeling these components to ensure framework-only OTA updates.",
            "D: Vendor policy may label files in '/dev' without any restrictions, including those files not within the '/dev/vendor' subdirectory."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "5f3e21ec-7259-43bb-af52-67272127991c",
        "source": "owasp_wstg",
        "question": "You are conducting a security audit on a web application and notice that it uses a server-side templating engine to render pages. You suspect that the application might be vulnerable to Server-Side Template Injection (SSTI). Which of the following payloads would you use to test for SSTI?",
        "choices": [
            "A: {{7*'7'}} which should render '7777777' if vulnerable.",
            "B: <script>alert('XSS')</script> which should trigger a JavaScript alert if vulnerable.",
            "C: ' OR '1'='1' -- which should bypass authentication if SQL injection is possible.",
            "D: system('id') which should execute a command if command injection is possible."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Server-Side Template Injection"
    },
    {
        "id": "b2033070-1ef1-444e-bace-f266167ba0d4",
        "source": "cs161_textbook",
        "question": "You are designing a secure web application form and want to prevent Cross-Site Request Forgery (CSRF) attacks. You decide to implement a CSRF token system. Which of the following steps are necessary to ensure the proper functioning of CSRF tokens within your application?",
        "choices": [
            "A: Generate a new CSRF token for every user session and have it remain constant for the duration of the session.",
            "B: Create a hidden form field to store the CSRF token which will be submitted with the form so that users do not see random strings during submission.",
            "C: Map each CSRF token to the user's IP address to ensure that the form submission originates from the legitimate user's device.",
            "D: Store a mapping of CSRF tokens to session tokens to validate that a request with a session token has the correct corresponding CSRF token."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "d0a2e674-3839-4199-85ac-b915ec3268f8",
        "source": "owasp_mastg",
        "question": "During a mobile application security test, you are evaluating the potential risks associated with Cross-site Request Forgery (CSRF) vulnerabilities. Which of the following factors would make CSRF a less relevant concern for the mobile application you are testing?",
        "choices": [
            "A: Mobile apps rarely use WebViews or cookie-based session management.",
            "B: Mobile apps typically open links in a default browser, which has a separate cookie store from that of WebViews.",
            "C: Mobile apps often implement certificate pinning, which prevents CSRF attacks.",
            "D: Mobile apps automatically add a session cookie or other authentication token to requests made in WebViews."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "CSRF in Mobile Applications"
    },
    {
        "id": "6300218d-bd1a-4019-9fbe-c169685dcabc",
        "source": "owasp_wstg",
        "question": "Consider an application design where a use case diagram illustrates a user entering a username and password to authenticate, and a misuse case diagram depicts an attacker extracting valid usernames by analyzing authentication error messages. Which of the following countermeasures would NOT be effective in mitigating the threat posed by the attacker's actions?",
        "choices": [
            "A: Introducing a time delay after each failed authentication attempt to slow down brute force attacks.",
            "B: Providing generic error messages to avoid giving away information about valid or invalid usernames.",
            "C: Locking user accounts for a period of time after several consecutive failed login attempts to prevent brute force attacks.",
            "D: Implementing a CAPTCHA system that must be solved after each failed login to distinguish between human users and automated scripts."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Use and Misuse Case Analysis"
    },
    {
        "id": "04b35039-4f12-4c67-80ee-ad9f071d49a2",
        "source": "owasp_wstg",
        "question": "A web application currently allows users to upload files, which are then included in server-side scripts based on user-supplied input. An audit has identified this as a potential file inclusion vulnerability. As a security consultant, which of the following measures would you recommend to mitigate this risk?",
        "choices": [
            "A: Implement a server-side input validation to reject directory traversal sequences and remote URLs.",
            "B: Store user-uploaded files with their original names to preserve the file extension and ensure proper execution.",
            "C: Maintain an allow list of files that can be included and use an identifier to access the selected file.",
            "D: Increase the server's memory allocation to handle the additional load from file inclusions."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "File Inclusion Vulnerability"
    },
    {
        "id": "88ab3210-5124-418c-bfd3-8ab1750a8b00",
        "source": "apple_platform_security",
        "question": "You are a security engineer at a car company implementing a digital car key system. A keyholder has requested to delete their digital car key. Which of the following steps are part of the process that your system must follow to securely remove the key from both the vehicle and the keyholder device?",
        "choices": [
            "A: The carmaker's server sends a remote termination request to the keyholder device after the vehicle confirms key removal.",
            "B: The keyholder device generates a cryptographically signed termination attestation once the key is terminated.",
            "C: The keyholder device must delete the key after receiving a termination request directly from the vehicle.",
            "D: The keyholder can directly delete the key from the carmaker’s key inventory server (KIS) without involving the carmaker."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "DigitalKeyDeletion"
    },
    {
        "id": "faa04771-a27a-42a6-9926-3dde6b68ccc5",
        "source": "owasp_wstg",
        "question": "In the context of web application security, consider a scenario where an application's session management is being assessed. Which of the following practices would NOT be effective in preventing session hijacking?",
        "choices": [
            "A: Implementing secure, HttpOnly, and SameSite flags for cookies.",
            "B: Utilizing a predictable session ID generation mechanism that is easily guessable.",
            "C: Enforcing HTTPS to secure data in transit and prevent man-in-the-middle attacks.",
            "D: Regenerating session IDs after a successful login to prevent fixation."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Session Hijacking"
    },
    {
        "id": "9aa54e61-d1cc-4f22-a29d-3c9fbc47bb3d",
        "source": "attck",
        "question": "An adversary has gained unauthorized access to a cloud environment and is likely to attempt service discovery to shape follow-on behaviors. Which of the following reasons is the LEAST valid justification for why disabling or modifying cloud logs would be counterproductive to the defense strategy?",
        "choices": [
            "A: Disabling cloud logs would prevent the adversary from discovering what services are being logged, thus reducing the chances of follow-on behaviors.",
            "B: Modifying cloud logs could potentially create gaps in logging that an adversary could exploit to evade detection.",
            "C: Disabling cloud logs would hinder the ability of defenders to track adversary behavior within the environment.",
            "D: Modifying cloud logs may alert the adversary to the presence of defensive measures, prompting them to change tactics."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Logs"
    },
    {
        "id": "b2b5d010-099c-47b4-9989-465e924b88eb",
        "source": "cs161_textbook",
        "question": "In the context of DNSSEC as described, what are the implications for the security and trust model of DNS queries?",
        "choices": [
            "A: DNSSEC introduces a hardened trust model by using signatures to validate the authenticity of name servers in the resolution chain.",
            "B: DNSSEC improves efficiency of DNS queries by streamlining the communication process between different name servers.",
            "C: The trust anchor in DNSSEC, being the root's hardcoded public key, ensures that messages verified with this key are trustworthy without further validation.",
            "D: DNSSEC introduces additional vulnerabilities due to increased complexity in the DNS query process, making it more susceptible to attack."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "TrustModel"
    },
    {
        "id": "11f5e2c7-9f7e-4f4f-954e-e31394edf430",
        "source": "cwe",
        "question": "A company is developing a new application that will handle user authentication and messaging. As part of the security requirements, the application must protect sensitive information during data transmission to other components of the system. Which of the following approaches should the company consider to prevent insertion of sensitive information into sent data?",
        "choices": [
            "A: Compartmentalizing the system to have safe areas with unambiguous trust boundaries.",
            "B: Enforcing strict type checking on all transmitted data to ensure type safety.",
            "C: Removing all unnecessary information from the transmission to reduce security risks.",
            "D: Using public Wi-Fi networks to transmit data to leverage common security protocols."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "DataProtection"
    },
    {
        "id": "ea6c2263-f528-4ed6-bef0-9a1469d5cb3a",
        "source": "owasp_wstg",
        "question": "You are reviewing the security of an OAuth Authorization Server implementation. You notice that during the OAuth flow, the AS does not properly validate the `redirect_uri` parameter. Which of the following implications can this have for the security of the application?",
        "choices": [
            "A: Allows the AS to grant clients access to resources without user consent.",
            "B: Could lead to tricking the AS into sending an authorization code to an attacker-controlled server.",
            "C: The AS can mistakenly issue refresh tokens instead of authorization codes.",
            "D: Enhances the security by adding randomness to the redirect process."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OAuth Authorization Server Weaknesses"
    },
    {
        "id": "c222982d-e375-446a-ae2c-d87525032db8",
        "source": "cwe",
        "question": "In the context of hardware security, an engineer argues that permanently disabling test or debug modes in hardware during runtime operations can prevent potential security breaches. Which of the following would be a valid counterargument to this claim?",
        "choices": [
            "A: Permanently disabling test or debug modes could impede necessary maintenance and real-time troubleshooting.",
            "B: Permanent activation of test or debug modes ensures a continuous check on the system's integrity and security.",
            "C: Test or debug modes are essential for the hardware to perform optimally and should remain active.",
            "D: Permanently disabling test or debug modes would have no impact on security since hardware is inherently secure."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "DebugFeatureSecurity"
    },
    {
        "id": "8eab60bc-b91c-4ab5-8437-9f0eb712e033",
        "source": "apple_platform_security",
        "question": "An Apple device security engineer is discussing the implications of Sealed Key Protection (SKP) and the system's ability to handle legitimate software updates without compromising security. Which of the following outcomes would likely occur if there was an unexpected change in the measured firmware or security configuration components on a device with SKP enabled?",
        "choices": [
            "A: The system measurement device key (SMDK) would become inaccessible due to the alteration of the hardware register measurements.",
            "B: The Secure Enclave would immediately lock down the device and prevent any form of user interaction until Apple Support is contacted.",
            "C: The crypto-hardware-derived system measurement root key (SMRK) would derive to a different value, causing a 'break' in the key hierarchy seal.",
            "D: The LocalPolicy modifications would be ignored, and the device would continue to function normally as if no changes had been made."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SKP Implications"
    },
    {
        "id": "8145debe-9097-46f9-ac5b-bdbe3cd1b5dc",
        "source": "owasp_wstg",
        "question": "An organization's security team is conducting a review of their web server's configuration to mitigate the risk of unauthorized data manipulation. Which HTTP method should they consider restricting due to its ability to modify existing resources, potentially leading to unauthorized updates if not properly secured?",
        "choices": [
            "A: GET, because it can retrieve sensitive information if not restricted.",
            "B: PATCH, as it can modify an object and should be secured to prevent unauthorized updates.",
            "C: HEAD, since it may expose metadata that could be leveraged in an attack.",
            "D: OPTIONS, as it lists available methods, potentially giving attackers information about the server."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "HTTP PATCH Method"
    },
    {
        "id": "03f29389-2ec1-4ec5-baa1-9ef989cf0519",
        "source": "attck",
        "question": "An organization's cybersecurity team has noticed irregular power setting configurations across several workstations that are not in accordance with their standard operating procedures. These changes are preventing the systems from entering standby mode and are suspected to be the result of a cyber threat actor's attempt to maintain persistence. Based on best practices, which of the following actions should the cybersecurity team prioritize to address this issue?",
        "choices": [
            "A: Monitor for unexpected changes to configuration files associated with the power settings of a system.",
            "B: Increase the frequency of data backups to ensure minimal data loss in case of sudden system shutdowns.",
            "C: Inspect the integrity of system files to detect potential rootkits that may be hiding on the system.",
            "D: Periodically inspect systems for abnormal and unexpected power settings that may indicate malicious activity."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Power Settings Manipulation"
    },
    {
        "id": "4d489625-524f-4792-aaab-99678def4c34",
        "source": "windows_security",
        "question": "In a security log entry, you encounter a Security ID (SID) that could not be resolved to an account name. What should be your next steps to handle this situation? (Select two)",
        "choices": [
            "A: Consult the security database to find the associated account, as SIDs are unique and never reused for different accounts.",
            "B: Disregard the event, as unresolved SIDs indicate a system error rather than a security issue.",
            "C: Attempt to correlate the SID with other security events that might have the same SID resolved to an account name.",
            "D: Consider the SID as a potential indicator of a compromised system, since unresolved SIDs are commonly used by attackers."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security Identifier (SID)"
    },
    {
        "id": "852ab672-9833-423d-8d3e-eeca53370b62",
        "source": "apple_platform_security",
        "question": "When setting up Auto Unlock between an Apple Watch and an iPhone, which of the following statements describe the security mechanisms involved in the initial exchange and subsequent communication between the devices?",
        "choices": [
            "A: The Apple Watch and iPhone use the Secure Enclave for negotiating an STS tunnel regardless of the underlying communication channel.",
            "B: AES-256-GCM or ChaCha20-Poly1305 encryption is used for Auto Unlock communication between an Apple Watch and an iPhone.",
            "C: A 32-byte unlock secret is generated by the Apple Watch and sent to the iPhone over a BLE connection during arm auto unlock.",
            "D: The unlock secret is stored permanently in the System keychain on the iPhone for future authentication sessions."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AutoUnlock"
    },
    {
        "id": "d323abf1-f2bd-4231-bedc-6d8ba5643d00",
        "source": "apple_platform_security",
        "question": "Which of the following actions would be least effective for maintaining the security of a company's mobile devices within a secure device management framework? (Choose all that apply.)",
        "choices": [
            "A: Allowing employees to access company data over unsecured public Wi-Fi networks.",
            "B: Implementing multi-factor authentication for device access.",
            "C: Regularly updating the company's mobile applications and operating systems.",
            "D: Creating a comprehensive user training program focused on recognizing phishing attempts."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "IneffectiveMeasures"
    },
    {
        "id": "1bbeec3b-f19b-4b7b-9852-aea6ca536ade",
        "source": "cs161_textbook",
        "question": "In reviewing the security of a blockchain ledger, you come across Block 4 in a hash chain. What aspects of Block 4 contribute to the overall security of the blockchain, and how do they prevent tampering with the ledger?",
        "choices": [
            "A: Block 4 contains a digest of all messages up to \\(m_4\\), which helps detect unauthorized modifications to previous blocks.",
            "B: Block 4 includes only the message \\(m_4\\), minimizing the block size and thus increasing the efficiency of the ledger.",
            "C: Block 4 contains a hash that does not depend on previous blocks, ensuring the privacy of earlier transactions.",
            "D: Block 4 includes the hash of Block 3, creating a chain that secures the integrity of the ledger by linking each block to its predecessor."
        ],
        "answer": "AD",
        "topics": [],
        "keyword": "BlockchainSecurity"
    },
    {
        "id": "58702a61-fae9-4209-8ff0-603f0945ec67",
        "source": "owasp_mastg",
        "question": "A mobile application uses JWT for stateless authentication. The server issues these tokens after validating user credentials. Which of the following practices should be implemented to ensure the security of the JWT-based authentication system?",
        "choices": [
            "A: The payload of the JWT must contain sensitive user data to ensure user identification for each request.",
            "B: A 'none' algorithm should be used in the JWT header to indicate that the token's integrity is verified.",
            "C: The JWT should include an 'exp' claim to indicate the expiration time, and the server must reject expired tokens.",
            "D: The secret used for the token's HMAC computation should be stored on the client side for token validation purposes."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "JWT"
    },
    {
        "id": "bde79bf0-870a-48a9-a4e5-6457d986d4b7",
        "source": "apple_platform_security",
        "question": "A cybersecurity consultant is evaluating the privacy and security aspects of Apple's Find My app for a client concerned about the potential for tracking and compromise of location data. Which aspects of Find My's design should the consultant highlight as addressing these concerns? (Choose all that apply.)",
        "choices": [
            "A: Find My uses a persistent public key for Bluetooth broadcasts, ensuring a constant identifier for the missing device.",
            "B: Find My's design ensures that participants' identities remain private from each other and from Apple.",
            "C: The public keys used by Find My for broadcasting are derived in a way that prevents them from being linked to the same device over time.",
            "D: Find My app relies solely on iCloud Keychain to sync the private encryption key pair among the user's devices."
        ],
        "answer": "BC",
        "topics": [],
        "keyword": "Find_My_Security"
    },
    {
        "id": "960d2171-2588-40f7-80c3-e028a4d41087",
        "source": "mit6.858",
        "question": "Considering the threat models and attack vectors described for SSL/TLS, which of the following measures would effectively mitigate the corresponding security issues?",
        "choices": [
            "A: Employing Cipher Block Chaining (CBC) to prevent an adversary from editing the ClientHello message undetected.",
            "B: Using authenticated padding bytes to prevent version roll-back attacks during the SSL 3.0 handshake.",
            "C: Requiring that the Finish message in the handshake protocol be preceded by a ChangeCipherSpec message to prevent attackers from dropping the ChangeCipher message.",
            "D: Covering block-cipher padding with the MAC to protect against padding oracle attacks like POODLE."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TLSHandshake"
    },
    {
        "id": "834ef7e9-7b4a-4287-9ece-d7966508e3ab",
        "source": "android_sec_doc",
        "question": "In the context of Android security, when discussing Keymaster's key attestation, which of the following statements correctly describes its purpose and the structure of the attestation certificate?",
        "choices": [
            "A: Key attestation is used to ascertain whether an asymmetric key pair is software-backed and to identify the limitations imposed on its use.",
            "B: The attestation certificate contains a 'subject' field with a value that varies for each certificate to uniquely identify the key.",
            "C: The 'attestKey' method performs a public key operation on the attested key and can generate an attestation without user authentication constraints.",
            "D: The attestation extension in the certificate excludes the 'Tag::USER_ID' and 'Tag::SECURE_USER_ID' because they carry significance only within the device."
        ],
        "answer": "CD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Key Attestation"
    },
    {
        "id": "8e1e1847-7502-4855-8914-4c2025002648",
        "source": "apple_platform_security",
        "question": "Consider the secure boot process for a Mac with Apple silicon, where the LocalPolicy file is signed by the Secure Enclave and the Owner Identity Key (OIK) plays a crucial role. What are the advantages and potential drawbacks of this design?",
        "choices": [
            "A: The design allows for the secure delegation of local security policy control to the Secure Enclave, enhancing the security against malicious software.",
            "B: Having a single OIK for all operating systems on the Mac simplifies the process of ownership handoff between different operating systems.",
            "C: The requirement for user passwords and measurements of the operating system to protect the OIK could be seen as a drawback due to potential user inconvenience.",
            "D: Storing the OIK on the BAA server provides an additional layer of security by separating the key storage from the local device."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecureBoot"
    },
    {
        "id": "9a49546c-15fd-4bc8-8ca4-b064790db03f",
        "source": "owasp_mastg",
        "question": "A mobile application developer is implementing encryption for sensitive user data. The developer opts to use symmetric encryption for performance reasons and decides to store encryption keys securely. Which of the following practices should the developer employ to ensure the security of the symmetric encryption keys? (Select two.)",
        "choices": [
            "A: Store the keys in the device's local file system alongside the encrypted data for easy access during decryption.",
            "B: Ensure the keys are stored using secure storage APIs provided by the mobile operating system.",
            "C: Use a static, hardcoded encryption key compiled into the app's code, relying on obfuscation for security.",
            "D: Employ a key-wrapping scheme with a master secret that is initialized for each user."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Symmetric Encryption Key Management"
    },
    {
        "id": "5e354441-18db-4a70-a240-4100cf14e442",
        "source": "android_sec_doc",
        "question": "A user has successfully changed their device password through the settings interface. Following this action, which sequence correctly represents the process that `vold` performs to re-encrypt the disk master key with the new password?",
        "choices": [
            "A: Trigger `vold.decrypt trigger_reset_main`, then `vold` sets `vold.encrypt_progress` to a percentage value.",
            "B: Set `vold.decrypt trigger_encryption`, then `vold` sets `vold.post_fs_data_done` to 1.",
            "C: `vold` receives the command `cryptfs changepw` and re-encrypts the disk master key with the new password.",
            "D: Set `vold.decrypt trigger_restart_min_framework`, then `vold` sets `ro.crypto.state encrypted`."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity"
        ],
        "keyword": "cryptfs changepw"
    },
    {
        "id": "efb33433-305d-4fb9-954a-cee99390c34e",
        "source": "android_sec_doc",
        "question": "When a user attempts to use their fingerprint to unlock their Android device, which of the following sequences correctly describes the operational flow?",
        "choices": [
            "A: The user touches the fingerprint sensor, the device wakes, `FingerprintService` processes the matching result, and then the vendor-specific library determines if there's a match.",
            "B: The `authenticate` call is made, the fingerprint sensor activates, the user places a finger, and the vendor-specific library checks for a match against enrolled fingerprints.",
            "C: The device wakes the screen, `FingerprintService` calls the `authenticate` function, and then the user places their finger on the sensor for matching.",
            "D: The fingerprint sensor wakes the device, the user places their finger on the sensor, and `FingerprintService` immediately verifies the fingerprint without consulting the vendor-specific library."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Operational Flow"
    },
    {
        "id": "88e60fd9-6509-416e-b7a7-7f016f201247",
        "source": "cs161_textbook",
        "question": "Considering a web application where the server reflects user input directly from an HTTP request into the response, which of the following measures would be effective in mitigating a reflected XSS vulnerability? (Choose all that apply)",
        "choices": [
            "A: Implementing server-side input validation to strip out any potential HTML or JavaScript code from the user input",
            "B: Using HTTPS instead of HTTP to ensure that the data is encrypted during transmission",
            "C: Applying HTML entity encoding to user input before including it in the response",
            "D: Increasing the complexity of the user input by allowing a wider range of characters"
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Input Sanitization"
    },
    {
        "id": "c39cb5d8-4324-4f91-9b39-2e9e14ffe55f",
        "source": "attck",
        "question": "Which of the following statements presents the strongest counterargument to the belief that detecting unauthorized email collection through auto-forwarding rules is straightforward due to the presence of specific artifacts in email headers?",
        "choices": [
            "A: Auto-forwarded messages contain platform-specific detectable artifacts in the header which can be monitored.",
            "B: Detection is challenging because auto-forwarded messages have the same presentation as manually forwarded messages, making them difficult to distinguish.",
            "C: Implementing stronger email encryption protocols will render header artifacts irrelevant.",
            "D: The presence of specific artifacts in email headers is a definitive indicator of compromise and requires no further investigation."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Email Header Artifacts"
    },
    {
        "id": "20b50c06-ba13-4a63-ba80-f9c030d4e4d4",
        "source": "cwe",
        "question": "What are the potential consequences of an HMAC engine not implementing an iterative function to break up messages longer than 512 bits into fixed-size blocks?",
        "choices": [
            "A: It may lead to weaker encryption and increase the risk of security breaches.",
            "B: The HMAC engine's performance may improve due to processing smaller messages only.",
            "C: It could result in the HMAC engine being more resilient to timing attacks.",
            "D: The engine may be unable to process certain messages, limiting its real-world application."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Iterative Function"
    },
    {
        "id": "cd5df9f5-0032-4e68-a37d-6673cca674a8",
        "source": "apple_platform_security",
        "question": "If an organization is designing a password management system with features similar to iCloud Keychain, what aspects of the iCloud Keychain's security and operational measures should be considered for implementation to ensure secure synchronization and recovery of passwords?",
        "choices": [
            "A: Passwords are stored on the organization's servers in plain text to facilitate easy recovery in case of user account issues.",
            "B: A syncing circle is created using public and private keys, which is then signed with a key derived from the user's account password for secure syncing between devices.",
            "C: The user's passwords are synced between devices without any form of encryption, relying solely on the security of the user's iCloud account.",
            "D: For two-factor authentication accounts, an additional syncing circle with its own set of asymmetric elliptical keys is created and stored in a secure cloud service."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "iCloud Keychain"
    },
    {
        "id": "16e4acc0-62b2-46d2-9ec1-925eaff61d8c",
        "source": "apple_platform_security",
        "question": "When a user adds a card to their Apple Wallet for use with Apple Pay, which of the following processes and security measures are involved?",
        "choices": [
            "A: The cardholder's full card number is stored within the Secure Element on the device.",
            "B: A unique Device Account Number is generated, encrypted, and then stored in the Secure Element.",
            "C: The provisioning process uses a series of server-side calls which do not utilize secure communication protocols.",
            "D: Apple shares information about the user's device and account activity with the card issuer during the Link and Provision process."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Provisioning"
    },
    {
        "id": "6e446d8b-19b8-4030-a6bb-2d00aeeeaf3f",
        "source": "attck",
        "question": "Which of the following malware uses the 'certutil' tool to download and execute a remote file, challenging the common assumption that all malware downloads files directly from a C2 server?",
        "choices": [
            "A: CARROTBAT",
            "B: Calisto",
            "C: Cobalt Strike",
            "D: Dipsind"
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "certutil Malware Technique"
    },
    {
        "id": "1d3d229d-6100-4b47-9aea-a3e808908c7b",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, why might using complex data types like Swift's String for processing sensitive information be problematic regarding memory management?",
        "choices": [
            "A: Complex data types like Swift's String are too inefficient for mobile applications, leading to performance issues.",
            "B: These complex data types can create multiple hidden copies in memory, which cannot be directly accessed for secure erasure.",
            "C: The use of complex data types like Swift's String is always secure as they are designed with built-in encryption.",
            "D: Memory management issues with complex data types are a myth; modern programming languages automatically handle security."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Memory Disclosure"
    },
    {
        "id": "59ececd8-32e5-45f8-b130-7eb835554413",
        "source": "mozilla_security",
        "question": "An online retailer has implemented a robots.txt file to manage which pages on their site should be indexed by search engines. However, they have noticed suspicious activity on pages that they attempted to disallow through the robots.txt file. Which of the following best explains why the robots.txt file did not prevent unauthorized access to sensitive pages?",
        "choices": [
            "A: The robots.txt file is designed to encrypt sensitive pages, but the encryption key was compromised.",
            "B: The robots.txt file is only a guideline for well-behaved web crawlers, and it does not prevent access by malicious bots or users.",
            "C: The server hosting the robots.txt file was down, leading to crawlers not being able to read the disallow directives.",
            "D: The robots.txt file increases the site's visibility to hackers by publicly listing sensitive URLs."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "robots.txt security limitations"
    },
    {
        "id": "88cb084a-a296-41a0-a956-01543b8dd03e",
        "source": "cwe",
        "question": "Consider the following code snippet in a Java application that reads and processes lines from a file. Identify the changes that would prevent the CWE 772: Missing Release of Resource after Effective Lifetime vulnerability from being exploited:",
        "choices": [
            "A: Enclose the file reading operation within a try-finally block, and place the file closing logic in the finally block.",
            "B: Allocate more memory to the Java Virtual Machine (JVM) to ensure that it has enough memory for garbage collection.",
            "C: Use a while loop to check the availability of file handles before attempting to open the file.",
            "D: Employ a connection pooling mechanism to reuse database connections efficiently."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ResourceRelease"
    },
    {
        "id": "f329cb7e-141c-4f4d-ac9c-3383c244c1cd",
        "source": "windows_security",
        "question": "When configuring a domain controller certificate for authentication of Microsoft Entra joined devices using Windows Hello for Business, which of the following criteria must be met according to the strict KDC validation security feature?",
        "choices": [
            "A: The domain controller's certificate must use any older certificate template.",
            "B: The domain controller's certificate's signature hash algorithm must be sha256.",
            "C: The domain controller's certificate's public key should be DSA (2048 Bits).",
            "D: The domain controller's certificate must not include the KDC Authentication extended key usage (EKU)."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "KDC Validation"
    },
    {
        "id": "0734d518-04ba-4615-a50b-cb7478088a26",
        "source": "owasp_mastg",
        "question": "You are tasked with reverse engineering a heavily obfuscated native binary for an Android application. Your goal is to perform low-level instruction tracing to uncover security vulnerabilities. Which combination of techniques would be the most efficient to achieve this goal?",
        "choices": [
            "A: Dynamic Binary Instrumentation using Valgrind and emulator-based tracing.",
            "B: Static analysis using a disassembler with manual control flow graph simplification.",
            "C: Using an iOS simulator to perform instruction-level tracing.",
            "D: Employing a commercial SaaS iOS emulator for dynamic analysis."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Dynamic Binary Instrumentation"
    },
    {
        "id": "a39601c2-5bce-40e4-8650-f00f6ebf4a33",
        "source": "cwe",
        "question": "Given that web browsers have significant variability in how they parse web pages, which of the following improvements to a denylist-based XSS protection mechanism is likely to be most effective?",
        "choices": [
            "A: Adding more entries to the denylist based on common XSS attack patterns.",
            "B: Switching to a whitelist-based approach that only allows known safe inputs.",
            "C: Regularly updating the denylist with new XSS payloads from recent web browser versions.",
            "D: Creating a denylist that only filters out JavaScript file extensions."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Whitelist"
    },
    {
        "id": "c21d2d77-7c3c-41a0-906a-d4d077039154",
        "source": "owasp_mastg",
        "question": "As a mobile app developer, you are updating your app's store listings to comply with new privacy initiatives. What is one of the key reasons for the introduction of privacy labeling systems like the App Store Nutrition Labels and Google Play Data Safety Section?",
        "choices": [
            "A: To allow developers to bypass traditional privacy policies with more user-friendly labels.",
            "B: To provide users with a detailed and technical breakdown of the app's source code.",
            "C: To help users easily understand how their data is being collected, handled, and shared.",
            "D: To ensure developers are recognized as legal experts in data protection laws."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Privacy Labeling Systems"
    },
    {
        "id": "1542ecec-bc85-4ecc-859c-1cd92eb04d0c",
        "source": "apple_platform_security",
        "question": "A company is implementing a Bring Your Own Device (BYOD) program and is considering using Apple devices. As an IT security administrator, which of the following features and management options should you consider to ensure secure device management and data protection?",
        "choices": [
            "A: Utilizing a separate, cryptographically protected APFS volume to store enterprise data on user-owned Apple devices.",
            "B: Enabling Device Enrolment to provide cryptographic separation of user and corporate data.",
            "C: Implementing User Enrolment to grant more limited privileges than unsupervised device enrolments and enable Managed Apple IDs.",
            "D: Applying Automated Device Enrolment to prevent users from removing the MDM profile on their personal Apple devices."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "BYOD"
    },
    {
        "id": "912204d4-c78e-4c5d-b6ee-c5b9e9ba4c3f",
        "source": "apple_platform_security",
        "question": "Evaluate the security features of the Password AutoFill system. Which of the following statements accurately reflect the benefits and potential security implications of using Password AutoFill?",
        "choices": [
            "A: Password AutoFill secures credentials by not exposing any password information to an app until the user consents to release a credential to the app.",
            "B: Password AutoFill prevents the reuse of passwords across different domains by alerting users when they attempt to save a reused password.",
            "C: Password AutoFill can cause a security risk as it saves passwords in plain text, making them vulnerable to unauthorized access.",
            "D: The system's Password Monitoring feature detects weak passwords by identifying patterns commonly used in brute force attacks."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "PasswordAutoFill"
    },
    {
        "id": "f308bc1a-dbd3-4d9d-9af3-d2aba109e067",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the security measures of an enterprise network that has recently been targeted by adversaries using remote services for initial access and persistence. Which of the following actions would be MOST effective in mitigating the risk of unauthorized access via external remote services?",
        "choices": [
            "A: Implementing multi-factor authentication for all remote service accounts",
            "B: Abandoning the use of traditional firewalls in favor of modern antivirus software",
            "C: Enabling remote desktop access without requiring VPN connections",
            "D: Decreasing the complexity of passwords for remote service accounts to ensure quick recovery in case of lockouts"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "c4df3074-6870-440b-b4fe-196d5ea302bb",
        "source": "cs161_textbook",
        "question": "Your company is revising its security policy to improve defenses against external attacks. Which of the following outcomes are likely to result from implementing a firewall that enforces a strict security policy limiting the visibility of network services to the outside world?",
        "choices": [
            "A: It will prevent all forms of external attacks, ensuring absolute security.",
            "B: The firewall may introduce a single point of failure if not properly configured and maintained.",
            "C: Users may experience disruptions in service due to overly restrictive access to essential network services.",
            "D: Network performance will significantly increase due to reduced traffic."
        ],
        "answer": "BC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "SecurityPolicy"
    },
    {
        "id": "99ad21b1-5ff5-4c21-bdb5-b45b047f3873",
        "source": "attck",
        "question": "Why might an adversary invest time in gathering detailed information about a victim's network topology and trust dependencies during the reconnaissance phase of an attack?",
        "choices": [
            "A: To identify potential points of ingress and map out the network for later stages of the attack.",
            "B: To immediately exploit vulnerabilities and gain unauthorized access to network resources.",
            "C: To estimate the cost of the network infrastructure for potential ransom demands.",
            "D: To prepare a detailed report on network security posture for the victim organization."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Network Topology"
    },
    {
        "id": "76c90f79-6f59-4df9-836c-ea2c942d5bda",
        "source": "attck",
        "question": "A financial institution has detected unusual patterns indicative of data manipulation within its transaction processing systems. The security team suspects that an adversary has gained access to implement fraudulent transactions mimicking legitimate behavior. To prevent further incidents, which of the following measures should the institution prioritize?",
        "choices": [
            "A: Encrypting important transaction information",
            "B: Implementing a strong email spam filter",
            "C: Increasing the password complexity requirements",
            "D: Upgrading the physical security of the data center"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Data Manipulation"
    },
    {
        "id": "6b18e8e2-e7af-428c-a337-23a038898b7a",
        "source": "owasp_wstg",
        "question": "How can security testing metrics directly influence risk management decisions within an organization?",
        "choices": [
            "A: By enabling business management to compare the application's performance against competitors' benchmarks.",
            "B: By providing a measure of risk for vulnerabilities, which helps business management decide on risk acceptance, mitigation, or transfer.",
            "C: By solely determining the financial budget allocated for the security department.",
            "D: By indicating the number of users who might stop using the application due to security flaws."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Security Testing Metrics"
    },
    {
        "id": "917a3891-25ad-4f06-91d5-a5d6c0ef6836",
        "source": "apple_platform_security",
        "question": "What privacy benefit does MAC address randomization provide for mobile devices in a wireless network environment?",
        "choices": [
            "A: It prevents the device from connecting to unsecured Wi-Fi networks.",
            "B: It helps in reducing the risk of intercepting Wi-Fi traffic by unauthorized users.",
            "C: It prevents passive observers from persistently tracking the device by its Wi-Fi traffic.",
            "D: It ensures that the Wi-Fi network remains hidden from unauthorized users."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Privacy"
    },
    {
        "id": "97118608-b5b2-4270-a900-3622783e4f58",
        "source": "cs161_textbook",
        "question": "Alice, a web developer, is tasked with improving the security of a user authentication system. The current system stores user passwords hashed with a cryptographic hash function. To enhance the security against potential attacks, which of the following practices should Alice implement? (Select all that apply)",
        "choices": [
            "A: Implement salting by adding random data to each password before hashing to prevent the use of rainbow tables.",
            "B: Increase the complexity of user passwords by enforcing password strength requirements to reduce the efficacy of common password lists.",
            "C: Use a slower hash function designed for password hashing, such as bcrypt, to reduce the feasibility of brute-force attacks.",
            "D: Store the plaintext passwords in a secure, encrypted database to prevent unauthorized access in case of a security breach."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PasswordHashing"
    },
    {
        "id": "ceccd25d-392a-4bd3-a6f0-7bd78dc19f9c",
        "source": "attck",
        "question": "A security analyst is evaluating a company's network defense strategy to mitigate the risk of data exfiltration over unconventional channels such as Bluetooth or RF. Which of the following methods would be effective in preventing such exfiltration attempts? (Select two)",
        "choices": [
            "A: Disable WiFi, Bluetooth, and other unnecessary RF channels on devices.",
            "B: Increase the strength of the WiFi signal to overpower potential unauthorized RF signals.",
            "C: Implement strict network firewall rules to block all outgoing traffic.",
            "D: Prevent the creation of new network adapters where possible."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Data Exfiltration Mitigation"
    },
    {
        "id": "3fd74316-dfd9-403f-9da3-428b49b4e4dc",
        "source": "apple_platform_security",
        "question": "Consider the scenario where a user is presenting their state ID from Apple Wallet to an identity reader. Which of the following security mechanisms are employed to protect the user's identity data during this process?",
        "choices": [
            "A: ISO/IEC 18013-5 compliant readers verify the user's ID using an issuer-provided signature.",
            "B: The user's device transmits identity data in plaintext to ensure compatibility with the widest range of identity readers.",
            "C: Session encryption is used to protect personally identifiable information (PII) exchanged over radio links.",
            "D: The user's private key for ID authentication is stored on Apple's servers for ease of recovery in case of device loss."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "IdentityDataTransmissionSecurity"
    },
    {
        "id": "3b49f4f2-856b-4228-9741-5185e158502a",
        "source": "mozilla_security",
        "question": "A website administrator is configuring the site's robots.txt file to manage web crawler access. Evaluate the implications of the following robots.txt configurations and select the scenarios where the configuration is appropriate:",
        "choices": [
            "A: Using robots.txt to disallow all user-agents from accessing the site for maintenance purposes.",
            "B: Using robots.txt to prevent sensitive directories like /admin from being indexed by search engines.",
            "C: Using robots.txt to enhance the security of the site by hiding the /secret directory.",
            "D: Using robots.txt to disallow all user-agents from indexing the entire site to maintain privacy."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "robots.txt"
    },
    {
        "id": "daa69515-79d7-44bb-aceb-91a3d7a403de",
        "source": "owasp_mastg",
        "question": "An Android application is using AES encryption with CBC block mode for data security. Considering the security benefits and the support provided by AndroidKeyStore, which of the following statements is an accurate counterargument to the use of CBC over GCM?",
        "choices": [
            "A: GCM should be preferred over CBC because GCM does not require separate authentication, whereas CBC does.",
            "B: CBC is more secure than GCM because it has been around longer and is better understood.",
            "C: CBC is preferable as it supports padding, which is not supported by GCM when used with AndroidKeyStore.",
            "D: GCM is not supported by AndroidKeyStore and therefore CBC remains the only viable block mode for AES encryption."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "AES block modes"
    },
    {
        "id": "0dadf73b-6454-4174-8018-db4add486894",
        "source": "owasp_wstg",
        "question": "Consider a web application developed in C where user input is used in a logging statement. A programmer wants to ensure that the logging of user input does not introduce a format string vulnerability. Which of the following code snippets correctly secures the logging statement against format string attacks?",
        "choices": [
            "A: printf(\"Log: \" + user_input);",
            "B: printf(\"Log: %s\", user_input);",
            "C: printf(user_input);",
            "D: fprintf(log_file, \"Log: \" + user_input);"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Format String Vulnerability"
    },
    {
        "id": "aeb79555-d153-4573-96ff-667f50608578",
        "source": "windows_security",
        "question": "You are an IT administrator tasked with creating a batch of virtual smart cards for your company's employees, which will be managed by your team. You decide to use the Tpmvscmgr command-line tool. When executing the command for creating these cards, which of the following configurations will ensure the cards can later be managed by a smart card management tool?",
        "choices": [
            "A: Use the command `tpmvscmgr.exe create /name \"EmployeeCard\" /AdminKey RANDOM /PIN DEFAULT` to allow for easy management by the IT team.",
            "B: Omit the `/generate` option and use default values to allow the card management system to take initial ownership of the virtual smart card.",
            "C: Specify the `/generate` option to create an unformatted card, ensuring it can be managed by a smart card management tool.",
            "D: Create the virtual smart card with a hardcoded administrator key for easy recall by the IT team and use the `/generate` option to format the card."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Command-Line Interface (CLI)"
    },
    {
        "id": "86ce528a-ba6d-4f03-8ede-e790e260f811",
        "source": "attck",
        "question": "In an effort to improve detection of adversarial activities, a cybersecurity team is considering monitoring certain aspects of network traffic. Which combination of data source and component should they prioritize to detect misuse of application layer protocols for malicious communication?",
        "choices": [
            "A: Analyzing network traffic content for anomalies in syntax and traffic patterns, combined with correlating unusual process execution and command line arguments.",
            "B: Monitoring network traffic flow to ensure compliance with organizational policies regarding data storage and transmission.",
            "C: Focusing on physical network components for signs of tampering that could indicate the presence of unauthorized network taps or devices.",
            "D: Implementing deep packet inspection for all inbound emails to scan for potential phishing attempts and malware."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Content"
    },
    {
        "id": "cca6002a-f0e7-43a3-bda8-f1a18d0ea40f",
        "source": "attck",
        "question": "In a hypothetical scenario, a security team has noticed an unusual spike in the use of system utilities associated with log access and exportation. To improve the detection of potential adversarial log enumeration activities, which detection method should the security team prioritize?",
        "choices": [
            "A: Monitor for the use of commands and arguments of utilities and other tools used to access and export logs.",
            "B: Monitor and restrict internet access to prevent adversaries from sending logs to external infrastructure.",
            "C: Implement strict password policies to reduce the risk of unauthorized access to logs.",
            "D: Monitor for increased CPU usage as an indicator of potential log enumeration."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command Execution Monitoring"
    },
    {
        "id": "3c45dc3d-fda7-498e-a5f7-a5c3e478c392",
        "source": "apple_platform_security",
        "question": "An organization is looking to protect its sensitive documents from unauthorized access and intellectual property theft. Which of the following measures would NOT be effective in safeguarding the organization's documents?",
        "choices": [
            "A: Implementing digital rights management (DRM) to restrict file access and usage.",
            "B: Using watermarks to trace unauthorized distribution of documents.",
            "C: Relying solely on a document's copyright notice for protection against theft.",
            "D: Employing encryption to secure document contents during transfer and storage."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Document Security"
    },
    {
        "id": "d95bc58f-fd64-4dd5-aa8f-1369424b9c42",
        "source": "cwe",
        "question": "A development team is working on a web form that accepts user-generated content to be displayed on a public blog. The form allows users to input text with basic formatting options. To prevent the improper neutralization of comment delimiters, which could lead to security vulnerabilities, what measures should the development team implement?",
        "choices": [
            "A: Develop a list of acceptable inputs that strictly conform to specifications, reject any input that does not, and consider properties such as length and type of input.",
            "B: Allow all user inputs without validation to ensure freedom of expression and rely on automated moderation tools to flag inappropriate content.",
            "C: Encode output by escaping all characters that do not pass an allowlist and wrap arguments in quotes after the escaping/filtering step.",
            "D: Permit users to submit any form of input, including scripts and HTML tags, assuming that client-side scripting will handle any potential security issues."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "CommentDelimiters"
    },
    {
        "id": "21ffc946-de7a-4bde-9cde-e451dcc07df2",
        "source": "owasp_wstg",
        "question": "In the context of web application discovery, which of the following statements is NOT a recommended practice?",
        "choices": [
            "A: Searching for applications on non-obvious URLs that may not be referenced elsewhere.",
            "B: Relying solely on the information provided by the client without verifying its completeness.",
            "C: Employing search engines with specific operators to find references to hidden applications.",
            "D: Considering the possibility of web applications being published on non-standard ports."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Web Application Enumeration"
    },
    {
        "id": "6e4d7c7d-8e9e-4880-901f-5c2a287587c2",
        "source": "apple_platform_security",
        "question": "A business is implementing Apple Messages for Business to communicate securely with its customers. Select the features that ensure the privacy and security of the users during this communication. (Select all that apply.)",
        "choices": [
            "A: A unique Opaque ID is generated for each user-business relationship to avoid sharing personal identifying information.",
            "B: Messages are stored on Apple's servers in unencrypted form for up to 30 days to allow message recovery.",
            "C: Businesses receive the user's phone number and iCloud account information for identification purposes.",
            "D: Messages are encrypted in transit between Apple's messaging servers and the business using TLS 1.2."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Messaging Security"
    },
    {
        "id": "b7232303-15bb-4c96-99a4-a480e28da950",
        "source": "attck",
        "question": "An organization is concerned about adversaries enumerating objects in their cloud storage infrastructure. As a security consultant, which of the following actions would you recommend to mitigate the risk of unauthorized cloud storage object discovery?",
        "choices": [
            "A: Restrict permissions related to object listing in cloud storage to necessary accounts only.",
            "B: Implement a web application firewall to automatically filter out malicious traffic.",
            "C: Enforce multi-factor authentication on all user accounts to prevent unauthorized access.",
            "D: Disable logging of cloud storage access to prevent adversaries from learning access patterns."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Storage Object Discovery"
    },
    {
        "id": "11b49f59-bfdc-4a2f-9bc0-cb7443befc50",
        "source": "owasp_wstg",
        "question": "A web application developer is implementing session management for a new application. To prevent session tokens from being compromised during transit, what measures should the developer take? Select two.",
        "choices": [
            "A: Enforce the use of HTTPS to ensure encryption of data during transmission.",
            "B: Configure session cookies with the Secure flag to prevent transmission over non-HTTPS connections.",
            "C: Implement session IDs within the URL parameters to streamline the session handling process.",
            "D: Allow caching of session tokens to reduce server load and improve response time."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTTPS"
    },
    {
        "id": "d7e421dd-d2a9-4eef-bafa-a1f34281eb98",
        "source": "owasp_mastg",
        "question": "As an iOS application security auditor, you are reviewing an application's user interface that includes UI components for entering and displaying sensitive information. What practices should you recommend to the development team to prevent sensitive data exposure?",
        "choices": [
            "A: Ensure sensitive information such as passwords is exposed in the UI to provide visual feedback to the user.",
            "B: Verify that no sensitive data is exposed via UI components unless explicitly required, and it should be properly masked when displayed.",
            "C: Take screenshots of the application when it goes into the background, including screens with sensitive information, for a better user experience.",
            "D: Allow keyboard caching for sensitive information to enhance the user's typing experience by providing suggestions and autocorrections."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "UI masking"
    },
    {
        "id": "71db5057-185d-4801-960a-c23ca4537e1e",
        "source": "attck",
        "question": "A cybersecurity analyst notices an unusual network traffic pattern where a certain process frequently receives encrypted data which then appears to be decrypted in-memory. The analyst suspects that a sophisticated piece of malware is at play. Which of the following decryption techniques is most consistent with this behavior?",
        "choices": [
            "A: Decoding the data using a static XOR key before decompressing with GZip",
            "B: Decrypting the payload via a XOR key with the hostname as part of the decryption process",
            "C: Utilizing a built-in operating system API call for decompression and decryption",
            "D: Invoking a PowerShell command to decode base64-encoded file contents on disk"
        ],
        "answer": "BC",
        "topics": [
            "MemorySafety",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "In-Memory Decryption"
    },
    {
        "id": "11ca3da8-2123-4329-9f4c-bbc511d41f07",
        "source": "cs161_textbook",
        "question": "In a system where confidentiality is as crucial as integrity and authenticity, which MAC function design would be most appropriate?",
        "choices": [
            "A: A MAC function that includes a part of the plaintext within the MAC to increase complexity.",
            "B: A MAC function that uses a deterministic algorithm based on a secret key without including the plaintext.",
            "C: A MAC function that tags each message with a random number before applying the MAC algorithm.",
            "D: A MAC function that applies multiple rounds of hashing to the message before generating the MAC."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "MAC Function Design"
    },
    {
        "id": "f5baf9a6-4f83-4552-ac2f-959c6f725e3b",
        "source": "cwe",
        "question": "Review the following pseudo-code for a feature toggle in a web application's settings page.\n\nif (userInput == 'enableFeatureX') {\n  displayMessage('Feature X is now enabled.');\n}\n\nGiven that Feature X is not yet implemented, what type of vulnerability does this code introduce?",
        "choices": [
            "A: Buffer Overflow",
            "B: SQL Injection",
            "C: Unimplemented or Unsupported Feature in UI",
            "D: Cross-Site Scripting (XSS)"
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Feature_Toggle"
    },
    {
        "id": "0b222fe7-3fd1-4f16-9169-d6635818e6cb",
        "source": "windows_security",
        "question": "You are tasked with securing the IT infrastructure for a newly established business that will be operating exclusively on the Windows platform. Which of the following measures should be prioritized to ensure a robust security posture? (Select two)",
        "choices": [
            "A: Implementing a comprehensive encryption strategy for data at rest and in transit",
            "B: Restricting administrative privileges to only top-level management personnel",
            "C: Configuring network security protocols and firewalls to protect against external threats",
            "D: Ensuring that all employees are trained in basic threat protection awareness"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "WebSecurity"
        ],
        "keyword": "Encryption Strategy"
    },
    {
        "id": "66c817eb-7fb2-4169-9904-54c0b9990403",
        "source": "owasp_mastg",
        "question": "In reviewing the source code for a mobile application, you come across the following snippet of code used for encrypting user data:\n\njava\nCipher cipher = Cipher.getInstance('DES/ECB/PKCS5Padding');\n\n\nAs a security consultant, what recommendation would you provide regarding the use of this encryption method?",
        "choices": [
            "A: Retain the use of DES/ECB as it is a certified and widely used encryption standard that provides strong security.",
            "B: Suggest replacing DES/ECB with a more secure alternative like AES-GCM-256 due to known vulnerabilities in DES and ECB mode.",
            "C: Advise to continue using DES/ECB but increase the key length to improve its security stance.",
            "D: Recommend the implementation of RC4 instead of DES/ECB to ensure faster encryption operations and backward compatibility."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DES Encryption"
    },
    {
        "id": "f700d18a-3d8d-4f3e-bd20-afa6eebfb5fe",
        "source": "attck",
        "question": "An adversary has gained access to a corporate network and plans to perform network configuration discovery to further their attack. Which of the following techniques or commands could the adversary use to gather network configuration details such as IP/MAC addresses, routing information, and adapter configurations? Select two.",
        "choices": [
            "A: Executing `net use` to map all shared resources on the network and list associated network configurations.",
            "B: Running `ipconfig /all` on a Windows system to display all current TCP/IP network configuration values.",
            "C: Using `ifconfig` on a Linux system to display the current network configuration for all interfaces.",
            "D: Invoking `dir /s` on a Windows system to recursively search for network settings files."
        ],
        "answer": "BC",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "ipconfig /all"
    },
    {
        "id": "4f260853-18a9-4add-b1df-66c2859d9b9e",
        "source": "cs161_textbook",
        "question": "In the context of securing a network that uses DHCP, which of the following statements are true regarding the limitations and possible defense strategies?",
        "choices": [
            "A: Using static IP addresses for all devices eliminates the risks associated with DHCP.",
            "B: DHCP vulnerabilities are best mitigated by employing Transport Layer Security (TLS) for all communications.",
            "C: The inherent risks of DHCP can be mitigated by relying on defenses at higher protocol layers, as lower layers are susceptible to spoofing attacks.",
            "D: DHCP-related security risks are completely mitigated by using MAC address filtering on network devices."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DHCP Defense"
    },
    {
        "id": "9c126e8f-4ee4-4252-a875-7e23ee899498",
        "source": "attck",
        "question": "An adversary is in the reconnaissance phase of an attack, aiming to collect information about a target organization's business operations and employee roles. Which of the following actions would be the most effective for the adversary to perform during this phase, and what could be a potential subsequent phase that these actions might facilitate?",
        "choices": [
            "A: Direct elicitation via phishing for information to discover roles and responsibilities, potentially aiding in establishing operational resources.",
            "B: Infiltrating the organization's secure intranet to modify financial records, potentially leading to fraudulent transactions.",
            "C: Launching a denial-of-service attack to disrupt business operations, potentially exposing network vulnerabilities.",
            "D: Deploying ransomware to encrypt critical files, potentially leading to extortion and financial gain."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Reconnaissance"
    },
    {
        "id": "2a26b7ae-f0d1-43ea-986a-3bf39e60f8fe",
        "source": "attck",
        "question": "An incident responder discovers a suspicious file on a network that seems to be part of a targeted attack. Preliminary analysis reveals that the file employs multiple layers of obfuscation and encryption to evade detection. Based on patterns observed in historical cyber threat activities, which of the following techniques could the malware be using to disguise its true nature? (Select two)",
        "choices": [
            "A: Decompressing itself using a custom LZM algorithm after applying a XOR operation",
            "B: Employing a custom algorithm that uses the system's uptime as a decryption key",
            "C: Using base64-decoding followed by AES decryption of its configuration data",
            "D: Encrypting command and control instructions using a Caesar cipher with a fixed shift"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Malware Encryption"
    },
    {
        "id": "a2c51ca4-5b22-471e-99e9-ea6351fa14e3",
        "source": "owasp_mastg",
        "question": "You are configuring a man-in-the-middle (MITM) attack for a mobile penetration test using an external USB WiFi card and a separate wired network interface on a Kali Linux system. You have ensured that your USB WiFi card supports access point (AP) mode. Select the configuration steps necessary to route the traffic from the mobile devices through your host computer to the target network:",
        "choices": [
            "A: Set up the USB WiFi card with hostapd to create an AP network, configure dnsmasq for DHCP services, and use iptables to forward traffic from the AP network to the wired interface.",
            "B: Install a VPN service on the host computer to automatically route all mobile device traffic through the host to the target network.",
            "C: Configure the USB WiFi card to use promiscuous mode to capture all inbound and outbound traffic without setting up an access point.",
            "D: Use airmon-ng to put the USB WiFi card into monitor mode and configure the host computer as a router using the route command."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Man-in-the-Middle Attack"
    },
    {
        "id": "dfdc11fe-81eb-4656-b376-a896e703e41b",
        "source": "attck",
        "question": "During a review of security logs in a Linux environment, a security analyst observes alerts triggered by auditd related to the differential between a user's actual and effective IDs, indicating the execution of the sudo command. Which of the following events should the analyst investigate to identify potential abuse of elevation control mechanisms?",
        "choices": [
            "A: Executions of /usr/libexec/security_authtrampoline and changes in the sudoers file directives.",
            "B: Instances of cmd.exe connecting to a named pipe from a services.exe parent process.",
            "C: Registry settings modifications indicative of UAC bypass techniques on the Linux system.",
            "D: Cloud API calls to assume additional roles and just-in-time access approvals."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "auditd"
    },
    {
        "id": "0e8577ca-0792-4d35-9be0-46042162b2fc",
        "source": "owasp_wstg",
        "question": "You are tasked with testing the security of a web application that is known to have a SQL injection vulnerability and uses a MySQL database backend. The database version in use is MySQL 4.1.x. Which of the following SQL injection techniques would you be able to use to exploit the vulnerability given the MySQL version?",
        "choices": [
            "A: UNION-based SQL injection",
            "B: Subquery-based SQL injection",
            "C: Trigger-based SQL injection",
            "D: Stored procedure-based SQL injection"
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "c547da8e-a6b0-44cd-b5cb-07beda081073",
        "source": "attck",
        "question": "An adversary with regular user privileges is attempting file and directory discovery on a host system. Which of the following system requirements could hinder the adversary's ability to discover certain files or directories?",
        "choices": [
            "A: Files located in public directories that require no special permissions.",
            "B: Folders requiring Administrator or SYSTEM permissions.",
            "C: Files that are stored on an external backup drive, currently unplugged.",
            "D: Directories that are indexed by the system's search functionality."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Access Controls"
    },
    {
        "id": "8f4de3bc-729b-4a6f-929c-f5b9fd23bb9a",
        "source": "cwe",
        "question": "An operational technology (OT) product used in critical infrastructure is being evaluated for security concerns before deployment. As a security analyst, you are presented with the task of assessing the authentication mechanism of the product. Which of the following characteristics, if present in the product's credentials, would indicate the use of weak authentication methods?",
        "choices": [
            "A: Credentials that are generated using a complex algorithm and are unique to each device.",
            "B: Credentials that are hard-coded into the device and cannot be changed post-deployment.",
            "C: Credentials that have a default value which is the same across multiple installations but can be altered by the administrator.",
            "D: Credentials that are generated based on environmental variables and change with each session."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "WeakCredentials"
    },
    {
        "id": "43bbe213-bae2-400e-ac1a-a312c848e03c",
        "source": "owasp_mastg",
        "question": "An iOS developer wishes to ensure that a private key used for ECC-based signing operations is securely generated and stored in the Secure Enclave on devices running iOS 9 or later. Which code snippet correctly configures the key generation parameters for this purpose?",
        "choices": [
            "A: let parameters = [kSecAttrKeyType as String: kSecAttrKeyTypeEC, kSecAttrKeySizeInBits as String: 256, kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave]",
            "B: let parameters = [kSecAttrKeyType as String: kSecAttrKeyTypeRSA, kSecAttrKeySizeInBits as String: 2048, kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave]",
            "C: let parameters = [kSecAttrKeyType as String: kSecAttrKeyTypeEC, kSecAttrKeySizeInBits as String: 256, kSecAttrTokenID as String: kSecAttrTokenIDNone]",
            "D: let parameters = [kSecAttrKeyType as String: kSecAttrKeyTypeAES, kSecAttrKeySizeInBits as String: 256, kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave]"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Secure Enclave"
    },
    {
        "id": "a4c7a570-219f-472e-a3c0-dbfe36975388",
        "source": "cs161_textbook",
        "question": "An organization implements a policy where every high-level decision must be approved by a committee of seven members to prevent unilateral actions. However, this has slowed down the decision-making process significantly. Select the most valid counterargument to the belief that more approvers inherently lead to better security as per the 'Separation of responsibility' principle.",
        "choices": [
            "A: Having multiple approvers can introduce complexity and slow down processes without necessarily increasing security if all members are not fully accountable.",
            "B: The committee members might develop a groupthink mentality, which could lead to faster decision-making but not necessarily better security decisions.",
            "C: A single, well-trained and trustworthy individual can make decisions more quickly and with as much security as a committee.",
            "D: The security of decisions is not related to the number of approvers but rather to the robustness of the security systems in place."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Decision-making security"
    },
    {
        "id": "5c3f5e40-ad06-4687-a343-af02b91e8ddf",
        "source": "cwe",
        "question": "In an audit of a company's data sanitization process for decommissioned servers, it was found that merely overwriting memory cells was insufficient to prevent data recovery. What physical properties of hardware could contribute to this inadequacy and what mitigation strategy could address this issue?",
        "choices": [
            "A: The adhesive quality of stickers on the servers may retain data imprints; applying RFID tags to track decommissioned hardware for complete destruction could mitigate this.",
            "B: Screen burn-in may display the last shown information; implementing screen dimming technology could mitigate this effect.",
            "C: Magnetic media remanence can retain data; degaussing the drives before disposal could prevent data recovery.",
            "D: The residual charge of ROMs/RAMs could allow data recovery; physically destroying the memory chips could prevent this."
        ],
        "answer": "CD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SanitizationProcess"
    },
    {
        "id": "f89c3dfe-49c6-4109-bb00-a9740459e10b",
        "source": "apple_platform_security",
        "question": "Consider the security measures Apple implements to protect user data on iOS devices. If an attacker gains physical access to an encrypted backup of an iOS device, which of the following factors would most likely contribute to the security of the data against brute-force attacks?",
        "choices": [
            "A: The keybag is protected with a simple four-digit backup password, which is run through 1,000 iterations of the key derivation function PBKDF2.",
            "B: The keybag is protected with a strong, complex password and is processed through 10 million iterations of the key derivation function PBKDF2.",
            "C: The backup keybag is created with a new set of keys for each backup, but the data is not re-encrypted, allowing for faster backup creation.",
            "D: The UID-derived key wrapping non-migratory keychain items is maintained during backups, which prevents data access on a different device."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Backup_Security"
    },
    {
        "id": "5a1f53b4-4828-4f77-aee3-6310ceb717b2",
        "source": "windows_security",
        "question": "An administrator claims that using a Windows Information Protection (WIP) policy to classify and protect only a subset of enterprise data is a security risk because it may leave other data unprotected. Which of the following statements provides the best counterargument to this claim?",
        "choices": [
            "A: Classifying a subset of data based on criticality ensures that protection efforts are focused and user productivity is not hindered by overclassification.",
            "B: It is more secure to classify all data as non-enterprise data to prevent accidental leaks of sensitive information.",
            "C: Data should only be classified by automated systems without any administrator input to ensure unbiased protection.",
            "D: The best security practice is to avoid classifying data altogether to prevent complexity in managing protection policies."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Data Classification"
    },
    {
        "id": "9438b59d-8596-4948-a8ff-0a0bb85ec3f5",
        "source": "attck",
        "question": "As a security analyst in charge of monitoring container activity, you are tasked with detecting the unauthorized build and deployment of container images on hosts. Which of the following data sources and components should you monitor? (Select two)",
        "choices": [
            "A: Image creation events to detect unexpected Docker image build requests.",
            "B: CPU usage spikes to identify potential unauthorized container deployments.",
            "C: Network connection creation to monitor for established communications with previously unseen anomalous IPs.",
            "D: USB device connections to identify potential physical breaches in container host security."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Image Creation Monitoring"
    },
    {
        "id": "a530034d-1b3f-455d-be95-6766e9a44a77",
        "source": "android_sec_doc",
        "question": "A system administrator is evaluating SELinux permissions for Keystore 2.0 to prevent the unnecessary exposure of sensitive key material. Which of the following permissions should be granted to a service responsible for adding authentication tokens but not for using or managing key material?",
        "choices": [
            "A: `use` and `manage_blob`",
            "B: `add_auth` and `list`",
            "C: `grant` and `rebind`",
            "D: `clear_ns` and `unlock`"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SELinux permissions"
    },
    {
        "id": "eb10327b-3e59-47ff-8f22-6bee7812e464",
        "source": "windows_security",
        "question": "In an effort to optimize performance for critical applications, your company is considering allowing certain user accounts to 'Increase scheduling priority'. What are the primary security considerations you must evaluate before implementing this change?",
        "choices": [
            "A: Ensuring that the users' accounts have strong passwords to prevent unauthorized access.",
            "B: Assessing the risk of unauthorized users potentially exploiting this setting to gain elevated privileges.",
            "C: Verifying that the firewall settings are configured to block all inbound connections.",
            "D: Checking compatibility with antivirus software to prevent conflicts with real-time scanning features."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Policy"
    },
    {
        "id": "fbe07b19-1115-46f5-ba8a-5c1e942e301d",
        "source": "cwe",
        "question": "When designing a new cryptographic system that requires random number generation, which of the following approaches should you consider to ensure that the Pseudo-Random Number Generator (PRNG) used provides adequate entropy?",
        "choices": [
            "A: Implement a PRNG that re-seeds itself periodically using a hardware-based source of entropy.",
            "B: Select a PRNG that strictly adheres to FIPS 140-2 standards, with particular emphasis on the guidance provided in Annex C.",
            "C: Opt for a PRNG that provides a predictable amount of strength and avoids failing in a weak manner even if it does not always use strong random data.",
            "D: Design the system to use a PRNG that relies solely on software-based entropy sources, as they are more predictable and easier to manage."
        ],
        "answer": "ABC",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "PRNG"
    },
    {
        "id": "244df2cc-e22f-4395-a2c2-bbae1b9c9539",
        "source": "mit6.858",
        "question": "A company decides to adopt WebAssembly for software fault isolation in their new web application to run high-performance code. As a cybersecurity expert, you are tasked to evaluate the decision. Given the considerations for using WebAssembly, which of the following statements are accurate concerning the advantages and limitations of WebAssembly for software fault isolation?",
        "choices": [
            "A: WebAssembly provides a consistent performance advantage due to its ability to translate into native code, bypassing the need for an interpreter.",
            "B: WebAssembly can be deployed without requiring special privileges or pre-configured systems by administrators, unlike containers or VMs.",
            "C: WebAssembly requires developers and devices to cooperate, which can be a limitation compared to containers or VMs that can run existing Linux applications without modification.",
            "D: WebAssembly's reliance on hardware or OS support for isolation makes it less flexible than other mechanisms that also provide hardware support."
        ],
        "answer": "ABC",
        "topics": [
            "SoftwareSecurity",
            "WebSecurity"
        ],
        "keyword": "WebAssembly"
    },
    {
        "id": "bb73d512-538a-47f4-8be7-d2b431e7f1d3",
        "source": "cs161_textbook",
        "question": "A web application uses the following Python code snippet to execute arithmetic operations based on user input: `result = eval(user_input)`. Considering the risk of code injection attacks, which of the following inputs could potentially lead to unintended code execution on the server if user input is not properly sanitized? Select all that apply.",
        "choices": [
            "A: 4*5; import os; os.system('ls /')",
            "B: '4' + '5'",
            "C: 4 - 5 if (1==1) else 0",
            "D: 4/0; __import__('os').system('shutdown -h now')"
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "6fb2594e-757c-4ac3-8547-4d123afcaf6c",
        "source": "cs161_textbook",
        "question": "An online service provider is reviewing strategies to mitigate Application Level DoS attacks. Which of the following strategies could be beneficial and what are potential downsides for each?",
        "choices": [
            "A: Implementing quotas to restrict each user to a limited amount of resources, but this might limit the functionality for legitimate power users.",
            "B: Requiring a complex authentication method for every request, which could inadvertently become a bottleneck and a target for DoS attacks.",
            "C: Isolating user sessions to prevent one user's actions from affecting others, potentially leading to increased overhead and complexity.",
            "D: Introducing a proof-of-work system such as CAPTCHAs, which could deter casual users and reduce the overall user experience."
        ],
        "answer": "ABCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DoS_Mitigation_Strategies"
    },
    {
        "id": "ee80948b-94d0-4f67-9c93-31f75fd97173",
        "source": "owasp_mastg",
        "question": "In a design review for a new Android mobile application, the following network architecture decisions are being considered. Identify the options that would enhance the application's network security.",
        "choices": [
            "A: Implementing a VPN tunnel for all data transmissions to obfuscate traffic from potential eavesdroppers.",
            "B: Disabling SSL/TLS to reduce handshake overhead and improve performance.",
            "C: Using a third-party service for handling OAuth 2.0 authentication to offload security responsibilities.",
            "D: Storing API keys in the application code to streamline the development process."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "OAuth 2.0"
    },
    {
        "id": "bfda1ac7-8ea2-419a-a993-8a559eb5cae3",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, why might reliance on iOS's built-in security features alone be insufficient for ensuring the security of a mobile application?",
        "choices": [
            "A: Because iOS built-in security features can be easily bypassed using common exploitation techniques.",
            "B: Because relying solely on platform security features ignores the application layer vulnerabilities that could be exploited.",
            "C: Because built-in security features are always less secure than third-party security solutions.",
            "D: Because iOS does not provide any built-in security features, making third-party solutions necessary."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Application layer vulnerabilities"
    },
    {
        "id": "1157b6bf-e63d-4484-9fc8-3a5e6ec63f21",
        "source": "apple_platform_security",
        "question": "When initializing a Mac with Apple silicon, several security keys and certificates are generated and managed. Suppose you are configuring a new Mac device and are in the process of setting up the secure boot environment. What are the correct steps and components involved in this initialization process?",
        "choices": [
            "A: The Secure Enclave generates a User Identity Key (UIK) which is then certified for Activation Lock, including constraints for validation-time enforcement on the LocalPolicy.",
            "B: A LocalPolicy file is signed by the Basic Attestation Authority (BAA) server before being sent back to the device.",
            "C: During the creation of a LocalPolicy, RemotePolicy constraints are applied to ensure the policy contains the ECID of the Mac and the specific Remote Policy Nonce Hash (rpnh).",
            "D: The Owner Identity Key (OIK) is generated and stored securely on the BAA server to ensure it can be accessed during recoveryOS boot operations."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Initialization"
    },
    {
        "id": "2615a6e1-a0c7-463d-a741-f98418a139d0",
        "source": "cs161_textbook",
        "question": "You are tasked with selecting a mechanism for generating encryption keys in a new software product that requires cryptographic security. Which of the following methods would be considered secure and appropriate, keeping in mind the need for unpredictability and high entropy?",
        "choices": [
            "A: Sampling data from a CPU's thermal noise patterns.",
            "B: Using a deterministic algorithm that produces bits computationally indistinguishable from true random bits.",
            "C: Generating keys based on the sequence of predictable time intervals, such as minutes of the day.",
            "D: Utilizing a biased physical process, such as a loaded dice that favors certain outcomes."
        ],
        "answer": "AB",
        "topics": [],
        "keyword": "Randomness"
    },
    {
        "id": "8477d241-1cee-43b3-9faa-d42068a0eaad",
        "source": "windows_security",
        "question": "Why is device health attestation a critical component in implementing the Zero Trust security model within an organization?",
        "choices": [
            "A: Because it allows unlimited access to corporate resources once a device passes a one-time health check.",
            "B: Because it provides continuous monitoring of user activity to prevent unauthorized data access.",
            "C: Because it confirms that a device is in a good state and has not been tampered with before granting access to corporate resources.",
            "D: Because it simplifies the user authentication process by replacing multi-factor authentication with device health checks."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Zero Trust"
    },
    {
        "id": "79087488-9744-4b73-ad85-87a37481c1da",
        "source": "attck",
        "question": "In an enterprise network environment, the security team has been alerted to a potential Resource Hijacking due to abnormal resource consumption patterns. Which of the following measures is least likely to aid in the identification and mitigation of the Resource Hijacking activity?",
        "choices": [
            "A: Searching for the presence of known cryptomining file artifacts on the system.",
            "B: Monitoring for the creation of network connections to cryptocurrency-related hosts.",
            "C: Enforcing password complexity policies across the organization.",
            "D: Analyzing network traffic for uncommon data flows from processes that typically do not require network communication."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Cryptomining Detection"
    },
    {
        "id": "ef740d57-6703-4b92-b0ce-f386209e4a1c",
        "source": "cwe",
        "question": "In the context of protecting data-structure sentinels from deletion or modification, which mitigation strategy would provide a fundamental solution rather than a partial one?",
        "choices": [
            "A: Using an abstraction library to abstract away risky APIs during the architecture and design phase.",
            "B: Running or compiling the software using features or extensions that automatically provide a protection mechanism against buffer overflows.",
            "C: Utilizing OS-level preventative functionality during operation.",
            "D: Implementing a wrapper interface that enforces strict access controls to the data-structure sentinels."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategies"
    },
    {
        "id": "4524d52f-d964-495d-a83c-10748028baff",
        "source": "attck",
        "question": "Your network is configured to use SNMP for device management, and you are evaluating the security controls in place to defend against unauthorized SNMP queries. Which of the following statements is a valid counterargument to the claim that 'Configuring intrusion prevention devices to only log SNMP queries from unauthorized sources is sufficient for security'?",
        "choices": [
            "A: Logging SNMP queries does not prevent unauthorized access; intrusion prevention devices should be configured to detect and block such queries.",
            "B: Intrusion prevention devices are not capable of detecting SNMP queries, thus logging is the only feasible option.",
            "C: SNMP queries are generally harmless, and focusing on prevention is likely to disrupt legitimate network management tasks.",
            "D: You should only monitor SNMP traffic during off-peak hours to minimize the impact on network performance."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Intrusion Prevention"
    },
    {
        "id": "cef987e0-803a-47a9-9c34-2d4c87dc5553",
        "source": "windows_security",
        "question": "What actions does Windows take to ensure the security and validity of certificates within its public key infrastructure?",
        "choices": [
            "A: Automatically updates the certificate trust lists (CTL) daily to validate certificates.",
            "B: Uses a static list of trusted root certificates that cannot be updated by administrators.",
            "C: Revokes certificates by adding them to the CTL as trusted certificates.",
            "D: Offers enterprise certificate pinning to prevent man-in-the-middle attacks by restricting certificate chains."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "Cryptography"
        ],
        "keyword": "Certificate Pinning"
    },
    {
        "id": "fcb02501-c22d-47e8-803d-dde0b3bd6c88",
        "source": "apple_platform_security",
        "question": "An iPhone user has configured Face ID for authentication. Under which conditions will Face ID augment its stored mathematical representation of the user's face based on the information provided?",
        "choices": [
            "A: Face ID will augment its data with the new mathematical representation after every successful match to continuously improve its accuracy.",
            "B: If Face ID fails to recognise the user's face but the subsequent passcode entry is immediate and the match quality is above a certain threshold, Face ID will augment its enrolled data with the new capture.",
            "C: Face ID updates its mathematical representation only when the user opts to reset Face ID, ensuring that the user's facial changes are comprehensively captured.",
            "D: Face ID captures and stores images during normal operation for future reference and comparison, enhancing the likelihood of a match."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "FaceIDAugmentation"
    },
    {
        "id": "7f236906-85ab-46cd-88c8-9ab8908121cf",
        "source": "owasp_wstg",
        "question": "In a web application security assessment, you observe the following discrepancies when making multiple requests to the same domain: inconsistent system times, different internal IP addresses in error messages, and varied server responses to Server-Side Request Forgery (SSRF) attempts. Based on these observations, which component is likely in use in front of the backend servers?",
        "choices": [
            "A: Web Application Firewall (WAF)",
            "B: Content Delivery Network (CDN)",
            "C: Load Balancer",
            "D: Network Intrusion Detection System (IDS)"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Load Balancer"
    },
    {
        "id": "16374e76-2440-46bd-be97-556210b15d83",
        "source": "mozilla_security",
        "question": "A developer is implementing security measures to protect sensitive data on a web application. One of the measures requires ensuring that a user's navigation path cannot be traced through referrer headers when they click on external links. Which of the following policies should the developer implement to meet this security requirement?",
        "choices": [
            "A: Content Security Policy (CSP) with a 'default-src' directive set to 'none'",
            "B: Referrer Policy with a directive to 'no-referrer'",
            "C: Cross-Origin Resource Sharing (CORS) policy with 'Access-Control-Allow-Origin' set to '*'",
            "D: HTTP Strict Transport Security (HSTS) policy with a max-age set to 31536000"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Referrer Policy"
    },
    {
        "id": "db12a597-7279-4c76-bad3-978864ed4444",
        "source": "windows_security",
        "question": "You are configuring a Windows 10 system to enhance its security against modern threats. Which of the following is NOT a legitimate configurable mitigation option provided by Windows 10 to protect against software exploits and other threats?",
        "choices": [
            "A: Windows Defender SmartScreen to prevent malicious applications from being downloaded",
            "B: Credential Guard to protect against Pass-the-Hash or Pass-the-Ticket attacks",
            "C: Enterprise certificate pinning to secure internal domain names from unwanted certificates",
            "D: Macro Defender to prevent macro-based malware from executing in Office documents"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Configurable security mitigations"
    },
    {
        "id": "fc586af6-6ebf-406a-a975-7483e10f0bf9",
        "source": "owasp_mastg",
        "question": "When developing a mobile application that renders user-provided data within a WebView, which of the following practices should be employed to prevent XSS vulnerabilities?",
        "choices": [
            "A: Only escape the '<' and '>' characters because they are the most critical in preventing HTML tag injection.",
            "B: Ensure that six control characters are escaped when data is rendered in an HTML context, including &, <, >, \", ', and /.",
            "C: It's sufficient to validate input for known bad patterns like '<script>' tags to prevent XSS.",
            "D: Avoid rendering any untrusted data in interpreted contexts, and if absolutely necessary, apply appropriate encoding such as HTML entity encoding."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTML entity encoding"
    },
    {
        "id": "28307634-cb9d-4021-8918-0fa8eaa52f80",
        "source": "attck",
        "question": "In designing a network access control system to prevent adversaries from exploiting valid accounts, which of the following would most effectively mitigate the risk of unauthorized lateral movement?",
        "choices": [
            "A: Implementing strict file permissions based on user roles.",
            "B: Configuring network segmentation and firewall rules to limit access.",
            "C: Deploying a network intrusion detection system to monitor traffic.",
            "D: Applying regular patches to all end-user devices."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Lateral Movement"
    },
    {
        "id": "064ed10c-1f35-4570-a304-eead6f164d2a",
        "source": "apple_platform_security",
        "question": "When discussing the security of access keys in Apple Wallet, a colleague suggests that the privacy and security measures Apple implements are excessive. Based on the described features in Apple Wallet, select the most compelling reasons to counter this claim:",
        "choices": [
            "A: Apple's privacy measures ensure that the use of keys is not tracked or stored, maintaining user confidentiality.",
            "B: Access keys are stored outside of the Secure Element of compatible devices, which could potentially allow for easier extraction and duplication.",
            "C: Two-factor authentication is required for iCloud account sign-in, adding an extra layer of security for provisioning access keys.",
            "D: Partners are not provided with anonymized device identifiers, which prevents them from controlling the number of provisioned access keys."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Privacy"
    },
    {
        "id": "7d53d175-59d3-4002-b8ff-bdfcd5681167",
        "source": "cs161_textbook",
        "question": "In what scenario is the use of cryptographic hashes particularly inappropriate?",
        "choices": [
            "A: Verifying that a downloaded file has not been tampered with during transmission.",
            "B: Decrypting a message to reveal its original contents.",
            "C: Confirming that a message has not been altered since a digital signature was computed.",
            "D: Ensuring that a password is not stored in plain text in a database."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "Hashes"
    },
    {
        "id": "d0d4dcad-a18a-4485-a459-43f1b80ccfcf",
        "source": "mit6.858",
        "question": "You are a security analyst tasked with finding security vulnerabilities in a large, complex web application. Considering the information from the lecture on bugs and symbolic execution, which two of the following methods would you prioritize to ensure a more comprehensive search for deep, application-specific bugs?",
        "choices": [
            "A: Employ fuzzers to generate a high volume of random inputs, hoping to trigger unexpected behavior and catch simple bugs like buffer overflows.",
            "B: Write an extensive suite of unit tests that cover all known functionalities and past bugs, ensuring that these issues do not reoccur.",
            "C: Use symbolic execution to explore various paths in the application's code, aiming to find bugs that would be difficult to trigger through random testing.",
            "D: Manually review the source code line by line, relying on expert knowledge to identify potential security vulnerabilities."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "bug-finding"
    },
    {
        "id": "7f261b67-2ddd-49c1-8b36-828d0b61c6d7",
        "source": "mit6.858",
        "question": "Consider the security design for a new web service that requires user authentication. As a security architect, you must choose authentication mechanisms that balance ease of use, security, and recovery capabilities. Which of the following approaches would you recommend incorporating into the design, and why?",
        "choices": [
            "A: Implementing a simple first-come first-served registration system with mandatory complex passwords changed every 30 days.",
            "B: Utilizing two-factor authentication to complement passwords, thereby adding an additional layer of security.",
            "C: Storing plain text passwords in the database for ease of recovery and simplifying the login process for users.",
            "D: Employing a combination of password managers, biometrics, and single-sign on systems to enhance both security and user convenience."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "authentication"
    },
    {
        "id": "c533748d-973b-4b11-856d-0aa44e424d8b",
        "source": "owasp_mastg",
        "question": "In designing an authentication system for an iOS mobile application, which of the following methods would enhance the security of user authentication?",
        "choices": [
            "A: Use simple session tokens that remain valid indefinitely for user convenience.",
            "B: Employ biometric authentication supported by iOS, combined with fallback to a PIN or password.",
            "C: Implement a four-digit PIN authentication as the sole method for user access.",
            "D: Allow users to authenticate through a third-party social media account without additional checks."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Authentication Mechanisms"
    },
    {
        "id": "abec6922-8e29-4f9c-a9aa-cd6064468db9",
        "source": "owasp_wstg",
        "question": "A web application utilizes a microservice-based architecture, with multiple services running in containers orchestrated by Kubernetes, and exposed through a single API gateway. When conducting security testing on this application, which of the following factors should you consider?",
        "choices": [
            "A: Since the microservices run on Kubernetes, no authentication testing is required as Kubernetes ensures secure authentication for all services.",
            "B: Testing should include an assessment of the API gateway for potential misconfigurations that could lead to unauthorized access to individual microservices.",
            "C: You should focus exclusively on static storage security, as microservices typically do not handle dynamic content or databases.",
            "D: The use of multiple languages in microservices can suggest their presence, which may be verified by looking for detailed error messages."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Microservice Architecture"
    },
    {
        "id": "7b9eb73a-ffb4-4414-807a-a8192c0584cf",
        "source": "mit6.858",
        "question": "Consider the principles of privilege separation as applied in the OKWS web server system. Evaluate the roles of different components and their associated security implications. Which of the following statements are correct concerning the security design and potential vulnerabilities in the OKWS system?",
        "choices": [
            "A: The dbproxy service is designed to prevent SQL injection attacks by accepting RPCs instead of SQL queries directly from services.",
            "B: A buffer overflow vulnerability in the profile editor service could potentially expose user passwords because it has access to the entire database.",
            "C: The design of OKWS allows the oklogd service to modify or delete log entries, which could be exploited by an attacker to cover their tracks.",
            "D: Per-user isolation in OKWS is deemed too expensive because the overhead of processing an HTTP request is much lower than that of starting or maintaining a separate process for each user."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PrivilegeSeparation"
    },
    {
        "id": "9b25110d-6e6e-4ad1-b44b-7092437c2651",
        "source": "apple_platform_security",
        "question": "You are advising on the secure boot policy settings for a Mac with an Apple T2 Security Chip. What are the implications of setting the secure boot policy to Full Security or Medium Security?",
        "choices": [
            "A: Full Security ties the version of macOS to the specific Mac, preventing rollback attacks.",
            "B: Medium Security prevents rollback attacks by using a global signature unique to each Mac.",
            "C: Full Security does not require a signature to be unique for the Mac, allowing for more flexibility in managing software installs.",
            "D: Medium Security allows the booting of any signed code from Apple, not attempting to prevent rollback attacks."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "SecureBootPolicy"
    },
    {
        "id": "03b0b265-c699-40e9-ba39-207fff598330",
        "source": "owasp_mastg",
        "question": "You are tasked with ensuring that sensitive data storage within an iOS mobile application complies with recognized security standards. Which of the following practices should you employ to secure the data at rest?",
        "choices": [
            "A: Encrypt sensitive data using a hard-coded symmetric key within the app's source code.",
            "B: Implement file-level encryption using iOS's built-in data protection mechanisms.",
            "C: Store sensitive information in plain text to facilitate easier data recovery and backup processes.",
            "D: Rely solely on iOS's native code obfuscation to protect sensitive data."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Data Protection"
    },
    {
        "id": "d97c9d6a-e22a-4a77-9347-a657e4ede0a0",
        "source": "cwe",
        "question": "Consider a scenario where an application is designed to log user actions for auditing purposes. An attacker is attempting to exploit improper output neutralization for logs by injecting malicious content. As a security expert, you are tasked with mitigating this risk. Which of the following approaches would be most effective in preventing log forging vulnerabilities?",
        "choices": [
            "A: Implement strict input validation by allowing only a predefined list of acceptable inputs and rejecting any input that does not conform to these specifications.",
            "B: Allow all inputs without validation and rely on the downstream logging component to correctly interpret and sanitize the inputs.",
            "C: Encode all output using a common encoding format like UTF-8 before logging, and ensure that the downstream logging component is compatible with this encoding.",
            "D: Store raw user input directly in the logs without any validation or encoding, as this would ensure an accurate audit trail."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "LogForgery"
    },
    {
        "id": "231e2f9d-3dde-4a43-985e-e33d08986c39",
        "source": "apple_platform_security",
        "question": "In the context of securing communications between an iPhone and an Apple Watch, which of the following statements accurately reflect the security measures and their implications?",
        "choices": [
            "A: Apple Watch uses wrist detection to automatically lock the device when removed from the user's wrist, which helps in preventing unauthorized access and Apple Pay transactions.",
            "B: During the pairing process, Apple Watch can use standard BLE Passkey Entry as a fallback method if the animated pattern exchange fails.",
            "C: Communication between iPhone and Apple Watch is encrypted using AES-256-GCM or ChaCha20-Poly1305, ensuring that data remains secure even if intercepted.",
            "D: The Bluetooth Low Energy device address rotation makes it more difficult to track the device locally, enhancing privacy and reducing the risk of location-based attacks."
        ],
        "answer": "ABCD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "watchOS"
    },
    {
        "id": "48c00a10-7ae4-4ca8-a962-cbd4a6705a4b",
        "source": "cs161_textbook",
        "question": "Consider a scenario where an organization is relying on logging as their primary method of intrusion detection. Given your understanding of this method, select the benefits and drawbacks that the organization may experience:",
        "choices": [
            "A: Logging provides real-time detection and can prevent attacks as they happen.",
            "B: Logs can be used to analyze past events and understand the nature of an attack after it has occurred.",
            "C: Logging may miss attacks that utilize evasion techniques such as path traversal.",
            "D: The cost of logging is typically high due to the need for dedicated logging servers and infrastructure."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Logging"
    },
    {
        "id": "a9ba3663-99af-47c8-9de8-f27362dc8315",
        "source": "cs161_textbook",
        "question": "Consider a C program running on a 32-bit system that performs various operations such as declaring constants, allocating memory dynamically, and executing functions. Which of the following statements correctly describe the operations or data associated with each section of the program's address space?",
        "choices": [
            "A: The code section is where the program's constants are stored and remain unchanged throughout its execution.",
            "B: The stack is used for storing dynamically allocated data that can grow in size as more memory is allocated using functions like `malloc`.",
            "C: Local variables and the data pertaining to function calls are stored in the stack, which grows downwards as more functions are called.",
            "D: Static variables are placed in the heap section, which expands upwards when memory is allocated during runtime."
        ],
        "answer": "C",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "MemorySections"
    },
    {
        "id": "ef179e6b-59f1-41ac-94a5-e0c4b5d2d943",
        "source": "d3fend",
        "question": "If an organization is facing issues with processes accessing non-essential system resources, which of the following techniques would not be effective in preventing such unauthorized access?",
        "choices": [
            "A: Hardware-based Process Isolation",
            "B: Executable Denylisting",
            "C: System Call Filtering",
            "D: Email Filtering"
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Email Filtering"
    },
    {
        "id": "2a04dfa6-3120-4cf2-9eb8-5d12996c54cf",
        "source": "attck",
        "question": "A cybersecurity team is investigating a breach where the adversary gained persistent access to a company's network. It was discovered that the adversary had trojanized a widely used client application. As a security analyst, which of the following methods would be most effective in preventing similar future incidents?",
        "choices": [
            "A: Implement a strict code signing policy for all application components.",
            "B: Increase the frequency of changing user passwords.",
            "C: Mandate the use of antivirus software on all endpoints.",
            "D: Disable all client applications that are not essential to business operations."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Code Signing"
    },
    {
        "id": "7c12a040-4846-4a23-bf74-606e536d5ff8",
        "source": "apple_platform_security",
        "question": "In the context of Apple's APFS, which of the following statements accurately describe the design and security features of the different storage volumes? Select all that apply.",
        "choices": [
            "A: The Preboot volume is encrypted and contains booting data for each system volume, which is visible to the user.",
            "B: The Data volume is designed to store changeable data such as user-installed apps and is writable by the user.",
            "C: In macOS 10.15 or later, the system volume is captured in a snapshot and the operating system boots from this snapshot, not a mutable system volume.",
            "D: The VM volume is used for storing unencrypted swap files and is accessible only after the system volume has been unlocked."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "APFSVolumes"
    },
    {
        "id": "23530f33-06bd-45fc-bad8-17eb4b5fd833",
        "source": "owasp_wstg",
        "question": "In the context of web application security, what is a potential trade-off of configuring a web application to return verbose error messages with detailed diagnostics?",
        "choices": [
            "A: Verbose error messages can assist developers in debugging but may inadvertently reveal system information to attackers.",
            "B: Verbose error messages enhance the end-user experience by providing clear guidance on issues, with no significant security trade-offs.",
            "C: Verbose error messages reduce the need for extensive logging, thereby improving server performance.",
            "D: Verbose error messages simplify compliance with regulatory requirements regarding transparency and information disclosure."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Verbose Error Messages"
    },
    {
        "id": "7b2748bb-ba3b-4ae8-97ae-b05891bf42b8",
        "source": "apple_platform_security",
        "question": "A user wishes to enhance privacy while using Safari to browse the web on their Apple device and manage passwords securely across various websites and apps. Which of the following security services would be most appropriate for the user to enable and what are the prerequisites for using these services?",
        "choices": [
            "A: Enable iCloud Private Relay and ensure they are using iOS 15, iPadOS 15, macOS 12.0.1, or later, and are signed into iCloud+ with an Apple ID.",
            "B: Turn on Password AutoFill and confirm the device is running on a version prior to iOS 15 or iPadOS 15.",
            "C: Use Sign in with Apple to avoid managing multiple passwords and ensure two-factor authentication is enabled for their Apple ID.",
            "D: Activate Automatic Strong Passwords feature and ensure iCloud Keychain is enabled to create and sync unique strong passwords."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Privacy"
    },
    {
        "id": "2e3be9fd-5288-4c02-9f46-e8ef419ab0a3",
        "source": "attck",
        "question": "As a penetration tester, you are analyzing a potential breach where the adversary has employed various obfuscation techniques. Which of the following methods would be considered an unconventional approach for an adversary to obfuscate a payload to evade signature-based detection?",
        "choices": [
            "A: Encrypting payloads using a symmetric algorithm such as Rijndael.",
            "B: Utilizing a known compression algorithm like zlib to compress the payload.",
            "C: Encoding parts of a file to hide plaintext strings that could aid in discovery.",
            "D: Employing a legitimate network protocol for covert data exfiltration."
        ],
        "answer": "D",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Payload Obfuscation"
    },
    {
        "id": "9d9e61a9-c660-4b2f-b060-52c69cd32589",
        "source": "cwe",
        "question": "A software application includes a feature that allows users to upload compressed XML configuration files. The development team is considering implementing a limit on the size of the decompressed XML content to mitigate the risk of decompression bombs. What are the pros and cons of this approach?",
        "choices": [
            "A: Pro: Prevents decompression bombs; Con: May limit legitimate large configurations.",
            "B: Pro: Increases upload speeds; Con: Does not prevent a targeted XML bomb attack.",
            "C: Pro: Reduces server storage requirements; Con: Users might experience data loss with legitimate files.",
            "D: Pro: Simplifies the XML parsing process; Con: Can lead to false positives for compression bombs."
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "MitigationStrategy"
    },
    {
        "id": "e2ceeaf7-2137-43c6-85a9-db5a0f87e1f4",
        "source": "windows_security",
        "question": "In a Windows 10 environment, your objective is to safeguard users from unsafe downloads and websites. You decide to leverage Windows Defender SmartScreen for its enhanced protection features. Which of the following actions does Windows Defender SmartScreen perform to achieve this, and how can it be configured?",
        "choices": [
            "A: Windows Defender SmartScreen checks the reputation of files downloaded from the Internet using digital signatures and blocks execution of high-risk files based on Intune or Group Policy settings.",
            "B: Windows Defender SmartScreen automatically encrypts downloaded files to prevent malware execution and can be turned off entirely for trusted networks.",
            "C: Windows Defender SmartScreen requires manual approval by the administrator for each downloaded file before execution and can be configured to send daily reports.",
            "D: Windows Defender SmartScreen scans and cleans all downloaded files using a full antivirus scan before they are run and can be set to high sensitivity mode for untrusted sources."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Windows Defender SmartScreen"
    },
    {
        "id": "3d77a173-7d7e-47b9-9694-fc604c435b5e",
        "source": "windows_security",
        "question": "You have been appointed as the lead of a security team responsible for safeguarding the infrastructure of a large organization. Among your first tasks is to align your team's activities with industry-standard security practices. Which of the following initiatives would you prioritize to enhance your team's security posture?",
        "choices": [
            "A: Implementing a security development lifecycle to integrate security at every phase of software development",
            "B: Exclusively focusing on endpoint security solutions to protect against malware",
            "C: Relying solely on a bug bounty program to identify and fix all security vulnerabilities",
            "D: Adopting a common criteria approach for evaluating the security and reliability of IT products"
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "security development lifecycle"
    },
    {
        "id": "e248bc9c-8c65-46ab-ae4c-96ecacc896c9",
        "source": "cs161_textbook",
        "question": "Consider a stateful packet filter with the following ruleset: \n1. allow tcp (* : *) → (10.0.0.1:80)\n2. drop (*) (* : *) → (* : *)\nWhich of the following traffic patterns would be allowed by this packet filter?",
        "choices": [
            "A: A TCP connection from any IP to port 80 on machine 10.0.0.1",
            "B: A UDP connection from IP 192.168.1.10 to port 80 on machine 10.0.0.1",
            "C: A TCP connection from IP 172.16.0.4 to port 443 on machine 10.0.0.1",
            "D: Any connection initiated by machine 10.0.0.1"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "StatefulPacketFilters"
    },
    {
        "id": "1a24c416-bf47-4ed8-9645-34f8037f9036",
        "source": "cs161_textbook",
        "question": "In a browser-based challenge-response protocol where a server sends a random challenge \\(r\\) to the user's browser, the browser then computes \\(H(w,r)\\) using a cryptographic hash (e.g., SHA256) and sends the result back to the server. What potential security issues are NOT addressed by this protocol that are otherwise mitigated by using SSL/TLS?",
        "choices": [
            "A: The user’s password is exposed to the server in plaintext form.",
            "B: Encryption of the data in transit between the browser and the server may be weaker or nonexistent.",
            "C: The server's identity is not authenticated, which could lead to man-in-the-middle attacks.",
            "D: The protocol may not secure data after authentication, leaving the session vulnerable to other forms of eavesdropping."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "protocol_comparison"
    },
    {
        "id": "b5804d4c-e140-434d-9ad9-0346c6ba5db5",
        "source": "cwe",
        "question": "Consider the following Java code snippet:\n\n  Long total = 0L;\n  for (long j = 0; j < 1000000; j++) {\n    total += j;\n  }\n\nWhich of the following changes could improve the performance of this code?",
        "choices": [
            "A: Replace 'Long' with 'long' when declaring the 'total' variable to avoid unnecessary autoboxing.",
            "B: Use a 'HashMap' to store each increment operation instead of a primitive operation.",
            "C: Change the loop condition to iterate until 'Long.MAX_VALUE' to increase the range of values.",
            "D: Wrap the loop inside a synchronized block to ensure thread safety."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Autoboxing"
    },
    {
        "id": "3d29d707-fb0f-48f4-a2bf-bc72d6c4d03a",
        "source": "cs161_textbook",
        "question": "When implementing Address Space Layout Randomization (ASLR), system architects must consider certain constraints. One such constraint is that memory segments usually need to start at a page boundary. What is a potential advantage and a disadvantage of this requirement? (Select one advantage and one disadvantage)",
        "choices": [
            "A: Advantage: Improves the efficiency of memory access as it aligns with the system's page size.",
            "B: Advantage: Allows for non-contiguous memory allocation, reducing the risk of buffer overflow attacks.",
            "C: Disadvantage: Limits the randomness of ASLR as addresses must align with page boundaries.",
            "D: Disadvantage: Increases the overall memory usage due to the need for encryption of page boundaries."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "ASLR constraints"
    },
    {
        "id": "132ca45a-faab-434b-b923-355abad9b91b",
        "source": "cwe",
        "question": "In a case study of a web service that aggregates user data, it has been proposed to mitigate the exposure of sensitive information through data queries by employing 'k-anonymity' models. What is the most compelling counterargument to this proposal?",
        "choices": [
            "A: 'K-anonymity' models can still be susceptible to linking attacks when the attacker possesses auxiliary information.",
            "B: 'K-anonymity' models will significantly improve the performance of the web service by reducing the data processing needs.",
            "C: Implementing 'k-anonymity' will make the data completely secure and immune to any form of statistical inference.",
            "D: The use of 'k-anonymity' is not necessary since users are already aware that their data can be used for statistical purposes."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "k-anonymity"
    },
    {
        "id": "8ba3dc58-2372-4903-9d76-60521e17020a",
        "source": "apple_platform_security",
        "question": "When an organization is deploying a suite of iOS apps and extensions for enterprise use, which of the following statements are accurate regarding security and data sharing?",
        "choices": [
            "A: Extensions can communicate with their containing apps using direct memory access to facilitate faster data exchange.",
            "B: Custom keyboards can use network services or exfiltrate typing data unless the user grants Open Access after being informed.",
            "C: App groups are used to allow apps and extensions owned by a developer account to share keychain items and preferences.",
            "D: Third-party keyboard extensions are automatically allowed to be used within any app without restrictions."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "AppExtensionSecurity"
    },
    {
        "id": "532e3286-3c86-40e9-a283-0c56191f4766",
        "source": "android_sec_doc",
        "question": "You are tasked with implementing a secure storage encryption feature for an Android device. As part of the solution, you need to ensure that the storage encryption keys are tied to the device's Verified Boot state and the user's Lock Screen Knowledge Factor. Additionally, you must utilize hardware-wrapped keys that are wrapped twice for added security. Which of the following steps are part of the correct implementation process?",
        "choices": [
            "A: Modify the KeyMint implementation to support 'TAG_STORAGE_KEY' and the 'convertStorageKeyToEphemeral' method.",
            "B: For Android 11 kernels, set 'BLK_CRYPTO_KEY_TYPE_HW_WRAPPED' in 'blk_crypto_profile::key_types_supported'.",
            "C: Integrate a custom KDF (Key Derivation Function) that differs from the hardware's implementation to enhance security.",
            "D: Add the 'wrappedkey_v0' flag to the 'fileencryption' and 'metadata_encryption' parameters in the device's 'fstab' file."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Key Wrapping"
    },
    {
        "id": "85f325d1-57e8-4dbd-9461-90a7ea3c31a2",
        "source": "apple_platform_security",
        "question": "As an MDM administrator, you have been notified that an iOS device in your organization has been lost. You decide to use Managed Lost Mode to secure the device. Which of the following actions can you perform, and which are not possible due to the limitations of Managed Lost Mode?",
        "choices": [
            "A: You can display a custom message with a contact number on the device's screen.",
            "B: You can remotely wipe all the data from the device while it is in Managed Lost Mode.",
            "C: You can request the device to send its current location to you even if Location Services are off.",
            "D: You can allow the current user to continue accessing the device but with limited permissions."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "LostMode"
    },
    {
        "id": "a67778dd-be4d-45b1-8238-f3f7de80adee",
        "source": "attck",
        "question": "A penetration tester is tasked with evaluating the security of an organization's network. They are contemplating using an input capture technique that would be least likely to be detected by conventional security monitoring tools. Which of the following techniques should they avoid using if they want to remain undetected?",
        "choices": [
            "A: Credential API Hooking, as it may trigger alerts when API calls to SetWindowsHook, GetKeyState, and GetAsyncKeyState are monitored.",
            "B: GUI Input Capture, as it is usually transparent to the user and less likely to be noticed.",
            "C: Web Portal Capture, because it does not involve direct interaction with the system's API or processes.",
            "D: Keylogging, as it typically does not involve changes to system files or registry keys."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Detection"
    },
    {
        "id": "bede4496-6806-4879-a54a-5baa7c5fea90",
        "source": "mit6.858",
        "question": "In a multi-component system like OKWS, different processes and unique user/group identifiers play a crucial role in maintaining security. Analyze the reasoning behind these design decisions and select the outcomes they aim to achieve.",
        "choices": [
            "A: Preventing a compromised service from overwriting or deleting the log files of other services.",
            "B: Allowing services to freely modify their executable binaries for updates without the need for root privileges.",
            "C: Facilitating the allocation of TCP port 80 to non-superuser processes without compromising system security.",
            "D: Ensuring that services can execute their binaries but cannot read, write, or modify them to prevent persistence of an attack."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "isolation"
    },
    {
        "id": "fe7e9514-3ab9-4d4c-ad22-eb3cf5702ca2",
        "source": "attck",
        "question": "A network administrator has observed signs of potential exploitation of remote services in the system logs. Which TWO of the following data sources are most effective for detecting such software exploitation attempts according to the ATT&CK framework?",
        "choices": [
            "A: Network Traffic Content for signs of common exploit traffic",
            "B: Antivirus scan reports for general malware detection",
            "C: Application Log Content for irregularities in software execution",
            "D: CPU usage analytics for identifying resource-intensive processes"
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Software Exploitation Detection"
    },
    {
        "id": "7f9cdfd5-5ce1-441d-a519-ce2e61d1f489",
        "source": "owasp_mastg",
        "question": "When developing an Android application, the security of the private key used for signing the APK is crucial. If a malicious actor gains access to this key, what are the potential consequences, and how can developers mitigate this risk?",
        "choices": [
            "A: The malicious actor can publish updates to the app with unauthorized content, and to mitigate this, developers should store keys in a secure KeyStore with a strong password known only to the key creator.",
            "B: The malicious actor can only view the app's source code without being able to modify the application, and developers should use obfuscation to prevent this.",
            "C: The malicious actor can decrypt user data, and developers should implement additional encryption algorithms to protect user data.",
            "D: The malicious actor can alter the app's functionality, but this poses no significant threat since app stores will detect and block malicious updates."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Private Key Security"
    },
    {
        "id": "bb9e5272-bce9-41e1-87e1-8b6d46e59a40",
        "source": "owasp_wstg",
        "question": "When implementing threat modeling in the design phase of a web application, which of the following statements correctly describe the outcome of this security practice?",
        "choices": [
            "A: Threat modeling ensures the complete elimination of security risks within the application.",
            "B: Creating a threat model helps in developing mitigation strategies for potential vulnerabilities identified.",
            "C: Threat modeling can replace other forms of security testing due to its comprehensive nature.",
            "D: A good threat model guarantees the production of secure software without further testing."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Threat Modeling"
    },
    {
        "id": "577fd091-520e-4dce-9c37-86a8181bf5bd",
        "source": "attck",
        "question": "You are assessing the security of a corporate network and notice that unauthorized modifications to the Windows Registry are being used to establish persistence. Based on the ATT&CK framework, which of the following measures could be effective at both mitigating the risk of persistence through Registry modifications and aiding in the detection of such activity? (Select TWO.)",
        "choices": [
            "A: Enforcing proper permissions for Registry hives to prevent unauthorized modifications.",
            "B: Disabling remote Registry access entirely across the network.",
            "C: Implementing full disk encryption to protect the contents of the Registry.",
            "D: Monitoring network traffic for unusual Windows API function calls related to the Registry."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Registry Permissions"
    },
    {
        "id": "87c2d98d-07be-4428-ba78-1153d05aa2a3",
        "source": "cs161_textbook",
        "question": "Consider a scenario where Alice is sending a message to Bob using a MAC to ensure the integrity and authenticity of the message. Which of the following actions are necessary for Bob to verify the message's integrity and authenticity upon receipt? (Select all that apply.)",
        "choices": [
            "A: Bob should generate a new MAC using his own secret key and compare it with the received MAC.",
            "B: Bob should recompute the MAC using the secret key and the received message, and compare it with the received MAC.",
            "C: Bob should check that the message's length matches a predefined value to confirm its integrity.",
            "D: Bob should decrypt the message using a public key to ensure it's authentic."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "MAC"
    },
    {
        "id": "9644fa09-38aa-4461-8a34-7ae66ea8e2af",
        "source": "cwe",
        "question": "Imagine you are designing a secure boot process for a System-on-Chip (SoC). Your goal is to ensure that the measurement data used for attestation is not alterable by an adversary. Which of the following design principles should be implemented to prevent an adversary from modifying the boot measurement data?",
        "choices": [
            "A: Store the measurement data in registers that are read-only with respect to an adversary.",
            "B: Implement a mechanism that allows the hash to be extended or modified by trusted agents, as proxies, if necessary.",
            "C: Employ a secure one-way hash function for calculating the measurement data and ensure the final hash value can be verified by an external entity.",
            "D: Incorporate appropriate access controls or protections for the registers that store the measurement data."
        ],
        "answer": "ACD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecureBootDesign"
    },
    {
        "id": "6f190e6c-f230-4bcb-ac14-7484bd0f6104",
        "source": "windows_security",
        "question": "What are the potential impacts on security and maintenance when considering different strategies for setting the administrator key during virtual smart card deployment?",
        "choices": [
            "A: Using the same administrator key across all virtual smart cards in the organization simplifies maintenance but significantly increases security risks.",
            "B: Assigning random administrator keys and not storing them ensures the highest level of security, even though it may complicate maintenance.",
            "C: Storing administrator keys in local registries instead of Active Directory is recommended for easier access by domain administrators.",
            "D: Assigning a uniform administrator key and storing it securely in Active Directory does not pose any security risks."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Administrator Key"
    },
    {
        "id": "6f01d9bb-ecc3-493a-b4b2-9dc8a24ed000",
        "source": "attck",
        "question": "A penetration tester is analyzing network traffic and observes a consistent flow of outbound connections to a particular server. The traffic contains a variety of file types being transferred, including documents, spreadsheets, and images. Based on the observed behavior, which of the following malware families is most likely responsible for this data exfiltration, and what is one of its notable characteristics?",
        "choices": [
            "A: FrameworkPOS – Primarily collects credit card data from process memory.",
            "B: Kimsuky – Known for collecting Office, PDF, and HWP documents from victims.",
            "C: GrimAgent – Capable of collecting files and information from compromised hosts.",
            "D: Hydraq – Establishes a backdoor for data exfiltration but focuses solely on system information retrieval."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Data exfiltration"
    },
    {
        "id": "a45f3ef2-25bd-4f4b-ad33-8118db20d255",
        "source": "owasp_wstg",
        "question": "A web application allows authenticated users to perform sensitive actions, such as transferring money between accounts. To protect against clickjacking attacks, the developers are considering implementing a server-side protection mechanism. Which of the following HTTP response headers should the developers use to ensure that the application's pages cannot be framed by potential attackers, thus preventing clickjacking attacks?",
        "choices": [
            "A: Set-Cookie: Secure",
            "B: X-Frame-Options: DENY",
            "C: Content-Type: text/html",
            "D: Access-Control-Allow-Origin: *"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "X-Frame-Options"
    },
    {
        "id": "c0a0a7d3-f132-410f-9f49-3bfcbfee7fb6",
        "source": "attck",
        "question": "An organization has recently discovered that adversaries have been hijacking existing remote service sessions to move laterally within their network. Which of the following actions should the organization take to mitigate the risk of such attacks? (Select TWO.)",
        "choices": [
            "A: Implement network segmentation to restrict traffic between security zones.",
            "B: Increase the session timeout settings for remote services to reduce the window of opportunity for attack.",
            "C: Limit remote user permissions and manage privileged accounts carefully.",
            "D: Disable remote services that are not necessary, such as SSH or RDP."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Remote Service Session Hijacking"
    },
    {
        "id": "0f7736e8-3a11-4334-b383-e5e811813e47",
        "source": "cs161_textbook",
        "question": "Why are digital signatures critical in the Bitcoin security model for ensuring that a user's identity cannot be impersonated by an attacker?",
        "choices": [
            "A: Digital signatures are crucial because they are unforgeable and an attacker without the secret signing key cannot create a signature that validates with the original public key.",
            "B: Digital signatures are essential because they rely on a centralized authority to certify the identity of users, which prevents impersonation.",
            "C: Digital signatures provide security solely because they encrypt messages, which means only the intended recipient can read the message content.",
            "D: Digital signatures are not necessary for security because all transactions are public, and the community can identify malicious behavior."
        ],
        "answer": "A",
        "topics": [],
        "keyword": "DigitalSignatures"
    },
    {
        "id": "12f60976-e250-42b3-be14-5dae19e92124",
        "source": "owasp_wstg",
        "question": "A security engineer is reviewing the access control policies of a web application to prevent directory traversal attacks. Which of the following best describes the security mechanisms that should be deployed to mitigate such attacks and prevent access to sensitive files?",
        "choices": [
            "A: Implementing strict Access Control Lists (ACL) to define privileges and restricting file access to certain users or groups.",
            "B: Allowing free file access within the web document root to ease usability and rely on server-side validation only.",
            "C: Disabling all server-side scripting capabilities to prevent the inclusion of external files.",
            "D: Limiting the web application to a single directory and disabling all navigation outside this directory."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Access Control Lists (ACL)"
    },
    {
        "id": "70955fa1-fdcb-478d-b925-c001b38960ca",
        "source": "cs161_textbook",
        "question": "A web application is looking to implement additional security measures beyond just passwords for user authentication. Which of the following are considered common and valid alternatives to password-based authentication? Select all that apply.",
        "choices": [
            "A: Retinal scanning",
            "B: Mandatory security questions",
            "C: Public-key cryptography",
            "D: Secure persistent cookies"
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "1e3d47ab-25b6-49ac-a1e5-7ba1bf276dda",
        "source": "attck",
        "question": "A company has experienced a security breach and it is suspected that adversaries have manipulated the company's systems to hinder their defensive capabilities. Which of the following actions would be consistent with the tactics used by adversaries to impair defenses as per the ATT&CK framework?",
        "choices": [
            "A: Increasing the integrity level of objects to prevent write actions.",
            "B: Disabling LSA protection using registry modifications.",
            "C: Enforcing strict password complexity and rotation policies.",
            "D: Implementing multi-factor authentication for all users."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Defense Evasion"
    },
    {
        "id": "306c2d4f-3068-4aa3-8e3d-d13769d98cab",
        "source": "cwe",
        "question": "You are designing a web application that manages sensitive user data. To safeguard against unauthorized access or modifications, which of the following strategies should you consider implementing? (Select all that apply)",
        "choices": [
            "A: Implement role-based access control (RBAC) and map roles carefully to data and functionalities, understanding that this might not protect against horizontal authorization.",
            "B: Avoid server-side access control enforcement to maximize performance, instead relying on client-side checks for efficiency.",
            "C: Utilize a vetted authorization framework that provides constructs to prevent missing authorization vulnerabilities.",
            "D: Configure the system to use a 'default deny' policy in the access control lists and use the access control features of the operating system."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Authorization"
    },
    {
        "id": "0f951158-0401-4895-8e81-5dcbfa8435e1",
        "source": "cs161_textbook",
        "question": "A company needs to implement encryption for its messaging system to ensure privacy and security. The system should prevent an eavesdropper from deducing information about the plaintext when the same message is sent multiple times. Additionally, it should thwart tampering with ciphertexts that would allow unauthorized modification of message contents. Which of the following block cipher modes of operation should the company consider implementing to meet these requirements?",
        "choices": [
            "A: ECB Mode because it encrypts each block separately, making it difficult for eavesdroppers to deduce information.",
            "B: CBC Mode since it uses an initialization vector and chains ciphertext blocks, which enhances security.",
            "C: OFB Mode because it makes tampering with ciphertexts easy, demonstrating its robustness against unauthorized changes.",
            "D: CTR Mode as it uses a counter and encryption function, resembling the security properties of a one-time pad."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "58bd6fbf-e3a8-4bbd-97a2-f9bc00bd76b9",
        "source": "attck",
        "question": "A security analyst is reviewing the company's incident response plan to address potential adversary actions that could interfere with event collection and forensic analysis. Which of the following actions would be effective in mitigating the risk associated with adversaries attempting to remove evidence of their presence on the company's systems?",
        "choices": [
            "A: Implementing strict file and directory permissions to protect locally stored event files from unauthorized modification.",
            "B: Decreasing the verbosity of event logs to reduce the amount of data available for adversaries to manipulate.",
            "C: Avoiding the use of anti-virus and host intrusion prevention systems as they may be bypassed by adversaries.",
            "D: Relying solely on manual log reviews for the detection of intrusion activities to prevent automated alteration by malware."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Indicator Removal"
    },
    {
        "id": "203821e1-3120-43cf-b9a2-2a75d4ff4cee",
        "source": "cwe",
        "question": "You are designing a new database-driven application. Which of the following practices should you implement to mitigate the risk of SQL Injection attacks?",
        "choices": [
            "A: Use a vetted persistence layer to automatically handle SQL command construction.",
            "B: Construct and execute dynamic SQL query strings using 'exec' for enhanced performance.",
            "C: Run the application code with the highest privileges to ensure it has necessary access.",
            "D: Utilize parameterized queries, prepared statements, or stored procedures for database access."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SQLInjectionMitigation"
    },
    {
        "id": "4a89e214-80ca-4f3d-b5f6-b5b3ca530088",
        "source": "owasp_wstg",
        "question": "A developer is in the coding phase of a web application. They are responsible for ensuring that the code complies with secure coding standards and for validating the security of their own coding artifacts. Which of the following actions should the developer take to meet these objectives effectively?",
        "choices": [
            "A: Use static and dynamic analysis tools to identify security issues as code is developed and ensure that unit tests validate the security functionality of components.",
            "B: Focus exclusively on functional testing of the application's features, since security concerns are typically addressed during the integration and validation phase.",
            "C: Rely solely on penetration testing tools during the integration phase to identify and mitigate any security issues in the code.",
            "D: Document threat scenarios only after the integration phase, since use and misuse cases are not relevant during the coding phase."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Secure Coding Standards"
    },
    {
        "id": "35bc2d3c-4572-4321-9fa1-7148d8f13f96",
        "source": "owasp_mastg",
        "question": "In the context of Android's cryptographic key lifecycle management, which of the following practices should you follow to adhere to the best practices outlined for handling cryptographic keys?",
        "choices": [
            "A: Store cryptographic keys in plain text within the application's private storage to ensure quick access when performing cryptographic operations.",
            "B: Implement key rotation frequently to replace old keys with new ones, thus minimizing the risk of a key being compromised over time.",
            "C: Use the same cryptographic key for multiple purposes across the application to reduce complexity and streamline key management.",
            "D: Archive cryptographic keys indefinitely to maintain historical data encryption compatibility, regardless of whether the keys are still in use."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Cryptographic Key Lifecycle"
    },
    {
        "id": "f53a3bb2-804b-46c8-a893-77bc35e294b2",
        "source": "cs161_textbook",
        "question": "A security analyst is reviewing the potential effectiveness of Address Space Layout Randomization (ASLR) as a mitigation against memory-safety vulnerabilities across different system architectures. Which of the following statements are accurate regarding the effectiveness of ASLR?",
        "choices": [
            "A: On a 32-bit system, ASLR provides substantial protection due to the high entropy available for address randomization.",
            "B: A 64-bit system offers more entropy for address randomization, making it significantly harder for an attacker to guess the correct address compared to a 32-bit system.",
            "C: ASLR is equally effective on both 32-bit and 64-bit systems because it changes the start of memory sections, hindering address guessing attacks.",
            "D: Memory leaks that disclose absolute addresses are ineffective against ASLR since it also randomizes relative addresses between variables."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "MemorySafety"
        ],
        "keyword": "ASLR Effectiveness"
    },
    {
        "id": "ebeac3f7-b24b-4fe4-92db-31949e8b157a",
        "source": "d3fend",
        "question": "A security team plans to deploy a decoy to understand the tactics of potential attackers targeting their e-commerce platform. The platform is highly interactive with real-time inventory updates, and the team is particularly concerned about attackers probing for vulnerabilities in this dynamic aspect of the system. Which type of decoy would be most appropriate for this situation?",
        "choices": [
            "A: Standalone Honeynet",
            "B: Decoy File",
            "C: Connected Honeynet",
            "D: Decoy Session Token"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Honeynet"
    },
    {
        "id": "1811efc9-0a74-4d0f-92cc-66f1688ca895",
        "source": "cs161_textbook",
        "question": "A web server is experiencing a SYN flood attack, where the attacker is sending a large number of SYN packets with spoofed IP addresses and not completing the handshake. Considering the attack's impact, which of the following are viable defenses the server could employ to mitigate the attack? Choose all that apply.",
        "choices": [
            "A: Increase the server's memory capacity (overprovisioning) to handle a larger number of incomplete TCP sessions.",
            "B: Implement SYN cookies to prevent the allocation of server memory for connections until the handshake is complete.",
            "C: Introduce a delay in processing SYN packets to slow down the rate of incoming connections.",
            "D: Enable stateful packet inspection on the network firewall to block connections from spoofed IP addresses."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "SYN_Flood_Defense"
    },
    {
        "id": "211cf668-247f-4d34-a0cb-ba9bb69c316f",
        "source": "cwe",
        "question": "You are reviewing code that handles file paths based on user input for a web application. Your goal is to ensure that file access remains within a designated directory. Which of the following code snippets correctly mitigates the risk of path traversal attacks where attackers might use 'dir\\..\\..\\filename' sequences?",
        "choices": [
            "A: File accessFile(String userPath) { return new File(userPath); }",
            "B: File accessFile(String userPath) { if (userPath.startsWith(\"..\")) throw new SecurityException(); return new File(userPath); }",
            "C: File accessFile(String userPath) { while(userPath.contains(\"..\")) userPath = userPath.replace(\"..\", \"\"); return new File(userPath); }",
            "D: File accessFile(String userPath) { Path path = Paths.get(\"/restrictedDir\").resolve(userPath).normalize(); if (!path.startsWith(\"/restrictedDir\")) throw new SecurityException(); return path.toFile(); }"
        ],
        "answer": "D",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PathTraversal"
    },
    {
        "id": "f06933d8-2c90-4f85-8308-b036d7457842",
        "source": "owasp_wstg",
        "question": "A company is developing an e-commerce web application that will handle customer credit card data. The business requirements document highlights the need to protect customer data and comply with applicable security regulations. As a web security specialist, you are tasked with ensuring that security controls are in line with industry standards. Which of the following security controls should be documented and validated in the security requirements to comply with industry best practices?",
        "choices": [
            "A: Enforcing password complexity of ten alphanumeric characters for customer accounts.",
            "B: Storing PINs and CVV2 data securely along with credit card information.",
            "C: Encrypting magnetic strip data in storage and transmission and masking it on display.",
            "D: Implementing weak authentication controls without multi-factor authentication."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PCI DSS Compliance"
    },
    {
        "id": "599aa502-8939-4fe3-bb27-342e9f9cdaac",
        "source": "windows_security",
        "question": "As a security administrator, you are reviewing the logs and notice several instances of security event 4670(S), indicating permissions on an object were changed. Which of the following is the LEAST likely to be part of your responsibilities in this situation?",
        "choices": [
            "A: Investigating the reason for the permission changes to ensure they are legitimate.",
            "B: Reverting the permissions to their previous state without reviewing the changes.",
            "C: Assessing the impact of the permission changes on system security and compliance.",
            "D: Updating the security policy to prevent unauthorized permission changes."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Administrator"
    },
    {
        "id": "5dcfbba1-3bf3-49f6-988c-1cb8d338590e",
        "source": "apple_platform_security",
        "question": "Evaluate the effectiveness of the XProtect feature in macOS. Select the scenarios where XProtect would be effective and the scenarios where it may not provide adequate protection.",
        "choices": [
            "A: XProtect is effective against malware that has been previously launched on the system and has a known signature.",
            "B: XProtect effectively scans and blocks all types of malware in real-time, regardless of whether it has been previously identified by Apple.",
            "C: XProtect automatically removes malware upon receiving updated information and periodically checks for infections without requiring a system reboot.",
            "D: XProtect is less effective against zero-day exploits that have not yet been identified and have no existing signature."
        ],
        "answer": "ACD",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "XProtect"
    },
    {
        "id": "2363b9b4-2241-4580-bf81-8f49c9c3a0bd",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately capture the reasons for specific security measures in iMessage's encryption process?",
        "choices": [
            "A: iMessage uses AES in CTR mode to allow for secure encryption of attachments without relying on message length.",
            "B: The digital signature created using ECDSA is meant to ensure that the message has not been altered in transit.",
            "C: Messages are stored on Apple servers for up to 30 days to facilitate message synchronization across multiple devices.",
            "D: Public keys are stored on Apple servers to facilitate the encryption process, which requires access to the recipient's public key."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Encryption Process"
    },
    {
        "id": "a45fe784-7f89-406f-a04a-b2a85aa09862",
        "source": "cwe",
        "question": "Considering secure design principles for file upload functionality in a web application, which of the following practices should be implemented to prevent unrestricted upload of files with dangerous types?",
        "choices": [
            "A: Use an allowlist approach to only accept file extensions that are known to be safe, and reject all others.",
            "B: Store uploaded files in the web document root to simplify access control.",
            "C: Generate a new, unique filename for each uploaded file using only server-side input, avoiding the use of user-supplied filenames.",
            "D: Rely on the MIME content type sent by the client's browser to validate if the uploaded file is safe to process."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "FileUploadSecurity"
    },
    {
        "id": "e70148d7-0ca9-4784-9783-5acd001c4bf1",
        "source": "mozilla_security",
        "question": "When maintaining a public repository for an open-source web application, which of the following would be an inappropriate action that could compromise the application's security?",
        "choices": [
            "A: Regularly updating the 'README.md' file with the latest project status and contributing guidelines.",
            "B: Publishing a 'CONTRIBUTING.md' file with guidelines on how to report bugs and request features.",
            "C: Exposing detailed error logs from the production environment that may contain sensitive information.",
            "D: Sharing a list of technologies and frameworks used in the project, like 'python' or 'django'."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Sensitive Information Exposure"
    },
    {
        "id": "763e9c7b-13bf-4930-a115-5bd8966ce153",
        "source": "cs161_textbook",
        "question": "A company discovers that the secret key for their cryptosystem has been potentially leaked. According to Kerckhoff’s Principle, what should the company's immediate response be to maintain the security of their system?",
        "choices": [
            "A: Re-write the encryption and decryption algorithms from scratch",
            "B: Inform all users to cease using the system immediately",
            "C: Change the secret key(s) and inform relevant parties to update their keys",
            "D: Keep using the same key, assuming the complexity of the algorithm will prevent breaches"
        ],
        "answer": "C",
        "topics": [],
        "keyword": "Incident Response"
    },
    {
        "id": "74fb63e8-1dc1-4838-95b4-692a33c424df",
        "source": "apple_platform_security",
        "question": "In the context of Apple's Secure Enclave, which combination of components and features contribute to the security of non-volatile user data? Select all that apply.",
        "choices": [
            "A: The public key accelerator (PKA), which is designed to resist SPA and DPA, encrypts user data.",
            "B: Secure non-volatile storage paired with a Secure Storage Component, using an encrypted and authenticated protocol for exclusive access to entropy.",
            "C: The True Random Number Generator (TRNG), which generates secure random data used whenever the Secure Enclave generates cryptographic keys or other entropy.",
            "D: The device group ID (GID), which is common to all devices using a given SoC, is used to cryptographically tie user data to a particular device model."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SecureEnclave"
    },
    {
        "id": "bfe1b311-32c7-430b-83f7-464afa5f2021",
        "source": "apple_platform_security",
        "question": "You have a Mac with Apple silicon running macOS 12.0.1 and you need to perform certain operations. Based on the LocalPolicy settings, select which of the following actions you will be able to perform:",
        "choices": [
            "A: Downgrade the operating system to an older version of macOS using the paired recoveryOS.",
            "B: Boot into a custom XNU kernel that you have built and signed yourself.",
            "C: Prevent iBoot from loading third-party kernel extensions (kexts) by holding the Shift key during recoveryOS boot.",
            "D: Use the fallback recoveryOS to downgrade security settings for the paired macOS installation."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "LocalPolicy"
    },
    {
        "id": "1fd58f90-ec60-4803-9695-590c02880ac3",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the security policies of a company that uses various developer utilities for software development tasks. Given the potential misuse of these utilities to proxy execution of malicious payloads, which of the following mitigation strategies should be implemented to enhance the company's defense against such threats?",
        "choices": [
            "A: Implement strict code obfuscation techniques to prevent reverse engineering of the utilities.",
            "B: Remove or disable specific developer utilities that are not necessary within the company's environment.",
            "C: Allow unrestricted execution of developer utilities to enable seamless development and debugging processes.",
            "D: Enforce mandatory use of VPN for all developer utilities to secure code execution."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Defense Evasion"
    },
    {
        "id": "d55202f4-3039-4d30-8a3d-bcf79c020934",
        "source": "owasp_mastg",
        "question": "A developer is building an iOS application that requires serialization of custom objects to ensure both type-safety and data integrity during the decoding process. Which protocol should the developer implement to meet these requirements, considering that the objects contain sensitive information that should not be easily tampered with?",
        "choices": [
            "A: NSCoding protocol with additional HMAC for integrity checks",
            "B: NSSecureCoding with supportsSecureCoding set to true",
            "C: NSKeyedArchiver without additional security measures",
            "D: Codable protocol with JSONEncoder and JSONDecoder"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "NSSecureCoding"
    },
    {
        "id": "5e3d9b9d-5ea0-4c1b-97fd-90db11b8ec0d",
        "source": "owasp_wstg",
        "question": "In the context of preventing workflow circumvention vulnerabilities, which of the following remediation strategies could be effective in ensuring that users complete each step of a transaction process in the correct order?",
        "choices": [
            "A: Implementing strict input validation checks on all user submissions",
            "B: Introducing CAPTCHAs at every step of the transaction process",
            "C: Enforcing sequence checks and state management controls in the application logic",
            "D: Applying encryption to data stored in the user's browser cookies"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "State Management Controls"
    },
    {
        "id": "bbca18bc-2736-4d0b-ae54-edacb4e75659",
        "source": "apple_platform_security",
        "question": "An organization has set a Medium Security boot policy on their Intel-based Macs with Apple T2 Security Chips. Which of the following outcomes does the organization accept as a consequence of this policy?",
        "choices": [
            "A: The organization cannot prevent attackers from running unsigned code.",
            "B: The organization accepts that rollback attacks cannot be prevented with this setting.",
            "C: The organization expects a unique signature to be generated for each Mac, tied to its specific T2 chip.",
            "D: The organization requires secure boot evaluation to be disabled, allowing booting from any media."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "MediumSecurityPolicy"
    },
    {
        "id": "2b045678-b69d-47c8-bd1c-15640b1d4e1e",
        "source": "apple_platform_security",
        "question": "Select the measures that Apple employs to ensure app security across its various platforms, keeping in mind the unique strategies for different devices:",
        "choices": [
            "A: All apps on iPhone, iPad, and iPod touch are sourced from the App Store and are sandboxed.",
            "B: macOS requires all internet downloaded apps to be notarised by Apple to launch, starting with macOS 10.15.",
            "C: macOS has a built-in antivirus protection that actively blocks and removes malware.",
            "D: All Mac apps are required to be provided through the App Store to ensure security."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "PlatformSecurity"
    },
    {
        "id": "44c67350-0e1c-4cdd-88e6-1a9d354c2bfc",
        "source": "owasp_wstg",
        "question": "In the context of a webmail application that interacts with internal IMAP/SMTP mail servers, which of the following are potential consequences of a successful IMAP/SMTP Injection attack? (Choose two.)",
        "choices": [
            "A: Extraction of sensitive information due to information leaks.",
            "B: Automatic encryption of all outgoing emails as a defensive response.",
            "C: Bypassing application restrictions to gain unauthorized access.",
            "D: Immediate termination of the webmail application's internet connection."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IMAP/SMTP Injection Impact"
    },
    {
        "id": "2030676f-a2e1-403b-87c3-09d21ab702c6",
        "source": "attck",
        "question": "A security analyst is monitoring network traffic to detect adversarial activities. Which of the following monitoring actions would least likely aid in the detection of an adversary establishing accounts as described in the ATT&CK framework?",
        "choices": [
            "A: Inspecting packet content for deviations from protocol standards.",
            "B: Correlating traffic patterns with anomalous process execution.",
            "C: Monitoring social media for new accounts with connections to the organization.",
            "D: Analyzing DNS queries for domain names associated with known email providers."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "29eee2b8-f83d-4bc3-80d2-8733dd936767",
        "source": "attck",
        "question": "In an effort to bolster defense against potential persistence attacks through Microsoft Office applications, which of the following statements correctly assess the effectiveness of proposed mitigation methods?",
        "choices": [
            "A: Disabling Office VBA macros and add-ins completely prevents execution of any malicious Office Template Macros and Outlook Rules.",
            "B: Microsoft's release of patches such as KB3191938, KB4011091, and KB4011162 is ineffective because they do not prevent the execution of all forms of malicious code in Outlook.",
            "C: Setting Registry permissions to 'Read Control' can effectively mitigate the Office Test method by hindering unauthorized changes without elevated privileges.",
            "D: Enabling Attack Surface Reduction (ASR) rules is ineffective against all Outlook-based persistence methods since they do not apply to email client behavior."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Mitigation Strategies"
    },
    {
        "id": "fd91fc96-b367-476c-878c-e2f2cde09638",
        "source": "mit6.858",
        "question": "You are evaluating the password recovery process for a corporate web application to ensure it is secure against social engineering and other attacks while maintaining usability for legitimate users. Which of the following recovery methods would you consider more secure and why?",
        "choices": [
            "A: Security questions based on easily researched or guessed personal information.",
            "B: Email verification, provided the email account itself has strong security measures.",
            "C: Customer service verification without a strict policy, relying on staff discretion.",
            "D: Proving knowledge of a credit card number associated with the user's account."
        ],
        "answer": "BD",
        "topics": [
            "Vulnerability",
            "SystemSecurity"
        ],
        "keyword": "recovery"
    },
    {
        "id": "e6c6c967-2b83-4cff-9cf7-e0f908c42611",
        "source": "attck",
        "question": "Which of the following is NOT a common practice when adversaries are developing their own capabilities such as malware or exploits?",
        "choices": [
            "A: Contracting out specific development skills that are not available in-house.",
            "B: Creating self-signed digital certificates to support operations.",
            "C: Developing mailing toolkits for use in spearphishing attacks.",
            "D: Purchasing off-the-shelf antivirus software to protect their infrastructure."
        ],
        "answer": "D",
        "topics": [
            "PenTest",
            "Vulnerability"
        ],
        "keyword": "Adversary Development Practices"
    },
    {
        "id": "276998c2-b7ff-4880-8fe1-797048cbd5e8",
        "source": "owasp_mastg",
        "question": "When conducting security testing on a Xamarin mobile application, you notice that setting the system proxy in the Wi-Fi settings does not allow you to observe HTTP requests in your interception proxy. Which of the following methods could be used to resolve this issue?",
        "choices": [
            "A: Reconfigure the Xamarin app to use a default proxy by modifying the OnCreate or Main method.",
            "B: Enable 'Support invisible proxying' in the Wi-Fi settings to force Xamarin apps to use the local proxy.",
            "C: Install a network analyzer tool on the mobile device to capture traffic without changing the app configuration.",
            "D: Update the Xamarin framework on the mobile device to the latest version to ensure proxy settings are respected."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Xamarin Proxy Configuration"
    },
    {
        "id": "3a650e15-a037-427e-88ab-f19cc22f75b0",
        "source": "cwe",
        "question": "In reviewing a software module's design, a developer argues that there is no need to strictly enforce argument types for function calls since the programming language being used is loosely typed. Which of the following is the best counterargument to this claim?",
        "choices": [
            "A: Loosely typed languages can still suffer from unexpected behaviors when the wrong data types are passed to functions, leading to potential security weaknesses.",
            "B: Strictly enforcing argument types will significantly reduce the execution speed of the application, which is undesirable.",
            "C: In a loosely typed language, the compiler automatically corrects any type mismatches, so there is no need for concern.",
            "D: The developer should focus solely on optimizing the code for performance, rather than worrying about argument types."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "ArgumentValidation"
    },
    {
        "id": "cb2a93fc-a60f-4fed-a336-c9f1d2be78d0",
        "source": "cs161_textbook",
        "question": "Consider the consensus mechanism in Bitcoin, which assumes the majority of users are honest. Which of the following statements are true about this assumption? Select all that apply.",
        "choices": [
            "A: The assumption is based on the belief that it is highly improbable for a majority of users to act maliciously due to the economic incentives of maintaining a reliable system.",
            "B: The assumption is necessary because, without it, any user could unilaterally alter the blockchain without consensus.",
            "C: The assumption implies that the system is fault-tolerant and can withstand up to 50% of users being malicious without breaking consensus.",
            "D: The assumption is flawed because it doesn't account for the possibility of a 51% attack, where a majority of mining power is controlled by a malicious entity."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Honest Majority"
    },
    {
        "id": "9423bf56-43b2-4f7b-bdba-fcd12a98e9be",
        "source": "attck",
        "question": "A security team has recently discovered that adversaries have been deploying containers in their environment to bypass existing defenses. Which of the following would NOT be an effective mitigation strategy to prevent such unauthorized container deployments?",
        "choices": [
            "A: Enforcing the principle of least privilege by using RoleBindings to limit user privileges in container orchestration systems.",
            "B: Implementing an audit system that scans images before deployment and blocks those not in compliance with security policies.",
            "C: Configuring containers with relaxed network rules and user limitations to accommodate for easier administration.",
            "D: Monitoring for unexpected modifications to containers and pods that could indicate attempts to deploy malicious containers."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Mitigation Strategy"
    },
    {
        "id": "909d4786-c0a7-4122-9e06-dec2961d71f7",
        "source": "windows_security",
        "question": "In the context of Windows Security, if a system administrator needs to take ownership of files and directories during a restore operation, bypass the set access control lists (ACLs), and set any valid user or group as the owner of an object, which privilege must they have?",
        "choices": [
            "A: SeShutdownPrivilege",
            "B: SeRestorePrivilege",
            "C: SeSecurityPrivilege",
            "D: SeRemoteShutdownPrivilege"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SeRestorePrivilege"
    },
    {
        "id": "e134cac6-51e6-4c29-9695-dfc8de4932d9",
        "source": "attck",
        "question": "A penetration tester is analyzing a piece of malware to determine which technique it uses to escalate privileges. The malware has been observed copying access tokens from existing processes and using those tokens to start new processes with elevated privileges. Which of the following techniques from the ATT&CK framework does the malware most likely employ?",
        "choices": [
            "A: Token Impersonation/Theft",
            "B: Parent PID Spoofing",
            "C: SID-History Injection",
            "D: Make and Impersonate Token"
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "Vulnerability"
        ],
        "keyword": "Access Token Manipulation"
    },
    {
        "id": "1217d243-11ff-4b83-83ea-67af12ca28d0",
        "source": "windows_security",
        "question": "In the deployment of enterprise certificate pinning, which of the following actions is NOT a step in the standard process as outlined for Windows devices?",
        "choices": [
            "A: Creating a pin rules certificate trust list file from the XML file.",
            "B: Deploying the registry configuration on the reference computer via group policy.",
            "C: Converting the certificate trust list into a binary format using a third-party utility.",
            "D: Applying the pin rules certificate trust list file to a reference administrative computer."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Certificate Trust List (CTL)"
    },
    {
        "id": "dd70edc2-d64f-40b6-81b5-c22c4295d538",
        "source": "owasp_wstg",
        "question": "A security analyst is tasked with assessing the security of a web-based PL/SQL application. The application utilizes Oracle's PL/SQL Gateway to translate web requests into database queries. The analyst is aware that different implementations of the PL/SQL Gateway, such as the early web listener product, the Apache `mod_plsql` module, and the XML Database (XDB) web server, have their own unique security considerations. Which of the following vulnerabilities should the analyst be particularly vigilant about when assessing the application? (Select TWO.)",
        "choices": [
            "A: Potential SQL injection vulnerabilities due to improper handling of user input by the PL/SQL Gateway.",
            "B: Denial of Service (DoS) attacks targeting the underlying operating system rather than the PL/SQL Gateway itself.",
            "C: Cross-site scripting (XSS) attacks facilitated by inadequate output encoding mechanisms in the PL/SQL Gateway.",
            "D: Buffer overflow vulnerabilities within the PL/SQL Gateway implementations that process web requests."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PL/SQL Gateway"
    },
    {
        "id": "50d3f622-6b55-4913-9e49-29a8feb68190",
        "source": "apple_platform_security",
        "question": "An IT security analyst at a company using Apple devices is assessing the security features provided by Apple's operating systems on their new hardware. From the features listed below, select the ones that are designed to protect the integrity of the operating system and prevent exploitation.",
        "choices": [
            "A: Fast Permission Restrictions allow for rapid changes in memory permissions, reducing overhead during system calls and preventing simultaneous execution, reading, and writing of memory.",
            "B: Pointer Authentication Codes provide environmental data monitoring to optimize system performance and prevent resource exhaustion attacks.",
            "C: Kernel Integrity Protection prevents modifications to kernel and driver code post-initialization by denying writes to a protected physical memory region.",
            "D: System Coprocessor Integrity Protection locks down coprocessor firmware at boot time to prevent its modification, ensuring the security of critical system tasks."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "MemorySafety"
        ],
        "keyword": "SecurityFeatures"
    },
    {
        "id": "decfb159-2637-4c6b-9a51-cd01eab99e25",
        "source": "cwe",
        "question": "In designing a secure software deployment process, what strategy should be employed to reduce the risk of introducing replicating malicious code into the system?",
        "choices": [
            "A: Minimize the use of third-party libraries to reduce the attack surface.",
            "B: Implement a sandbox environment where all incoming files are executed and monitored for suspicious behavior.",
            "C: Conduct regular penetration testing to identify and address security vulnerabilities.",
            "D: Perform software integrity verification by checking digital signatures and checksums during the installation phase."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SoftwareDeployment"
    },
    {
        "id": "e73249cc-9096-4a6b-a03f-924091b97072",
        "source": "attck",
        "question": "A network administrator observes regular data transmissions from a server to an external IP address every 10 minutes. The administrator suspects that this could be a case of scheduled data exfiltration by an adversary. Which of the following actions would be most effective in investigating and mitigating this potential security threat?",
        "choices": [
            "A: Implement network signature-based intrusion detection systems to identify specific adversary command and control infrastructure.",
            "B: Increase the frequency of data backups to ensure any lost data can be quickly restored.",
            "C: Schedule downtime for the server during off-hours to prevent unauthorized data transfers.",
            "D: Migrate services to a new server with a different operating system to disrupt the adversary's tactics."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Scheduled Data Exfiltration"
    },
    {
        "id": "5b67044f-d852-46c2-8710-88b9486420b5",
        "source": "attck",
        "question": "A cybersecurity team has implemented multi-factor authentication (MFA) as a mitigation strategy against account manipulation attacks. Which of the following scenarios would MFA least likely prevent?",
        "choices": [
            "A: An adversary leverages stolen credentials to access a user's cloud storage.",
            "B: An adversary modifies the `authorized_keys` file on a server to maintain SSH access.",
            "C: An adversary uses a phishing attack to obtain a user's single-factor credentials.",
            "D: An adversary intercepts a one-time password sent to a user's compromised email."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "419bab6e-263c-4557-890d-2879860ba0c5",
        "source": "owasp_mastg",
        "question": "Considering the evolution of Android's default network security configurations, what could be the rationale behind the framework setting the 'cleartextTrafficPermitted' flag to 'false' by default starting with Android 9 (API level 28)?",
        "choices": [
            "A: To mandate the usage of cleartext traffic for all network communications and ensure compatibility with older protocols.",
            "B: To prevent the accidental usage of cleartext traffic, thus enhancing the security of network communications.",
            "C: To allow more flexibility for developers in implementing custom security protocols and configurations.",
            "D: To reduce the performance overhead associated with encrypted traffic by defaulting to cleartext communication."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "cleartextTrafficPermitted"
    },
    {
        "id": "e47756e2-9ea3-4297-bad9-34f45e919cb2",
        "source": "windows_security",
        "question": "As an IT professional, you are configuring the security policy setting for a Windows client to determine what user information should be displayed when a session is locked. Which of the following considerations should you take into account to ensure a balance between user convenience and security best practices?",
        "choices": [
            "A: Displaying full user account names and department information can aid in social engineering attacks.",
            "B: Hiding all user information from the lock screen can lead to increased help desk calls due to users forgetting their usernames.",
            "C: Showing only the user's first name may provide a compromise between displaying too much information and none at all.",
            "D: Displaying the user's last login time can discourage unauthorized access attempts during perceived off-hours."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "security policy setting"
    },
    {
        "id": "54f6f9a2-d124-4547-8524-75df1ce89aab",
        "source": "apple_platform_security",
        "question": "A security analyst is reviewing the security measures of Apple Pay as described for transactions within apps and on the web. Which of the following assertions about Apple Pay’s security measures are accurate, and what could be a potential counterargument for each?",
        "choices": [
            "A: Apple Pay uses a Device Account Number and a payment cryptogram for dynamic security, which enhances security but may lead to increased processing time for transactions.",
            "B: Apple Pay retains anonymous transaction information which can improve the service, but it could raise privacy concerns despite the data not being tied to the user.",
            "C: Apple Pay enables payments without user authentication for convenience, which could potentially increase the risk of unauthorized transactions.",
            "D: Credit or debit card numbers are stored on the device and sent to merchants, potentially increasing the risk of card number theft."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "ApplePaySecurity"
    },
    {
        "id": "6a4c6835-9496-4a07-b751-297e05d9df52",
        "source": "attck",
        "question": "In an effort to enhance detection capabilities for process injection techniques, a cybersecurity team is configuring their monitoring systems. Which of the following detection methods would provide the most effective way to identify unauthorized process injections?",
        "choices": [
            "A: Monitoring for file metadata changes indiscriminately across the network to detect potential code injections.",
            "B: Monitoring for Linux specific calls such as the ptrace system call, which should not generate large amounts of data due to their specialized nature.",
            "C: Relying solely on behavior-based detection for process injections without analyzing the specific sequences of API calls.",
            "D: Monitoring for process memory inconsistencies by comparing memory ranges against a known copy of the legitimate module."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Process Injection Detection"
    },
    {
        "id": "9d40e942-e755-4b39-97e8-caff7711a231",
        "source": "cs161_textbook",
        "question": "Which of the following statements are true regarding the properties and functionalities of pseudorandom number generators (pRNGs)?",
        "choices": [
            "A: A secure pRNG is designed such that its output is computationally indistinguishable from true random bits to any observer who does not know the seed.",
            "B: The efficiency of a pRNG is compromised if it is limited to producing a fixed number of bits per truly random input, since more true randomness would be required frequently.",
            "C: A pRNG's internal state remains constant once initialized with the initial truly random seed.",
            "D: The 'Generate(n)' function of a pRNG cannot update the internal state while generating pseudorandom bits."
        ],
        "answer": "AB",
        "topics": [],
        "keyword": "pRNG"
    },
    {
        "id": "0c9633c3-6927-4dd2-9561-50d633c734c3",
        "source": "android_sec_doc",
        "question": "As an Android developer, you are implementing an inverted color scheme for a high-contrast accessibility mode in your app. According to the guidelines for Android Protected Confirmation, you have set the background color to #000000 with an opacity of 87%. What should be the color for the confirmation string to ensure compliance with the inverted color accessibility requirements?",
        "choices": [
            "A: The confirmation string color should be set to #a1c2fa to maintain consistency with the icon color.",
            "B: The confirmation string color should be #ffffff to comply with the inverted color accessibility requirements.",
            "C: The confirmation string color should remain the same as the default color to avoid confusion.",
            "D: The confirmation string color should be set to #4285f4 to provide sufficient contrast against the background."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Inverted Color Accessibility"
    },
    {
        "id": "78711345-fe5f-4dcb-af82-9fdd8073df5a",
        "source": "apple_platform_security",
        "question": "Which of the following Apple devices feature a hardware microphone disconnect as described, and what is the primary security function of the Secure Enclave in these contexts?",
        "choices": [
            "A: 13-inch MacBook Pro with the T2 chip, and the Secure Enclave physically disconnects the microphone.",
            "B: iPad Pro (all models), and the Secure Enclave manages the sensor calibration for the hardware microphone disconnect.",
            "C: iPad models from 2020 onwards, and the Secure Enclave provides a non-reversible hardware lockout of sensitive parameters on the sensor.",
            "D: Mac computers with Apple silicon, and the Secure Enclave provides the foundation for evaluating biometric data."
        ],
        "answer": "CD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Hardware Disconnect"
    },
    {
        "id": "0984ccd7-13f5-4b03-8694-2b15f473ac1a",
        "source": "cs161_textbook",
        "question": "In the context of x86 assembly, certain registers are designated to hold addresses that point to specific sections of the memory associated with a program's execution. Given the three special x86 registers, eip, ebp, and esp, match each register with the section of C memory it typically points to during program execution:",
        "choices": [
            "A: eip points to the current instruction in the code section.",
            "B: ebp points to a variable in the static section.",
            "C: esp points to the top address of the current stack frame in the stack section.",
            "D: eip points to the bottom address of the heap section."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "registers"
    },
    {
        "id": "288ba220-06cb-4104-bfcc-4b576444582b",
        "source": "apple_platform_security",
        "question": "A company is planning to implement a system where their iOS app will allow users to make contactless payments using their iPhones. As a security consultant, you must ensure that the implementation aligns with Apple's security standards for such payments and key management. From the information you know about Apple's security standards, which of the following processes and measures should be incorporated into the company's system?",
        "choices": [
            "A: Ensure that payment kernels and contactless payment card data are hosted within the Secure Element of the device.",
            "B: Implement NFC controller protocols to handle communication only in Reader Mode for secure card data exchange.",
            "C: Store transaction information, including payer's personal details, within the app for customer service purposes.",
            "D: Encrypt and sign the card data using the payment acceptance applet on the Secure Element after card read completion."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "ContactlessPaymentSecurity"
    },
    {
        "id": "0ecb213f-fc03-495a-b90a-45b1a695c196",
        "source": "apple_platform_security",
        "question": "Which of the following scenarios would require the enablement of System Integrity Protection (SIP), FileVault, and Firmware Password to protect the integrity of the boot chain on an Intel-based Mac with an Apple T2 Security Chip?",
        "choices": [
            "A: A user needs to prevent rollback attacks on their macOS installation.",
            "B: An MDM administrator wants to prevent unauthorized boot modes such as recoveryOS and Single User Mode.",
            "C: An attacker with physical access is attempting to use Target Disk Mode to overwrite the booter.",
            "D: A user intends to ensure that the macOS kernel is protected against malicious writes from within a running macOS."
        ],
        "answer": "BCD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "BootChainSecurity"
    },
    {
        "id": "63ccbe8d-3d42-4bf2-a51b-760de15b15c3",
        "source": "cs161_textbook",
        "question": "Alice is trying to verify the integrity of a file she downloaded. She has the file's SHA256 hash that was securely obtained from the file's creators. What properties of the cryptographic hash function ensure that if the computed hash of her downloaded file matches the provided hash, the file is likely authentic and unaltered? Select all that apply.",
        "choices": [
            "A: The hash function is one-way, ensuring that an adversary cannot generate the original file from the hash alone.",
            "B: The hash function is second preimage resistant, preventing an adversary from finding a different file with the same hash as the original.",
            "C: The hash function is collision resistant, making it infeasible to find two distinct files that produce the same hash.",
            "D: The hash function is computation resistant, requiring significant time to calculate the hash for any given file."
        ],
        "answer": "ABC",
        "topics": [],
        "keyword": "HashFunctionProperties"
    },
    {
        "id": "145c214a-903b-4017-b2af-347c40ea42c9",
        "source": "attck",
        "question": "An advanced persistent threat (APT) group is known to operate using a sophisticated malware that utilizes multiple fallback mechanisms for command and control (C2) communications. These mechanisms include secondary C2 servers, use of various network protocols, and switching C2 channels upon certain triggers. As a cybersecurity analyst, you are evaluating the group's tactics and considering potential mitigation strategies. Which of the following would be the MOST effective mitigation strategy to counter the group's use of fallback channels?",
        "choices": [
            "A: Implementing strict egress filtering for all outbound traffic to limit communication to known command and control servers.",
            "B: Deploying network intrusion prevention systems that use network signatures to identify and mitigate traffic for specific adversary malware.",
            "C: Focusing solely on hardening the primary communication channel to prevent any fallback mechanisms from activating.",
            "D: Using antivirus software updates as the only line of defense against the malware used by the APT group."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Intrusion Prevention Systems"
    },
    {
        "id": "b2513815-2c48-4029-a252-e73acd551e70",
        "source": "cwe",
        "question": "In an argument about the severity of placing a user into an incorrect user group, one individual claims that the access-control system should automatically detect and prevent any malicious usage of this incorrect group membership. Why might this not be a valid argument?",
        "choices": [
            "A: Access-control systems rely on predefined rules and may not have the capability to detect the context of group membership.",
            "B: Users placed in incorrect groups usually do not have any malicious intent, which negates the need for detection.",
            "C: All group memberships are reviewed manually by an administrator on a daily basis, rendering automated detection systems unnecessary.",
            "D: Incorrect group memberships are a rare occurrence and hence do not require a sophisticated detection mechanism."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "AccessControl"
    },
    {
        "id": "85c3b986-ac94-4692-9d5d-26bc24e0673b",
        "source": "owasp_wstg",
        "question": "You are conducting a security assessment on a web application that uses cloud storage services. Which of the following actions should you perform to evaluate whether the access control configurations for the cloud storage service are properly in place?",
        "choices": [
            "A: Attempt to read and upload data using the provided URLs and methods like curl or AWS CLI.",
            "B: Check if the web application's source code contains hard-coded API keys for the cloud storage service.",
            "C: Verify the SSL/TLS certificate of the cloud storage service's domain to ensure data is encrypted in transit.",
            "D: Perform a port scanning on the cloud storage service's endpoints to find open ports."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Access Control Configuration"
    },
    {
        "id": "abf26766-70c7-4157-bb5d-3d4522fbb90e",
        "source": "cwe",
        "question": "In the design review of a legacy application, several instances of obsolete functions were identified. What are the most compelling arguments against continuing to use these obsolete functions? Select all that apply.",
        "choices": [
            "A: Obsolete functions can lead to code that is more difficult to maintain and understand, as they may not align with current coding standards and practices.",
            "B: The use of obsolete functions may not pose any security risks if the application is not connected to the internet.",
            "C: Continuing to use obsolete functions can increase the risk of security vulnerabilities as they may not have been designed with modern security threats in mind.",
            "D: Retaining obsolete functions can hinder the integration of new technologies and frameworks that are based on current language features and standards."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "LegacyCode"
    },
    {
        "id": "0c91d01f-31b1-4949-a413-333eb09529f0",
        "source": "cwe",
        "question": "Given the following Python function that processes user input, select all scenarios that could potentially introduce vulnerabilities due to improper handling of input values:",
        "choices": [
            "A: The function is called with fewer arguments than expected, leading to an IndexError.",
            "B: The input values provided are of the correct type and quantity, but one of them is a null value.",
            "C: The function is called with more arguments than expected, but all extra arguments are ignored.",
            "D: All input values provided are strings, including ones that are expected to be integers, leading to a Type Error."
        ],
        "answer": "ABD",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "7593c324-b176-48cb-b9dd-c522e2876fbd",
        "source": "apple_platform_security",
        "question": "A company is planning to deploy a fleet of iOS devices for its field agents and needs to ensure that sensitive data stored on the devices is protected in the event that any device gets lost or stolen. As a security consultant, which of the following technologies and features should you recommend integrating into their security infrastructure to protect the data at rest on the devices? (Select all that apply.)",
        "choices": [
            "A: System Coprocessor Integrity Protection (SCIP) to prevent unauthorized modification of the coprocessor firmware, which may indirectly affect the security of the data.",
            "B: Passcode-derived key (PDK) to ensure that data encryption keys are intertwined with the user's passcode, providing an additional layer of security.",
            "C: ridge flow angle mapping to provide a mathematical representation of fingerprint data, ensuring only authorized users can access the device.",
            "D: XProtect technology to implement signature-based detection and removal of malware, which could potentially access or compromise data on the devices."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Data Protection"
    },
    {
        "id": "814747b5-79a7-44a0-a914-1721f4884d10",
        "source": "windows_security",
        "question": "In Windows 10, which of the following security features would provide the best protection against a malicious application attempting to tamper with the memory space of a trusted application, and what is a potential drawback of this security measure?",
        "choices": [
            "A: SMB signing and mutual authentication for SYSVOL and NETLOGON shares – May prevent legitimate scripts from processing domain-based Group Policy if misconfigured.",
            "B: Universal Windows apps running in an AppContainer sandbox – May limit the app's functionality due to restricted system-level access.",
            "C: Protected Processes feature – May interfere with the performance of the system due to the extra validation required.",
            "D: Heap allocation randomization – May cause compatibility issues with legacy applications expecting static memory allocation."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Protected Processes"
    },
    {
        "id": "3921f1ea-e732-45b8-a286-7af8565233cd",
        "source": "owasp_wstg",
        "question": "A security analyst is evaluating the risks of a web application which does not implement HTTP Strict Transport Security (HSTS). Which of the following are potential security issues that could arise due to the absence of the HSTS header? (Select two)",
        "choices": [
            "A: Attackers could intercept and access information transferred over an encrypted network channel.",
            "B: Users may not be able to access the website due to certificate errors.",
            "C: Attackers could carry out manipulator-in-the-middle (MITM) attacks by exploiting users who accept untrusted certificates.",
            "D: Users could mistakenly enter an address using HTTP instead of HTTPS, leading to unencrypted traffic."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "MITM attacks"
    },
    {
        "id": "40f0d5ad-7907-4420-8772-9dd0ef71ac2b",
        "source": "owasp_mastg",
        "question": "When conducting security testing on iOS devices, certain modifications to the operating system may be necessary to enable a higher level of access and control. These modifications often include the ability to run unsigned code and have unrestricted debugging capabilities. What are the potential benefits for a security tester to perform such modifications on an iOS device?",
        "choices": [
            "A: Access to internal APIs and the ability to install applications from any source, which can facilitate dynamic analysis.",
            "B: Ability to dual-boot the device into a different operating system, providing comparative analysis against iOS.",
            "C: Automatic patching of all known vulnerabilities, ensuring a secure environment for testing.",
            "D: Enables the use of virtualization to simulate multiple devices and network environments."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Jailbreaking"
    },
    {
        "id": "33a354a9-250a-442d-b99b-28ca580c8ebf",
        "source": "windows_security",
        "question": "You are configuring a web server to host the Certificate Revocation List (CRL) for your domain. After creating a DNS host record for the CRL, you must set up a file share with appropriate permissions and disable caching for the shared folder. What are the correct steps to completing this configuration?",
        "choices": [
            "A: In the file share properties, share the folder with the name 'cdp$', set 'Full control' permission for the certificate authority, disable caching by selecting 'No files or programs from the shared folder are available offline', and ensure NTFS permissions grant 'Full control' to the certificate authority.",
            "B: Configure the shared folder with the name 'crl$', set 'Read' permission for everyone, enable caching by selecting 'Only the files and programs that users specify are available offline', and set NTFS permissions to 'Read & Execute' for authenticated users.",
            "C: Share the folder without setting a specific share name, grant 'Modify' permissions to the certificate authority, leave caching settings at their default values, and set NTFS permissions to 'Full control' for the web server's computer account only.",
            "D: In the file share properties, share the folder with the name 'cdp', set 'Read & Execute' permission for the certificate authority, disable caching by selecting 'Files or programs from the shared folder can be cached for offline use', and ensure NTFS permissions grant 'Modify' to the web server administrators group."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Certificate Revocation List (CRL)"
    },
    {
        "id": "158246ad-be51-46de-b7de-c97c7405622b",
        "source": "mozilla_security",
        "question": "A web application implements a security mechanism that includes verifying a unique token on both the client's session and the server side before processing a request. This measure is primarily used to mitigate which of the following types of attacks?",
        "choices": [
            "A: Distributed Denial-of-Service (DDoS) Attacks",
            "B: Cross-Site Scripting (XSS) Attacks",
            "C: Cross-Site Request Forgery (CSRF) Attacks",
            "D: SQL Injection Attacks"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSRF Prevention"
    },
    {
        "id": "7de3b0e7-37c0-4753-93a7-7aac4207141f",
        "source": "apple_platform_security",
        "question": "When deploying FileVault on APFS-enabled devices, a user would need to be aware of the various methods available to manage encryption keys and recovery options. Which of the following actions can they continue to perform?",
        "choices": [
            "A: Store a personal recovery key with an MDM solution for escrow.",
            "B: Create and use a local administrator recovery key (LARK) for each device.",
            "C: Defer FileVault enablement until a user logs in or out.",
            "D: Use Secure Token to enable automatic login for all users."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "FileVault"
    },
    {
        "id": "04c99f39-d4d3-4f90-a9b3-51e265ba08f1",
        "source": "owasp_mastg",
        "question": "When designing an authentication mechanism for a mobile application on Android, what practices should be followed to ensure compliance with recognized security standards?",
        "choices": [
            "A: Implement device-level authentication that relies solely on the security of the underlying platform.",
            "B: Utilize well-tested protocols and frameworks to handle authentication processes within the application.",
            "C: Develop a custom authentication protocol that is unique to the application to prevent known attack vectors.",
            "D: Store user credentials locally on the device to expedite the authentication process."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Authentication Mechanisms"
    },
    {
        "id": "8791d918-fc6d-4a0a-a8ce-f02ac5526546",
        "source": "apple_platform_security",
        "question": "Which of the following reasons best explain why Apple has deprecated certain cipher suites and algorithms for TLS connections on its devices?",
        "choices": [
            "A: To enforce the usage of cryptographic standards that ensure forward secrecy",
            "B: To encourage the development of proprietary encryption methods by third-party developers",
            "C: To phase out algorithms with known vulnerabilities such as RC4",
            "D: To support legacy systems with maximum compatibility"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Deprecated Algorithms"
    },
    {
        "id": "d99de8c0-7ef3-49ac-868f-43d9a6a2e891",
        "source": "mit6.858",
        "question": "A Certificate Authority (CA) plays a critical role in the SSL/TLS certificate trust model. However, there are various scenarios where the CA's role can be compromised or misused. Which of the following scenarios present potential security concerns involving CAs?",
        "choices": [
            "A: A web server generates its own certificate without the involvement of a CA.",
            "B: A CA erroneously issues a certificate for a domain to an unauthorized entity.",
            "C: A CA's private key is exposed due to a server vulnerability like the Heartbleed bug.",
            "D: A CA revokes a certificate immediately after it expires."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "CATrustIssues"
    },
    {
        "id": "cdd08d0c-36a4-4ab6-9d67-6d1b4a9aea09",
        "source": "mozilla_security",
        "question": "Why is it generally not recommended for most websites to implement HTTP Public Key Pinning (HPKP), despite its ability to enhance security by binding a site to specific certificate authorities?",
        "choices": [
            "A: The implementation of HPKP is complex and requires frequent updates, leading to high maintenance costs.",
            "B: HPKP is deprecated in favor of newer technologies that offer better security features and easier management.",
            "C: The possibility of a self-denial-of-service due to incorrect HPKP implementation outweighs the risk of a fraudulent certificate being issued.",
            "D: The majority of websites do not have the technical expertise required to manage HPKP effectively."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Self-denial-of-service"
    },
    {
        "id": "e6d54245-da3d-42cb-8d87-1b16183ba787",
        "source": "apple_platform_security",
        "question": "You are configuring the security policy for a Mac with Apple silicon that has multiple macOS installations. Which of the following statements are accurate regarding the security policy control and boot mode restrictions for this scenario?",
        "choices": [
            "A: Fallback recoveryOS is capable of downgrading security settings for any macOS installation.",
            "B: Permissive Security setting can only be accessed from command-line tools and is not available within the Startup Security Utility.",
            "C: Security policies are set globally for the Mac and affect all installed macOS instances, regardless of their version.",
            "D: The paired recoveryOS for a macOS installation can downgrade security settings but only for the specific paired macOS version."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityPolicy"
    },
    {
        "id": "d87e4d77-e481-4fdf-8477-5ea5069a948e",
        "source": "owasp_mastg",
        "question": "A mobile application developer is implementing security measures for an Android app that handles sensitive user data. Which of the following practices should the developer avoid to maintain a high level of security?",
        "choices": [
            "A: Utilizing Android's built-in security features to encrypt sensitive data before storing it locally.",
            "B: Implementing custom encryption algorithms to enhance the uniqueness of the security approach.",
            "C: Adopting the principle of least privilege when granting permissions to different components of the application.",
            "D: Applying regular security updates and patches to the application and its dependencies."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "9dd998bf-80e0-433c-9456-ec52ae9786d7",
        "source": "attck",
        "question": "An adversary has compromised a corporate network and executed several commands to erase traces of their activity. As a penetration tester, which of the following actions would you recommend as a detection strategy to identify such behavior?",
        "choices": [
            "A: Monitoring for unexpected firewall rule modifications that may indicate tampering.",
            "B: Exclusively enhancing physical security measures to prevent unauthorized access to server rooms.",
            "C: Focusing on increasing network throughput to dilute the concentration of malicious traffic patterns.",
            "D: Disabling remote management services to prevent adversaries from accessing system logs."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Defense Evasion"
    },
    {
        "id": "a4f036a2-2f9c-47fe-8fab-54bda8733e96",
        "source": "attck",
        "question": "A cybersecurity analyst notices unusual activity in the system logs of a company's server, including entries that correspond to the execution of shutdown/reboot commands and the presence of Event ID 1074 and Event ID 6006. Additionally, several reports have been received about sudden system unavailability. Based on the ATT&CK framework, which of the following could be the most likely explanation for this activity?",
        "choices": [
            "A: The server is undergoing routine maintenance, and the IT department is rebooting the systems as part of a scheduled update.",
            "B: An adversary has potentially compromised the system and is attempting to disrupt access or aid in the destruction of systems as part of an Impact tactic.",
            "C: The server’s power supply unit is malfunctioning, causing spontaneous reboots and generating corresponding event logs.",
            "D: A recent software update is incompatible with the system, leading to automatic reboots to prevent further system damage."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Impact Tactic"
    },
    {
        "id": "e1682f93-ec53-4d78-a6f9-7bc0da5890af",
        "source": "apple_platform_security",
        "question": "What would be the security implications if the Secure Enclave did not utilize a shared pairing key for communication with the Secure Element during Apple Pay transactions? Select all applicable answers:",
        "choices": [
            "A: The NFC controller would be unable to facilitate the encrypted communication between the Secure Enclave and Secure Element, potentially exposing transaction details.",
            "B: Payment authorization could proceed without encryption, making the process vulnerable to eavesdropping and replay attacks.",
            "C: The Device Account Number could be compromised as it would be stored on Apple Pay servers instead of the Secure Element.",
            "D: The card provisioning process would be unaffected, as it does not rely on the communication between the Secure Enclave and Secure Element."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Secure Communication"
    },
    {
        "id": "e75b07c1-dc98-4855-a223-5f2d1e8bbafa",
        "source": "android_sec_doc",
        "question": "In Android 8.0 and higher, during the boot-up process, the 'init' process is responsible for certain tasks related to SELinux policy files. Which of the following actions are performed by 'init' during the system boot-up to ensure proper loading and application of SELinux policies?",
        "choices": [
            "A: Mounts the vendor partition to read SELinux files and merge them with platform policies before loading into the kernel.",
            "B: Compiles the text-based SELinux policy files into binary format using the policy compiler.",
            "C: Concatenates file_contexts from `system/sepolicy` and `BOARD_SEPOLICY_DIRS` to generate `file_contexts.bin`.",
            "D: Switches SELinux from permissive mode to enforcing mode after loading the policy files."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "75f95abb-45f2-4c1d-8687-b502379d86e1",
        "source": "cs161_textbook",
        "question": "A new file-sharing application has become popular among users, and recently, reports of a virus spreading through this platform have emerged. As a security analyst, you are tasked with recommending strategies to enhance the application's defense against such viruses. Which of the following strategies would be effective in mitigating the risk of virus propagation through the application, considering the nature of viruses and signature-based detection methods?",
        "choices": [
            "A: Implementing a feature that scans and verifies the integrity of shared files using the latest virus signatures before they are opened by the user.",
            "B: Restricting the application's ability to execute code, thereby preventing viruses from running their malicious code upon file opening.",
            "C: Creating a sandbox environment where files are opened in isolation to observe for potential malicious behavior indicative of a virus.",
            "D: Enabling automatic updates for the application to ensure users are consistently operating with the most current version and security patches."
        ],
        "answer": "ABCD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "VirusPropagation"
    },
    {
        "id": "d45b6b4a-02d7-4f6a-9cf6-eeec8adb7c14",
        "source": "cwe",
        "question": "Given a code snippet that takes a user-supplied string to determine the size of an array to be allocated, which of the following checks would NOT be sufficient to prevent a potential buffer overflow vulnerability?",
        "choices": [
            "A: Checking that the user-supplied string represents a positive integer value.",
            "B: Ensuring the user-supplied string, when converted to an integer, does not exceed a predefined maximum size.",
            "C: Validating that the user-supplied string is within an allowable range of sizes for the array.",
            "D: Confirming that the user-supplied string contains only alphabetic characters."
        ],
        "answer": "D",
        "topics": [
            "MemorySafety",
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "BufferOverflow"
    },
    {
        "id": "ac3a1794-1513-4c85-a36f-80f7cf7c35dc",
        "source": "owasp_wstg",
        "question": "During a security audit of a web application, it was discovered that the application allows for the batch upload of files without proper validation. The development team proposes to implement a deny list of file extensions to block known malicious file types. As a security consultant, what would be the most effective counterargument to this proposed remediation strategy?",
        "choices": [
            "A: A deny list approach may not be comprehensive and can be circumvented by attackers who use unconventional file extensions or disguise malicious files with accepted extensions.",
            "B: Deny lists enhance security by providing a clear list of unacceptable file types, which makes it easier for the application to block malicious uploads.",
            "C: Using a deny list is more resource-efficient than other methods and will improve the application's performance during file uploads.",
            "D: A deny list is unnecessary since modern web browsers are capable of detecting and blocking malicious file uploads automatically."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Deny list"
    },
    {
        "id": "d0757080-e8ce-490d-abac-3352b07b8367",
        "source": "cs161_textbook",
        "question": "What are the advantages and potential limitations of using HMAC-DRBG as a pseudorandom number generator? Select all that apply.",
        "choices": [
            "A: HMAC-DRBG can accept an arbitrary long initial seed, which accommodates seeds with lower entropy by using more bits to achieve adequate entropy levels.",
            "B: The addition of non-entropic strings such as a string of 0 bits can deteriorate the entropy quality of HMAC-DRBG's internal state.",
            "C: HMAC-DRBG's reliance on HMAC ensures that the output is indistinguishable from random, as long as the internal state remains secret.",
            "D: Rollback resistance is a limitation of HMAC-DRBG because if the previous state can be computed from the current state, it indicates a reversal of the underlying hash function."
        ],
        "answer": "AC",
        "topics": [],
        "keyword": "HMAC-DRBG"
    },
    {
        "id": "7ed87700-1bd1-44f9-adcb-732a92032fcc",
        "source": "mit6.858",
        "question": "When establishing a secure channel over TCP/IP using cryptographic methods, which of the following components are essential to ensure both confidentiality and authenticity of the communication?",
        "choices": [
            "A: Encrypting the data using the server's public key to maintain confidentiality.",
            "B: Using the same symmetric key for both encryption and MAC to save on key management overhead.",
            "C: Verifying the server's identity with a certificate signed by a trusted authority server.",
            "D: Employing forward secrecy by using short-lived encryption keys and long-term signing keys."
        ],
        "answer": "ACD",
        "topics": [
            "Cryptography",
            "NetworkSecurity"
        ],
        "keyword": "SecureChannel"
    },
    {
        "id": "009b6972-fbc2-4be4-b317-ddff4afa6c6e",
        "source": "apple_platform_security",
        "question": "If an Apple Security Research Device were to be mistakenly handled by an unauthorized user, which of the following security measures would prevent the user from operating the device as a normal iPhone?",
        "choices": [
            "A: The device starts up only while charging and enters Recovery mode if not charging during startup.",
            "B: The device allows side-loading of applications without any restrictions.",
            "C: The device’s iBoot and Boot Kernel Collection are designed to fail booting on non-research-fused hardware.",
            "D: The device permits any downloaded application to be debugged using the 'research.com.apple.license-to-operate' entitlement."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security Measures"
    },
    {
        "id": "a6ee50a8-4795-47db-b1ae-a1df3fd00e96",
        "source": "cs161_textbook",
        "question": "Suppose a large multinational corporation decides to adopt a hierarchical PKI structure similar to the one outlined for the California state government. In evaluating this decision, which of the following are potential advantages and disadvantages of using a hierarchical PKI for managing digital certificates within the corporation?",
        "choices": [
            "A: Advantage: It can reduce the risk of a single point of failure in the certificate issuance process.",
            "B: Disadvantage: It eliminates the need for certificate revocation mechanisms.",
            "C: Advantage: Hierarchical PKI can reflect the organizational structure and improve manageability.",
            "D: Disadvantage: It can lead to longer certificate chains, possibly increasing the time required for certificate verification."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Hierarchical PKI"
    },
    {
        "id": "3a1315b5-5981-47c1-b5e6-9e7ac0ce53ee",
        "source": "attck",
        "question": "An adversary is planning an attack and needs to acquire infrastructure that is difficult to physically tie back to them and can be rapidly provisioned, modified, and shut down. Which of the following options would be least beneficial for the adversary's requirements?",
        "choices": [
            "A: Renting a botnet that can be used for distributed operations.",
            "B: Acquiring dedicated physical servers that are housed in a data center.",
            "C: Leasing cloud servers that offer quick setup and teardown capabilities.",
            "D: Utilizing serverless architecture to dynamically manage the provisioning of resources."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Serverless Architecture"
    },
    {
        "id": "bda504e4-0154-46d5-8970-1c609eb7523b",
        "source": "owasp_mastg",
        "question": "During a mobile application security assessment, you are tasked with ensuring that no unintended processes are interfering with your ability to monitor and test the WiFi interface. You come across a script that includes the following command: 'airmon-ng check kill'. What is the purpose of this command in the context of the security assessment?",
        "choices": [
            "A: To configure a new WiFi interface for monitoring purposes",
            "B: To monitor the traffic passing through the WiFi interface",
            "C: To terminate processes that may be using the WiFi interface",
            "D: To generate a report on the security of the WiFi interface"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Process Interference"
    },
    {
        "id": "d00ef981-3832-420a-b070-3e69bc96318c",
        "source": "owasp_mastg",
        "question": "In a comprehensive mobile app security testing guide, which of the following categories would most likely be included to ensure a robust examination of an application's security?",
        "choices": [
            "A: Authentication and session management",
            "B: Color scheme and design consistency",
            "C: User interface responsiveness",
            "D: Marketing strategy and advertisement placement"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "d82caef4-4625-4a48-933a-63225111816a",
        "source": "apple_platform_security",
        "question": "Which of the following statements correctly reflect the security features and policies associated with Apple IDs?",
        "choices": [
            "A: Apple IDs must contain at least one uppercase and one lowercase letter.",
            "B: Users are notified by email or push notifications when important changes are made to their account.",
            "C: Managed Apple IDs allow the organization to reset passwords and limit purchasing.",
            "D: Two-factor authentication for Apple IDs uses a four-digit verification code."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Policy"
    },
    {
        "id": "c5b08b66-3344-4c37-9c95-3ee46c7eb4e6",
        "source": "owasp_wstg",
        "question": "What are the potential consequences of not properly sanitizing user input in a web application with dynamic file inclusion mechanisms?",
        "choices": [
            "A: Optimized performance of the web server due to dynamic content loading.",
            "B: Sensitive Information Disclosure due to unauthorized access to local files.",
            "C: Improved user experience by allowing customizable content inclusion.",
            "D: Denial of Service (DoS) attacks by overwhelming the application with file requests."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Dynamic File Inclusion"
    },
    {
        "id": "99d6c43e-098e-4a31-81b3-dccaa953a708",
        "source": "attck",
        "question": "A penetration tester is analyzing the behavior of a newly discovered malware on a victim's system. The malware exhibits various activities that are indicative of process discovery attempts. Which of the following activities is LEAST likely to be a method used by malware for process enumeration based on established adversary patterns?",
        "choices": [
            "A: The malware uses the Tasklist command to gather a list of running tasks.",
            "B: The malware calls NtQuerySystemProcessInformation with SystemProcessInformation to enumerate all running processes.",
            "C: The malware generates a unique hash for each process name and compares it to a blocklist to determine if it should terminate the process.",
            "D: The malware checks the system's BIOS version to determine active processes."
        ],
        "answer": "D",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Process Discovery"
    },
    {
        "id": "f535982c-2b36-4f2f-90d4-883fe762ee25",
        "source": "apple_platform_security",
        "question": "An Apple device owner uses the 'Find My' feature to locate their missing device. Which of the following statements are correct regarding the process and privacy protection measures involved in locating the device using 'Find My'?",
        "choices": [
            "A: The finder's device encrypts its current location using the public key Pi from the missing device's broadcast, and Apple can decrypt this information.",
            "B: The encrypted location data is associated with a server index computed as the SHA256 hash of the P-224 public key Pi, which Apple cannot correlate to specific devices.",
            "C: The device owner can decrypt the encrypted location information using the original private P-224 key d and secret values SKi known only to them.",
            "D: Apple retains information that allows them to correlate the finder and owner of the device for customer support purposes."
        ],
        "answer": "BC",
        "topics": [],
        "keyword": "Encryption"
    },
    {
        "id": "b75651bf-7ad4-4fea-af92-035e10d17718",
        "source": "mozilla_security",
        "question": "You are developing a web application that includes a third-party JavaScript library hosted on a CDN. To ensure the integrity of the script being loaded, which technique would be most effective and why?",
        "choices": [
            "A: Implement Subresource Integrity by adding an integrity attribute to the script tag, which will provide a hash of the expected script content.",
            "B: Include the script via an iframe to isolate it from the main page, thus preventing any possible malicious code from accessing your page's data.",
            "C: Use a CORS header 'Access-Control-Allow-Origin: *' on your server to ensure that the script is loaded securely from the CDN.",
            "D: Rely on the Same-Origin Policy of the browser to automatically prevent the loading of scripts that do not match the site's origin."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Subresource Integrity"
    },
    {
        "id": "efcaa0e5-4c13-40e2-887d-84252fe0b310",
        "source": "cwe",
        "question": "An application development team is assessing the risks of using dynamic variable identification in their project. What are the MOST important reasons for avoiding dynamic variable identification from a security perspective?",
        "choices": [
            "A: Dynamic variable identification can increase the complexity of code, making it harder to maintain and audit.",
            "B: Attackers can potentially modify unintended variables with security implications if they gain control over the input strings.",
            "C: Dynamic variable identification can lead to performance issues due to the overhead of runtime checks.",
            "D: Using dynamic variable identification can make it difficult to implement internationalization and localization features."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityRiskAssessment"
    },
    {
        "id": "a62af244-4469-4445-924a-cee05b32116e",
        "source": "cwe",
        "question": "A web application processes user-submitted dates in the format of 'MM/DD/YYYY'. An attacker realizes that when a date input contains letters (e.g., 'AB/CD/EFGH'), the application does not perform proper validation and processes this input in an unintended way, which leads to unauthorized access to sensitive data. What could be the primary reason for this security breach?",
        "choices": [
            "A: The application does not sanitize user input, allowing script injection.",
            "B: The application incorrectly assumes all input will be in the correct date format, leading to a type confusion error.",
            "C: The application uses weak encryption for user input, enabling attackers to decrypt sensitive information.",
            "D: The application's access control relies on client-side verification, which can be bypassed."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Misinterpretation"
    },
    {
        "id": "cd3f6680-fb19-47bf-a8ca-0b280969d0a2",
        "source": "attck",
        "question": "A security engineer is tasked with improving the monitoring system to detect potential abuses of event-triggered execution mechanisms used by adversaries for persistence. Which of the following should the engineer monitor? (Select TWO.)",
        "choices": [
            "A: Monitor the network traffic to detect anomalies in data patterns.",
            "B: Monitor executed commands and arguments related to system event triggers.",
            "C: Monitor the installation of new software packages unrelated to system events.",
            "D: Monitor for changes made to windows registry keys related to system event triggers."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Detection Strategies"
    },
    {
        "id": "89efcd47-2fae-4553-b00a-73eab39b2252",
        "source": "apple_platform_security",
        "question": "A security analyst is tasked with explaining the rationale behind various design choices for the Secure Enclave's components. What are the reasons for these specific features of the Secure Enclave? (Select all that apply.)",
        "choices": [
            "A: The Secure Enclave Processor runs at a lower clock speed to reduce the risk of clock and power attacks.",
            "B: The Memory Protection Engine uses a nonce in conjunction with the CMAC to prevent replay attacks on Secure Enclave memory.",
            "C: The Secure Enclave Boot ROM is immutable to prevent unauthorized modification and ensure a consistent hardware root of trust.",
            "D: The True Random Number Generator (TRNG) is based on a single ring oscillator for simplicity and cost-effectiveness."
        ],
        "answer": "ABC",
        "topics": [],
        "keyword": "Design Rationale"
    },
    {
        "id": "f9c70ae5-becb-4539-bcc6-c41bbc18d6e5",
        "source": "windows_security",
        "question": "An organization is deploying the enterprise certificate pinning feature on their Windows devices. They are creating a pin rules XML file and want to ensure that the rules for pinning are audited even after the enforcement period expires. Which combination of attributes should they include in the PinRules element to fulfill this requirement without specifying both a Duration and a NextUpdate?",
        "choices": [
            "A: Include the LogDuration attribute with a specified time span.",
            "B: Include the ListIdentifier attribute with a friendly name for the list of pin rules.",
            "C: Include both Duration and NextUpdate attributes with the same expiry date.",
            "D: Include the NextUpdate attribute with a specific UTC DateTime and omit Duration."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Enterprise Certificate Pinning"
    },
    {
        "id": "cdba3d33-bd5b-4bfa-88f9-b7093ab620b0",
        "source": "owasp_mastg",
        "question": "An iOS app developer wants to ensure that a stored secret authentication token can only be accessed after successful Touch ID authentication and it is only available on the current device when the passcode is set. Which attribute and parameter should be used when saving the secret token to the iOS keychain to meet these requirements?",
        "choices": [
            "A: Use `kSecAttrAccessibleWhenUnlocked` as the attribute with `SecAccessControlCreateFlags.biometryAny` as the parameter.",
            "B: Use `kSecAttrAccessibleAlways` attribute to ensure the token is always accessible for user convenience.",
            "C: Use `kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly` as the attribute with `SecAccessControlCreateFlags.biometryCurrentSet` as the parameter.",
            "D: Implement a `SecAccessControlCreateFlags.userPresence` parameter to allow access based solely on user presence without any biometric check."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "SecAccessControl"
    },
    {
        "id": "da003750-3a7e-4ade-b94f-231c447a75b9",
        "source": "windows_security",
        "question": "In the context of deploying virtual smart cards, which of the following statements are true regarding their personalization and security features?",
        "choices": [
            "A: The administrator key is critical for the security of the card and can be set uniformly across the organization for ease of maintenance.",
            "B: Private information on a virtual smart card can be moved and used on a different computer with a different TPM.",
            "C: During personalization, the values for the administrator key, PIN, and PUK are assigned, with the administrator key used for resetting the PIN or deleting the card.",
            "D: Virtual smart card security includes isolated cryptography, ensuring unencrypted copies of private keys are loaded only within the TPM."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Trusted Platform Module (TPM)"
    },
    {
        "id": "a7c891ca-f1af-4ab7-87fd-987a9f514380",
        "source": "owasp_mastg",
        "question": "In an iOS application, you are implementing a feature that uses custom URL schemes to communicate with other apps. Which of the following practices should you employ to ensure the security of the URL handling process?",
        "choices": [
            "A: Validate all URL parameters and discard malformed URLs to prevent potential attacks.",
            "B: Allow other apps to directly delete content or access sensitive information through the URL scheme.",
            "C: Prompt users for confirmation before triggering any action from an incoming URL request.",
            "D: Use custom URL schemes as the preferred method for deep linking instead of universal links."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Custom URL schemes"
    },
    {
        "id": "2bf49701-af29-447c-8887-eb94043a6701",
        "source": "android_sec_doc",
        "question": "What are the potential implications of a system application on an Android device using the `defaultToDeviceProtectedStorage` attribute? Choose two.",
        "choices": [
            "A: It ensures that all data, including sensitive user information, is stored in Credential Encrypted (CE) storage by default.",
            "B: Sensitive data must be audited and paths changed to ensure it uses Credential Encrypted (CE) storage, as default storage is redirected to Device Encrypted (DE) storage.",
            "C: The attribute enables unrestricted access to both Device Encrypted (DE) and Credential Encrypted (CE) storage locations for the application.",
            "D: Device manufacturers should inspect the data stored to ensure it does not contain personal information, as it redirects app storage to Device Encrypted (DE) storage."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "defaultToDeviceProtectedStorage"
    },
    {
        "id": "05b2485d-4b47-4c1b-a37b-8c106b2db6f7",
        "source": "apple_platform_security",
        "question": "An organization is concerned about the possibility of their meetings being inadvertently recorded when laptops and tablets are left in the conference room. They are considering deploying Apple devices due to their hardware security features. As a cybersecurity consultant, you are tasked to explain the conditions under which the hardware microphone disconnect is triggered in these devices. Select all applicable scenarios from the options below:",
        "choices": [
            "A: The microphone is disconnected on Mac notebooks with the T2 chip when the lid is opened beyond a certain angle.",
            "B: On Apple silicon–based Mac notebooks, the microphone is disabled when the lid is closed.",
            "C: For iPad models from 2020 onwards, the microphone disconnects when a non-MFi-compliant case is closed.",
            "D: The microphone disconnect in Mac notebooks is triggered by a hardware signal from lid or case sensors."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "MicrophoneDisconnect"
    },
    {
        "id": "aa1911db-dd35-4319-9ec7-1d3f709417e0",
        "source": "attck",
        "question": "An adversary is attempting to collect sensitive data from a company's local network systems before executing an exfiltration plan. Which of the following methods is least likely to be employed by the adversary to search for files of interest on local systems?",
        "choices": [
            "A: Utilizing a Command and Scripting Interpreter to interact with the file system.",
            "B: Employing Automated Collection tools designed for data aggregation on the local system.",
            "C: Infiltrating the network device CLI to gather information from the file system.",
            "D: Deploying a SQL injection attack on the company's public-facing website."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Exfiltration"
    },
    {
        "id": "3dea6038-0a29-4165-b4df-1b4f656654c6",
        "source": "apple_platform_security",
        "question": "Consider a scenario where a large enterprise is developing a proprietary in-house application for its iOS devices. The development team must ensure that the application adheres to Apple's security standards and can be distributed within the organization. What measures would they need to consider as part of their development and distribution process to align with Apple's security requirements for apps on iOS and iPadOS?",
        "choices": [
            "A: Implementing an application firewall to restrict network access to and from the app.",
            "B: Using an Apple-issued certificate to sign the executable code of the app.",
            "C: Creating a provisioning profile to permit the proprietary in-house app to run on authorized devices.",
            "D: Ensuring that the app runs as the ‘root’ user to have the necessary privileges."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "AppSecurity"
    },
    {
        "id": "a8f5b7c5-4d12-47f7-aee9-260b13b0c3a0",
        "source": "cwe",
        "question": "Consider a web application that processes user-generated content before displaying it on a public forum. As a developer, you are reviewing code that is intended to sanitize input strings to prevent line delimiter injection vulnerabilities. Which of these approaches would be the most secure way to handle the input strings?",
        "choices": [
            "A: Use a denylist to filter out known dangerous characters or patterns and directly output the sanitized input.",
            "B: Perform input validation by allowing only a strict set of known good inputs, rejecting all others, and then encoding the output.",
            "C: Canonicalize inputs to a standard internal representation, perform input validation, and ensure inputs are not decoded multiple times.",
            "D: Accept all user input and rely on the downstream component to perform necessary validation and sanitation."
        ],
        "answer": "BC",
        "topics": [
            "Vulnerability",
            "SoftwareSecurity"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "d76a3bf8-6514-4a18-9053-357d77355f0b",
        "source": "mozilla_security",
        "question": "Why might a web application developer choose not to implement the 'Referrer-Policy: no-referrer, strict-origin-when-cross-origin' for their site?",
        "choices": [
            "A: It would prevent the Referer header from being sent to any origin, compromising the site's functionality.",
            "B: It would always send the full URL, including the path and query string, to any origin, compromising privacy.",
            "C: It would send no referrer information when navigating to a cross-origin, which can be too restrictive for analytics purposes.",
            "D: It would incorrectly configure the server to send referrer information to foreign origins only."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Referrer-Policy"
    },
    {
        "id": "a4e65bb0-cb2a-4f89-995b-0df7c44f2e4e",
        "source": "mozilla_security",
        "question": "A security analyst argues that loading passive content such as images over insecure channels on a secure website poses no significant threat beyond potentially degrading the user interface. What is the most valid counterargument to this claim?",
        "choices": [
            "A: Loading passive content insecurely has no negative consequences and is an accepted practice for modern web development.",
            "B: Insecure loading of passive content can allow active attackers to deface websites or phish users, representing a security threat.",
            "C: Browsers do not generate warnings for passive content loaded insecurely, so it is a non-issue for web security.",
            "D: Secure websites should aim to load passive content insecurely to conserve bandwidth and improve load times."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "phishing"
    },
    {
        "id": "c5128821-955f-47f5-901a-92a5c3b21735",
        "source": "owasp_wstg",
        "question": "A company's cybersecurity policy mandates the use of HTTPS for all its web applications. During a routine security assessment, you discover that an internal application is using a TLS certificate signed by the company's internal CA, which is not included in your system's list of trusted CAs. The application is only accessible within the company's network. What should your next step be regarding the certificate?",
        "choices": [
            "A: Mark the certificate as untrusted because it is not signed by a public CA.",
            "B: Accept the certificate as valid because it is signed by the company's internal CA and the application is for internal use.",
            "C: Recommend replacing the internal CA-signed certificate with a self-signed certificate for better security.",
            "D: Advise the company to discontinue using TLS as it is susceptible to implementation vulnerabilities."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Internal CA"
    },
    {
        "id": "81d7e018-20b5-4db9-8f24-38b19da5689b",
        "source": "cs161_textbook",
        "question": "A security consultant argues that in the event of a system failure, it is preferable for a firewall to continue forwarding packets to ensure business continuity. From a security principles perspective, which of the following counterarguments is most valid against this claim?",
        "choices": [
            "A: Continued packet forwarding may lead to network congestion, which can disrupt business operations.",
            "B: Defaulting to forwarding packets can expose the network to unfiltered traffic and potential attacks.",
            "C: Ensuring business continuity should always be the primary concern, even over security considerations.",
            "D: Packet forwarding during a failure can increase the firewall's recovery time once the system is restored."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "firewall"
    },
    {
        "id": "5b5e13fc-6e2a-4509-afdf-0ac32489d473",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, particularly for the Android platform, which of the following measures should be implemented to adhere to resilience requirements?",
        "choices": [
            "A: Utilizing multi-factor authentication to secure user access.",
            "B: Implementing obfuscation techniques to protect code against reverse engineering.",
            "C: Applying the same security measures for both front-end and back-end components.",
            "D: Ensuring compatibility with all Android versions, including deprecated ones."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Mobile Application Security"
    },
    {
        "id": "456d5310-1731-433f-aca8-05325066da7b",
        "source": "apple_platform_security",
        "question": "Consider a scenario where a macOS user is attempting to install an application obtained from the internet, which is not directly from the App Store. Which of the following statements are accurate regarding the security checks and protections that macOS applies to the application before it can be executed on the user's system?",
        "choices": [
            "A: The application must be signed with an Apple-issued Developer ID certificate and notarized by Apple to run under the default Gatekeeper settings.",
            "B: Gatekeeper ensures that applications from outside the App Store have not been altered and are free of known malicious content by verifying that they are from an identified developer and notarized by Apple.",
            "C: XProtect is responsible for real-time scanning and notarization of applications to ensure no known malware exists before execution.",
            "D: Mandatory Access Controls (MACs) in macOS do not require code signing for apps that need to pass through the firewall."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "macOS"
    },
    {
        "id": "2bc00990-dff8-407d-8076-0aad0c9496cd",
        "source": "apple_platform_security",
        "question": "Given the various data protection classes available on Apple devices that support Data Protection, which of the following scenarios would not be appropriately secured by the specified protection class?",
        "choices": [
            "A: Using Class A protection for files that need to be accessed immediately after device reboot, without user authentication.",
            "B: Using Class C protection for files that should be available as soon as the device is unlocked for the first time after a reboot.",
            "C: Using Class B protection to allow files to be written to while the device is locked, such as downloading a mail attachment in the background.",
            "D: Using Class D protection for files that require an additional layer of confidentiality and should not be stored in Effaceable Storage."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Data Protection Classes"
    },
    {
        "id": "c58c6b24-c7ee-431f-aab7-c4795d351f48",
        "source": "windows_security",
        "question": "You are configuring single sign-on for Microsoft Entra joined devices in an enterprise transitioning resources to the cloud. To ensure that these devices can validate certificates and provide single sign-on access to on-premises resources, what configuration should you implement for the CRL distribution point?",
        "choices": [
            "A: Publish the CRL distribution point on a web server using HTTPS.",
            "B: Configure the CRL distribution point to require authentication before accessing it.",
            "C: Publish the CRL distribution point on a web server using HTTP, without requiring authentication.",
            "D: Store the CRL distribution point within Active Directory using an LDAP URL."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "CRL distribution point"
    },
    {
        "id": "856d7f64-a060-4c45-8a54-cf293420d3a4",
        "source": "attck",
        "question": "An adversary has successfully obtained and is using alternate authentication material such as password hashes and application access tokens to move laterally within a company's network, bypassing normal system access controls. Which of the following mitigation strategies would NOT be effective against this specific type of attack?",
        "choices": [
            "A: Implementing system-wide multi-factor authentication (MFA)",
            "B: Enforcing the principle of least-privilege access",
            "C: Limiting credential overlap across systems",
            "D: Increasing the frequency of password rotation policies"
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Lateral Movement"
    },
    {
        "id": "8e55d32e-8700-48b7-8733-de5f8c0a2127",
        "source": "apple_platform_security",
        "question": "An organization is using an MDM solution to manage their fleet of iOS devices. As an IT administrator, you are aware that configuration profiles are crucial for enforcing security policies on these devices. If a user removes an enrollment profile from their device, which of the following outcomes is expected?",
        "choices": [
            "A: The device will no longer be able to receive new configuration profiles or commands from the MDM solution.",
            "B: All existing configuration profiles and their associated settings will remain on the device.",
            "C: Any managed apps installed via the enrollment profile will be removed from the device.",
            "D: Multiple enrollment profiles can coexist on the device after the removal of one."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "MDM"
    },
    {
        "id": "9fd171b7-4679-427d-9b7f-0f94a50e436a",
        "source": "attck",
        "question": "In a penetration testing scenario, you are evaluating a system that has been potentially compromised. Which of the following statements is a valid counterargument to the claim that all malware examples under the ATT&CK Discovery tactic query the Windows Registry to gather system information?",
        "choices": [
            "A: InvisiMole is an example of malware that specifically focuses on camera and microphone surveillance without querying the Registry.",
            "B: HOPLIGHT does not interact with the Registry as it only hooks lsass.exe for data exfiltration.",
            "C: Gold Dragon does not enumerate any Registry keys but instead focuses on data encryption.",
            "D: Carbon merely enumerates values in the Registry without gathering any system information."
        ],
        "answer": "BC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Discovery Tactic"
    },
    {
        "id": "59674197-319f-4da6-b4b3-3ec74faadf51",
        "source": "owasp_mastg",
        "question": "When securing an Android application against reverse engineering, a security engineer considers implementing obfuscation techniques. Which of the following statements accurately reflect the pros and cons of using obfuscation?",
        "choices": [
            "A: Obfuscation can prevent decompilation of Java classes, making reverse engineering impossible.",
            "B: Obfuscation can rename identifiers to meaningless strings, complicating reverse engineering without impacting performance.",
            "C: Using obfuscation guarantees the detection and prevention of any tampering with the app's native code.",
            "D: Obfuscation can potentially introduce new vulnerabilities due to the complexity it adds to the codebase."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Obfuscation"
    },
    {
        "id": "41b922f3-d410-46af-ae65-980401ea54ad",
        "source": "attck",
        "question": "An adversary is attempting to compromise a system by executing a payload using shared modules. As a security architect, you are tasked with deciding which mitigation technique would be best suited to prevent the execution of unknown modules. Which of the following would you recommend?",
        "choices": [
            "A: Implement application whitelisting to ensure only known and trusted modules are loaded.",
            "B: Increase the frequency of antivirus scans to detect and remove malicious modules.",
            "C: Restrict user permissions to read-only to prevent the execution of any modules.",
            "D: Deploy a network intrusion detection system to monitor for unusual module load activity."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Application Whitelisting"
    },
    {
        "id": "7e113b10-c718-48ae-b7d3-7989d35b6ecb",
        "source": "cs161_textbook",
        "question": "Consider the following statements regarding system security and cryptographic principles. Which of the following statements are true based on Shannon's Maxim and related security principles?",
        "choices": [
            "A: A cryptographic system that conceals its algorithms can be considered secure as long as the algorithms remain secret.",
            "B: Security through obscurity is a robust approach because the design complexity of a system makes it difficult for attackers to understand and exploit vulnerabilities.",
            "C: In cryptographic systems, the security should not depend on the secrecy of the algorithm, but rather on the secrecy of the keys, which should be easily changeable if compromised.",
            "D: An obscure system with limited knowledge shared among few experts can lead to a false sense of security and may become vulnerable as it gains popularity."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "security_principles"
    },
    {
        "id": "53f98bbc-3e4d-497b-8013-9852d5c7184c",
        "source": "cwe",
        "question": "A development team is designing a new embedded system that includes various components connected via a system bus. To comply with secure design principles, the team is considering the configuration of the bus-control-enable bit in the fabric end-point registers. Which of the following outcomes are likely if the bus-control-enable bit is set to 1 by default for all responder devices?",
        "choices": [
            "A: Responder devices would be restricted from initiating transactions, enhancing system security.",
            "B: Responder devices could potentially control bus transactions, leading to security vulnerabilities.",
            "C: The system would be more flexible, allowing any device to initiate transactions as needed.",
            "D: System boot time would be reduced, as no additional firmware checks would be needed for bus-control settings."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "security-vulnerabilities"
    },
    {
        "id": "445f2a45-ce45-4c8e-9a97-0abc80aa58dd",
        "source": "cs161_textbook",
        "question": "Given the binary string `0b1011001110001111`, select all valid hexadecimal conversions for the string.",
        "choices": [
            "A: 0xB38F",
            "B: 0xC71E",
            "C: 0xC38E",
            "D: 0xB39F"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "MemorySafety"
        ],
        "keyword": "NumberRepresentation"
    },
    {
        "id": "7e6ea1c6-27d1-4127-9c69-4082d588a027",
        "source": "cs161_textbook",
        "question": "You have been tasked with designing a public ledger using a hash chain to ensure that it is append-only and immutable. You receive a new message, \\(m_6\\), to append to the ledger. What information will you include in Block 6 to maintain the integrity of the hash chain, and why is this crucial for the ledger's security?",
        "choices": [
            "A: Include \\(m_6\\) and the hash of Block 5 in Block 6, ensuring any alteration of previous blocks would invalidate the hash of subsequent blocks.",
            "B: Include only \\(m_6\\) in Block 6 as including the hash of the previous block is redundant and increases data size unnecessarily.",
            "C: Include \\(m_6\\) and a random nonce in Block 6, relying on the uniqueness of the nonce for security.",
            "D: Include \\(m_6\\) and the hashes of all previous blocks in Block 6, to doubly ensure that no prior information is altered."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HashChain"
    },
    {
        "id": "5a255f3d-e2bc-4342-ac17-3bc92d5482ca",
        "source": "owasp_mastg",
        "question": "When configuring build settings for an iOS application to enhance its security, which of the following practices should be implemented? (Select TWO)",
        "choices": [
            "A: Enable stack protection to prevent stack overflow attacks.",
            "B: Disable ARC (Automatic Reference Counting) to improve manual memory management.",
            "C: Use non-executable memory to mitigate code injection vulnerabilities.",
            "D: Set the optimization level to the highest setting for debugging purposes."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Stack Protection"
    },
    {
        "id": "11cac7aa-d151-4970-8eb2-b414b4fc99ce",
        "source": "owasp_wstg",
        "question": "A developer is building a mobile application that requires secure authorization to access a web service. Which OAuth grant type would be the most secure and appropriate choice for this type of client application?",
        "choices": [
            "A: Authorization Code without PKCE, because mobile applications are considered public clients.",
            "B: Proof Key for Code Exchange (PKCE), since it enhances the security of the Authorization Code grant for use by public clients such as mobile applications.",
            "C: Implicit Flow, as it is designed specifically for client-side applications to retrieve access tokens quickly.",
            "D: Device Code, as it is intended for applications that operate on devices with limited input capabilities."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OAuth Grant Types"
    },
    {
        "id": "8dc29902-15d7-4cff-8857-9cebf7686f2a",
        "source": "cs161_textbook",
        "question": "Considering the limitations of block ciphers in terms of deterministic encryption and fixed-length input, select the block cipher mode(s) of operation that solve these issues by using randomization or statefulness in their encryption algorithm.",
        "choices": [
            "A: ECB Mode because it encrypts each block with a unique key derived from the message block itself.",
            "B: CBC Mode since it uses an initialization vector (IV) that introduces randomness into the encryption process.",
            "C: CFB Mode because it operates in a feedback loop that depends on the previous ciphertext block.",
            "D: OFB Mode because it uses an initial vector (IV) and generates a sequence of values that are encrypted to create a one-time pad."
        ],
        "answer": "BCD",
        "topics": [
            "Cryptography"
        ],
        "keyword": "BlockCipherModes"
    },
    {
        "id": "fe0e29c1-29d9-4fd6-8106-3d26175161b9",
        "source": "owasp_wstg",
        "question": "A company is deploying a new web application and has asked for your expertise to avoid common misconfigurations. Which of the following practices should be avoided to prevent compromising the application's security?",
        "choices": [
            "A: Reviewing server software documentation as part of the security assessment.",
            "B: Using generic configurations that are provided with system installations.",
            "C: Conducting performance tuning as recommended by the platform's official guidelines.",
            "D: Following industry benchmarks for web server security."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Generic Configurations"
    },
    {
        "id": "e11a070a-8585-4c6a-90b5-e1f70d654eb1",
        "source": "cwe",
        "question": "An application is being designed to allow users to retrieve files from a restricted directory. Which design approach would best prevent a path traversal vulnerability?",
        "choices": [
            "A: Implement a whitelist of approved file names, and only serve files that match the whitelist entries exactly.",
            "B: Allow full file paths to be specified, but monitor for suspicious patterns such as '..' and reject those requests.",
            "C: Use an index-based approach where users request files by an ID, mapped server-side to actual file paths.",
            "D: Accept user input for the path, but scan and remove known file extensions from the input string before accessing the file."
        ],
        "answer": "AC",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "SecureDesign"
    },
    {
        "id": "588ec3ad-4efc-4c05-9cd0-0e51c024cda8",
        "source": "attck",
        "question": "In the context of detecting an Endpoint Denial of Service attack, which of the following methods is LEAST likely to effectively identify the attack early on?",
        "choices": [
            "A: Monitoring for unusual traffic patterns and packet inspection for deviations from protocol standards.",
            "B: Analyzing third-party application logs for signs of service degradation.",
            "C: Monitoring for uncommon data flows from processes that do not normally utilize the network.",
            "D: Relying solely on user reports of service unavailability."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "DoS Detection"
    },
    {
        "id": "a6d7c4f6-7c95-487b-9052-2c89b0165f4b",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing a potential breach where sensitive data might have been exfiltrated. Given the emerging tactics of adversaries leveraging command and control (C2) channels to encode and send stolen data using the same protocol as C2 communications, which of the following methods would be the most effective in preventing data exfiltration without significantly impacting normal network operations?",
        "choices": [
            "A: Blocking all outgoing network traffic from the compromised host.",
            "B: Implementing strict egress filtering to monitor and restrict unusual types of outbound traffic.",
            "C: Enforcing application whitelisting to prevent unauthorized applications from executing.",
            "D: Regularly updating antivirus signatures on network endpoints."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Egress Filtering"
    },
    {
        "id": "68ab5a5b-d924-4529-866d-455ef3d85b9f",
        "source": "android_sec_doc",
        "question": "As an Android OS developer, you are tasked with configuring the encryption parameters for a new device's filesystem that is launching with Android 11 and features inline encryption hardware. What is the recommended setting for the `fileencryption` fstab option for most devices that meet these criteria?",
        "choices": [
            "A: fileencryption=aes-256-xts:aes-256-cts",
            "B: fileencryption=aes-256-xts:aes-256-cts:inlinecrypt_optimized",
            "C: fileencryption=aes-256-xts:aes-256-heh:inlinecrypt_optimized",
            "D: fileencryption=adiantum:inlinecrypt_optimized"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "fileencryption fstab option"
    },
    {
        "id": "2a37827c-f773-4a42-86bc-715d4fa73b44",
        "source": "attck",
        "question": "In the context of a containerized environment, what measures can be put in place to reduce the risk of unauthorized access through exposed remote services?",
        "choices": [
            "A: Monitoring for anomalous use of exposed APIs and applications",
            "B: Allowing anonymous access to Docker daemon API and Kubernetes environments to monitor traffic patterns",
            "C: Blocking all remote services indiscriminately to prevent any potential breaches",
            "D: Implementing gateway-controlled access only to well-documented and necessary remote services"
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Container Security"
    },
    {
        "id": "396e56d2-f127-4d98-8e59-774ca9a22837",
        "source": "android_sec_doc",
        "question": "You are tasked with implementing RSA encryption in an Android application. A requirement states that the message to be encrypted does not require a digest, and the RSA key size is 512 bytes. Which `PaddingMode` would you choose for this operation, and what is the minimum size the message can be?",
        "choices": [
            "A: `PaddingMode::RSA_PKCS1_1_1_5_ENCRYPT` with a minimum message size of 501 bytes.",
            "B: `PaddingMode::RSA_PSS` with a minimum message size of 510 bytes.",
            "C: `PaddingMode::RSA_OAEP` with no minimum message size requirement.",
            "D: `PaddingMode::RSA_OAEP` with a minimum message size of 501 bytes."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PaddingMode"
    },
    {
        "id": "ecbf92bc-b860-4df5-8b84-3d294c058060",
        "source": "cwe",
        "question": "A developer believes that using short circuit evaluation in conditional statements enhances performance without any negative impact on the logic of a program. Which argument counters this belief effectively, explaining the potential risks of short circuit evaluation?",
        "choices": [
            "A: Short circuit evaluation can cause some expressions not to be evaluated, which might skip necessary side effects and introduce logic errors.",
            "B: Short circuit evaluation significantly reduces the readability of the code, making it difficult to maintain.",
            "C: Short circuit evaluation is not well-defined in programming standards, leading to unpredictable behavior across different compilers.",
            "D: Short circuit evaluation can only be used with numerical data types, limiting its applicability in string and object manipulation."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ShortCircuitRisks"
    },
    {
        "id": "4de8282e-cdcd-4bd4-bc1b-e6c1ac4a47ec",
        "source": "owasp_mastg",
        "question": "A mobile app developer is looking to enhance the security of their application by implementing obfuscation techniques to protect against reverse engineering. Which combination of obfuscation methods would provide a balanced approach to hinder static analysis while maintaining reasonable application performance?",
        "choices": [
            "A: Aggressively using control flow flattening and heavy dead code injection throughout the app.",
            "B: Applying name obfuscation, string encryption, and selective control flow flattening.",
            "C: Implementing heavy string encryption only on the most critical parts of the app.",
            "D: Relying solely on instruction substitution for all operations within the app."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Obfuscation Techniques"
    },
    {
        "id": "d0ba335d-82c1-4374-a2da-394b0175dda6",
        "source": "cwe",
        "question": "A developer is writing a web application that includes a feature for pinging network hosts provided by users. Which of the following code snippets would not prevent an OS command injection vulnerability associated with this feature?",
        "choices": [
            "A: ping -c 4 $(echo $userInput | sed 's/[^a-zA-Z0-9.]//g')",
            "B: ping -c 4 `echo $userInput | sed 's/[^a-zA-Z0-9.]//g'`",
            "C: Runtime.getRuntime().exec(new String[]{\"ping\", \"-c\", \"4\", userInput.replaceAll(\"[^a-zA-Z0-9.]\", \"\")});",
            "D: ProcessBuilder pb = new ProcessBuilder(\"ping\", \"-c\", \"4\", userInput.replaceAll(\"[^a-zA-Z0-9.]\", \"\")); pb.start();"
        ],
        "answer": "B",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "code_snippet"
    },
    {
        "id": "f20b3e98-8e80-404e-b46a-88d1050f9640",
        "source": "apple_platform_security",
        "question": "An organization's employee is attempting to share a Wi-Fi password with a colleague using an iOS device. Under which circumstances would the Wi-Fi password sharing successfully occur? Select all that apply.",
        "choices": [
            "A: The requesting device advertises its need for the Wi-Fi password using Bluetooth Low Energy (BLE).",
            "B: The granting device requires the requestor's contact information and the requestor must verify their identity using a mechanism similar to AirDrop.",
            "C: The requesting device is connected to a power source and is in Airplane Mode.",
            "D: The granting device is managed through a mobile device management (MDM) solution that restricts the use of Wi-Fi password sharing."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Wi-Fi"
    },
    {
        "id": "61a2ec5e-b3a4-411a-9b26-e08b578efb31",
        "source": "attck",
        "question": "An adversary is aiming to conduct a financial theft operation through a targeted phishing campaign. They decide to use impersonation as their main tactic. Based on typical adversary behaviors, which of the following actions would the adversary most likely take to increase the chances of success? (Select TWO.)",
        "choices": [
            "A: Acquire infrastructure such as email domains to substantiate their false identity.",
            "B: Use generic email subjects that are applicable to a wide range of potential victims to avoid detection.",
            "C: Impersonate a low-level employee to avoid drawing attention.",
            "D: Leverage manipulative and persuasive language in their communication to induce urgent action."
        ],
        "answer": "AD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Impersonation"
    },
    {
        "id": "a74cc59b-8e2c-4eb1-9f29-45cfbb3d3bfb",
        "source": "owasp_wstg",
        "question": "In a scenario where an attacker aims to exploit a Self DOM-Based XSS vulnerability on a website, which of the following factors would make the attack more feasible?",
        "choices": [
            "A: The website uses a very sophisticated Content Security Policy (CSP) that only allows scripts from the same domain.",
            "B: The website provides detailed error logs in the developer console, helping users troubleshoot their input.",
            "C: The attacker convinces the user to disable their browser's CSP support under the pretense of resolving compatibility issues.",
            "D: The website's input fields are designed to only accept alphanumeric characters, limiting the types of inputs a user can submit."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Social Engineering"
    },
    {
        "id": "6a462b7e-771a-46ff-aa33-83a3743429c5",
        "source": "android_sec_doc",
        "question": "A developer is configuring a device with file-based encryption running Android 11. Which of the following kernel configuration settings are required to enable Adiantum and ensure optimal encryption performance?",
        "choices": [
            "A: CONFIG_CRYPTO_ADIANTUM=y\nCONFIG_DM_CRYPT=y\nCONFIG_F2FS_FS_ENCRYPTION=y",
            "B: CONFIG_CRYPTO_ADIANTUM=y\nCONFIG_FS_ENCRYPTION=y\nCONFIG_BLK_INLINE_ENCRYPTION=y\nCONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y\nCONFIG_FS_ENCRYPTION_INLINE_CRYPT=y\nCONFIG_DM_DEFAULT_KEY=y",
            "C: CONFIG_CRYPTO_ADIANTUM=y\nCONFIG_DM_CRYPT=y\nCONFIG_CRYPTO_AES_ARM=y\nCONFIG_CRYPTO_CHACHA20_NEON=y\nCONFIG_CRYPTO_NHPOLY1305_NEON=y",
            "D: CONFIG_CRYPTO_ADIANTUM=y\nCONFIG_FS_ENCRYPTION=y\nCONFIG_F2FS_FS_ENCRYPTION=y\nCONFIG_KERNEL_MODE_NEON=y"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "CONFIG_CRYPTO_ADIANTUM"
    },
    {
        "id": "53353b89-1c00-4dcf-9a43-0e55308238d7",
        "source": "windows_security",
        "question": "A company using a Windows Event Collector (WEC) server to centralize security event logging fears that the server might become unresponsive due to a high number of events per second. Which of the following would be the LEAST effective measure to mitigate this concern?",
        "choices": [
            "A: Isolate the EVTX file to its own disk array to improve disk I/O performance.",
            "B: Increase the number of open TCP ports available on the WEC server to allow more simultaneous WEF source connections.",
            "C: Regularly prune the registry to remove inactive WEF client information to manage the registry size.",
            "D: Configure a larger buffer size on the WEF client machines to store more events locally."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "WEC Scalability"
    },
    {
        "id": "b8b3c31e-0618-4697-bc56-7e68eda381ce",
        "source": "windows_security",
        "question": "A company's IT department is configuring their Windows domain controllers to mitigate potential password guessing attacks. They want to ensure that an account is temporarily disabled after several failed logon attempts. Which of the following steps should be taken to achieve this within the Group Policy Management Console?",
        "choices": [
            "A: Configure Account Lockout Policy settings under Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy.",
            "B: Increase the password complexity requirements under Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy.",
            "C: Disable guest accounts under Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options.",
            "D: Enable the firewall on each client machine under Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Group Policy Management Console"
    },
    {
        "id": "6ae2a0a6-d13c-42a8-b0b3-a167974f3fb2",
        "source": "android_sec_doc",
        "question": "As an Android platform security engineer, you are tasked with ensuring that a new system service, which is critical for device functionality, adheres to the SELinux 'neverallow' rules and the correct placement of SEPolicy in Android 8.0+. The service is meant to interact only with other system components and should not require interaction with vendor-specific components or policies. Where should the SEPolicy for this new service be placed?",
        "choices": [
            "A: In `system/sepolicy/private` since it is only needed for the system image and does not interact with vendor components.",
            "B: In `device/manufacturer/device-name/sepolicy` to ensure it is included in the vendor image.",
            "C: In `BOARD_SEPOLICY_DIRS` as it is meant for device augmentation across different device types.",
            "D: In `system/sepolicy/public` to ensure the policy persists across releases and is available for vendor customization."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SEPolicy"
    },
    {
        "id": "97dda1c6-bf6d-4f9f-abae-d11b8e37adf6",
        "source": "owasp_wstg",
        "question": "An Amazon S3 bucket is found to be publicly accessible due to misconfiguration. What are the potential security implications of this misconfiguration?",
        "choices": [
            "A: Publicly accessible S3 buckets may allow unauthorized users to upload or modify files, potentially leading to data tampering or exposure of sensitive information.",
            "B: If an S3 bucket is publicly accessible, it automatically encrypts all stored data, thereby increasing data security.",
            "C: Public accessibility settings of an S3 bucket have no impact on the actual data, as long as the data is encrypted at rest.",
            "D: Making an S3 bucket public restricts access to the bucket to a limited set of IP addresses, enhancing its security posture."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "S3 Bucket Misconfiguration"
    },
    {
        "id": "ef301c49-97ec-4816-b30f-464a3e87359a",
        "source": "android_sec_doc",
        "question": "Consider an Android application that requires strong security services for cryptographic operations. The app leverages Android's Keystore system for hardware-backed key management. Which of the following are advantages and disadvantages of using hardware-backed keys as opposed to software-only key management solutions?",
        "choices": [
            "A: Advantage: Hardware-backed keys can provide a usage control scheme to mitigate the risk of security compromise due to misuse of keys.",
            "B: Disadvantage: Hardware-backed keys prevent key attestation, making it impossible to verify a key's configuration remotely.",
            "C: Advantage: Hardware-backed keys enforce access controls for the lifetime of the key, enhancing security.",
            "D: Disadvantage: Hardware-backed keys are restricted to asymmetric cryptographic operations and do not support symmetric cryptography such as AES and HMAC."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Hardware-backed Keystore"
    },
    {
        "id": "34bae2ef-4df7-4878-9606-8a3312d97177",
        "source": "windows_security",
        "question": "A company is upgrading its systems to Windows 10 and Windows 11. The IT department is tasked with implementing security policies that will help secure the enterprise against malicious software threats. Which of the following policy settings should be considered for detailed explanations, best practices, and security considerations?",
        "choices": [
            "A: Account Policies",
            "B: Security Options",
            "C: Network Configuration Rules",
            "D: Advanced security audit policy settings"
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Policy Settings"
    },
    {
        "id": "5e207899-3d03-432a-9822-2904db3324d0",
        "source": "android_sec_doc",
        "question": "You are developing a secure Android application that requires the generation of an RSA key with a specific set of cryptographic properties for digital signing. Which combination of features and configurations should you request from the Android Keystore to ensure the key meets your application's security requirements?",
        "choices": [
            "A: Generate an RSA key of 2048-bit key size with RSASSA-PKCS1-v1_5 padding mode for signing, and specify a public exponent of F4 (2^16+1).",
            "B: Generate an RSA key of 512-bit key size with RSASSA-PSS padding mode for encryption, and specify a public exponent of F3 (2^15+1).",
            "C: Generate an RSA key of 3072-bit key size with RSAES-PKCS1-v1_5 padding mode for decryption, and enforce an authorization list with `TAG::KEY_SIZE` of 3072.",
            "D: Generate an ECDSA key using the NIST P-256 curve with SHA-256 digest mode for signing, and specify arbitrary public exponents for RSA."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "RSA"
    },
    {
        "id": "9eb647d4-247e-435b-8f39-41fe30d78d92",
        "source": "windows_security",
        "question": "You have been tasked with applying certificate pinning rules to a reference computer in preparation for deploying these settings across your enterprise. After generating the certificate pinning rules in certificate trust list format using the certutil utility, which of the following steps would you correctly perform next?",
        "choices": [
            "A: Execute certutil -setreg chain\\PinRules @pinrules.stl from a non-elevated command prompt to write the binary information into the registry.",
            "B: Apply the certificate pinning rules using certutil -setreg with the 'chain\\PinRules' argument and the '.stl' file name prefixed with the '@' symbol, from an elevated command prompt.",
            "C: Directly edit the registry key 'HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType0\\CertDllCreateCertificateChainEngine\\Config' to manually input the binary data from the '.stl' file.",
            "D: Use the Group Policy Management Console to create a new policy that automatically applies the '.stl' file to the reference computer upon the next restart."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "certutil"
    },
    {
        "id": "bf9a616f-836e-4a1c-a827-cd7f81d3f274",
        "source": "cs161_textbook",
        "question": "Alice and Bob are communicating over an insecure channel using a symmetric-key cryptographic primitive to ensure message integrity and authenticity. Which of the following statements correctly describe the functions and limitations of using Message Authentication Codes (MACs) in their communication?",
        "choices": [
            "A: MACs can prevent an adversary from reading the contents of the message if intercepted.",
            "B: MACs can enable the recipient to detect if a message has been tampered with or spoofed.",
            "C: MACs can provide non-repudiation, ensuring that the sender cannot deny sending the message.",
            "D: MACs require Alice and Bob to share a secret key that is not known to anyone else for verification."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "MACs"
    },
    {
        "id": "85190efa-bf04-4df4-b20a-0e1ee9929c4d",
        "source": "cs161_textbook",
        "question": "If, in an unlikely scenario, the trust anchor (the root server) in a DNSSEC implementation was compromised, what would be the implications for the trust delegation process?",
        "choices": [
            "A: Trust would still be maintained for all name servers endorsed prior to the compromise due to the persistent trust anchor's initial validation.",
            "B: The entire trust delegation process would be undermined, leading to potential trust in malicious name servers.",
            "C: Only the directly connected child name servers to the compromised trust anchor would be affected, while others in the hierarchy would remain secure.",
            "D: The compromised trust anchor would have no real impact on DNSSEC, as the system is designed to handle such events without a loss of trust."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Trust Compromise"
    },
    {
        "id": "d98de15a-d1d8-4637-8a6d-061fe5c52e5b",
        "source": "owasp_mastg",
        "question": "An application security tester is preparing an environment to test the security of a mobile application's network communication. Which of the following commands correctly sets up a host access point for intercepting and analyzing the traffic from the mobile device?",
        "choices": [
            "A: sudo hostapd -start",
            "B: hostapd start",
            "C: sudo systemctl start hostapd",
            "D: $ hostapd hostapd.conf"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "hostapd"
    },
    {
        "id": "c0d9c18d-b4cd-43fb-aba0-f974a6e6e0a3",
        "source": "cs161_textbook",
        "question": "Consider a scenario where you are tasked with reviewing legacy code in a C application to enhance its memory safety. You identify several instances where the code uses unsafe string and memory manipulation functions. Which of the following replacements would generally be considered safer alternatives to reduce the risk of memory safety vulnerabilities?",
        "choices": [
            "A: Replacing `gets()` with `fgets()`.",
            "B: Replacing `strcpy()` with `strncpy()` or `strlcpy()`.",
            "C: Replacing `sprintf()` with `snprintf()`.",
            "D: Replacing `malloc()` with `alloca()`."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity",
            "MemorySafety"
        ],
        "keyword": "memory-safety"
    },
    {
        "id": "0b3c42f1-9658-4e9d-b060-9dd64929deb3",
        "source": "attck",
        "question": "Which of the following actions would LEAST likely suggest that an adversary is actively conducting browser information discovery on a compromised system? (Select TWO.)",
        "choices": [
            "A: Accessing a browser's cache directory to retrieve session cookies.",
            "B: Using a company-approved automated backup tool to back up browser settings.",
            "C: Executing a script to collect URLs from the browser's bookmark file.",
            "D: Running a legitimate antivirus scan that checks browser extensions for malware."
        ],
        "answer": "BD",
        "topics": [
            "PenTest",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Adversary Behavior"
    },
    {
        "id": "bbe80472-9565-4a25-9717-49aaf950e469",
        "source": "cwe",
        "question": "A web application has a functionality that allows users to upload pictures. The current implementation directly stores the uploaded files in a public directory, using the original filenames provided by users. Which of the following practices would NOT contribute to securing the file upload process?",
        "choices": [
            "A: Implementing server-side validation checks that are also performed on the client side.",
            "B: Limiting the uploaded file extensions to a predefined list of safe extensions like .jpg and .png.",
            "C: Storing uploaded files in a directory that is not accessible directly via URL, and serving them through a separate script or process.",
            "D: Using only client-side JavaScript to check the file extension and size before allowing the upload to proceed."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "UploadMitigation"
    },
    {
        "id": "ae760551-460b-48e8-99f9-a230fd91c97d",
        "source": "owasp_mastg",
        "question": "You are developing a mobile application that requires enhanced security for user accounts. To implement Two-Factor Authentication (2FA), you evaluate different second factors. Which of the following options are considered secure practices for 2FA?",
        "choices": [
            "A: Use a one-time password sent via SMS, with the message including instructions for users who did not request the code.",
            "B: Allow the second factor to be enforced and verified on the client-side to streamline the process.",
            "C: Implement your own custom 2FA mechanism to avoid third-party library dependencies.",
            "D: Send a push notification to a registered application using the OS notification feature for transmitting OTPs."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Two-Factor Authentication"
    },
    {
        "id": "69244e51-b228-44a0-a38d-80574749a55f",
        "source": "cs161_textbook",
        "question": "In a situation where Alice's secret key is compromised, which of the following outcomes is a direct consequence concerning the transactions she can send to Bob?",
        "choices": [
            "A: Bob can no longer verify transactions coming from Alice using her public key.",
            "B: The Bitcoin network automatically detects and blocks transactions from Alice's compromised key.",
            "C: An attacker can impersonate Alice and send transactions to any recipient, but these transactions can be identified as fraudulent by the network.",
            "D: An attacker can impersonate Alice to send unauthorized transactions, which will appear legitimate to the network and recipients."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CompromisedKey"
    },
    {
        "id": "60e863e5-047e-4699-80d0-82894ed6671d",
        "source": "apple_platform_security",
        "question": "Under which conditions will an Apple Watch NOT successfully unlock a paired iPhone using the Auto Unlock feature, assuming the feature is enabled?",
        "choices": [
            "A: The Apple Watch is currently in Bedtime mode.",
            "B: The iPhone was last unlocked with Face ID more than 6.5 hours ago.",
            "C: The distance measured between the Apple Watch and the iPhone is 4 meters.",
            "D: There is a failure in the BLE connection between the Apple Watch and the iPhone during the unlock attempt."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AutoUnlockConditions"
    },
    {
        "id": "045340b0-9126-4d69-a0b4-0e902a008fca",
        "source": "apple_platform_security",
        "question": "An iOS user has recently upgraded their device and wants to ensure that their sensitive data remains secure during various operations. Based on your understanding of iOS security features, which of the following statements are correct regarding the security mechanisms employed during backups, syncing, and software updates?",
        "choices": [
            "A: The user's keychain is protected by the device keybag, which uses the user's passcode for encryption and is shared with the backup keybag when performing encrypted backups using Finder or iTunes.",
            "B: During an over-the-air software update, a single-use unlock token is generated and protected by a Secure Enclave controlled anti-replay nonce, which does not rely on counters or Effaceable Storage on A9 and later SoCs.",
            "C: The escrow keybag is used to improve the user experience during device syncing with the Finder or iTunes by storing class keys protected by a newly generated key, which is split between the device and the host or server.",
            "D: iCloud Backup keybag uses symmetric key cryptography with class keys that remain the same during each backup, ensuring consistency and compatibility across different devices."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "iOS_Security"
    },
    {
        "id": "d65560dc-7de2-4c8c-8b65-f61192abf7f3",
        "source": "cs161_textbook",
        "question": "A web service is experiencing an increase in online guessing attacks. The security team is evaluating different mitigation strategies to protect user accounts. Which of the following strategies could potentially mitigate the impact of these attacks, considering their advantages and disadvantages as described in the study?",
        "choices": [
            "A: Implementing rate-limiting by allowing only a certain number of incorrect guesses per hour, reducing susceptibility to targeted attacks.",
            "B: Requiring CAPTCHAs after a failed login attempt to increase the difficulty of automated attacks.",
            "C: Enforcing stringent password requirements to ensure all users have complex passwords.",
            "D: Introducing a password meter during account creation to nudge users towards stronger passwords."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Mitigations"
    },
    {
        "id": "4feed59c-787b-4ed0-9a2c-12df574b42cf",
        "source": "owasp_mastg",
        "question": "In the context of Android mobile application development, which of the following statements accurately reflects the impact of a security measure on the application’s robustness?",
        "choices": [
            "A: Implementing SSL/TLS encryption for data in transit ensures that data cannot be intercepted or tampered with, thereby securing the application's data.",
            "B: Enabling debug mode in the production release can provide real-time error reporting, enhancing the application’s reliability.",
            "C: Allowing the application to execute code from external sources can increase flexibility and functionality.",
            "D: Using unencrypted HTTP connections for sensitive data transactions can increase application performance."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "SSL/TLS Encryption"
    },
    {
        "id": "e564c8a7-9003-4376-8423-c4130ac21841",
        "source": "apple_platform_security",
        "question": "Which of the following statements correctly describe the security roles or implications of keybags when performing backups, syncing, or updating iOS and related devices?",
        "choices": [
            "A: The escrow keybag enables an MDM solution to remotely clear a user’s passcode and facilitates syncing with the Finder or iTunes without requiring the user to enter a passcode each time.",
            "B: The backup keybag is protected with a password that undergoes 10 million iterations of PBKDF2, which makes it immune to brute-force attacks parallelised across multiple computers.",
            "C: During an OTA software update, the Secure Enclave generates a single-use unlock token that expires after 8 hours to ensure that the user keybag is only accessible during the update process.",
            "D: iCloud Backup keybag uses asymmetric class keys, which means all backed-up data, regardless of their original Data Protection class, are re-encrypted with these asymmetric keys."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Keybags"
    },
    {
        "id": "2d36466f-9d0a-4fed-8e8e-b2d14db3b473",
        "source": "owasp_wstg",
        "question": "A web application implements a multi-layered authentication system including a lock-out mechanism after several failed login attempts, a password strength policy, and a two-factor authentication process. You are conducting a security audit for this application. Which two of the following testing strategies would be most effective in evaluating the robustness of the application's authentication system?",
        "choices": [
            "A: Testing for weak password policy to ensure that the system enforces complex and strong password requirements.",
            "B: Assessing the implementation of the lock-out mechanism to verify it cannot be easily bypassed or does not lock out users prematurely.",
            "C: Evaluating the two-factor authentication process to confirm that it does not add any substantial security and can be omitted.",
            "D: Checking for session management weaknesses to ensure that authenticated sessions are securely handled and not susceptible to hijacking."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Authentication Testing"
    },
    {
        "id": "de287452-77c7-4e1e-89c8-738043577801",
        "source": "cwe",
        "question": "Given the scenario where a PHP developer mistakenly included database credentials in an 'include' file as 'database.inc' and used it within a 'login.php' file, which of the following actions would best mitigate the risk of sensitive information exposure?",
        "choices": [
            "A: Rename 'database.inc' to 'database.inc.php' to ensure that the server pre-processes the file before sending it to the client.",
            "B: Use .htaccess or equivalent configuration to deny direct access to 'database.inc' from the web.",
            "C: Store the credentials as environment variables and access them within the scripts.",
            "D: Comment out the credentials in 'database.inc' and include a note to move them to a secure location later."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SensitiveInfoInCode"
    },
    {
        "id": "3f435b2b-e7b8-48f8-a456-e4b4b5edd28b",
        "source": "owasp_wstg",
        "question": "Which of the following security vulnerabilities is the Zed Attack Proxy (ZAP) NOT primarily designed to test?",
        "choices": [
            "A: Stored Cross Site Scripting (XSS)",
            "B: SQL Injection",
            "C: Cross-Site Request Forgery (CSRF)",
            "D: Insecure Direct Object References (IDOR)"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Zed Attack Proxy (ZAP)"
    },
    {
        "id": "593d442c-418e-4bbc-b3ca-77c38b6198f9",
        "source": "attck",
        "question": "A cybersecurity analyst is tasked with enhancing the security posture of a company to defend against threats where adversaries rely on user execution to gain access to systems. Which combination of mitigations and detection strategies should be implemented to reduce the risk of successful user execution attacks?",
        "choices": [
            "A: Enable Attack Surface Reduction rules to prevent executable files from running without meeting certain criteria, and monitor for unexpected third-party application logging that may indicate user-initiated execution.",
            "B: Allow all executable files to run as long as they originate from email attachments, and only monitor command execution for applications known to be used by the IT department.",
            "C: Disable all remote access software to prevent direct control of the system by adversaries, and only monitor container creation as a form of user execution.",
            "D: Restrict web-based content by blocking unknown file types and monitor for unusual network connections initiated by processes that do not normally do so."
        ],
        "answer": "AD",
        "topics": [
            "PenTest"
        ],
        "keyword": "User Execution"
    },
    {
        "id": "11bf0538-fc05-4a95-be4e-53b72fcb78c6",
        "source": "cwe",
        "question": "Review the following pseudocode for a user authentication system and identify the choice(s) that indicate a violation of the 'Economy of Mechanism' principle:\n\nPseudocode:\nfunction authenticateUser(credentials) {\n // Step 1: Perform complex validation of credentials format\n // Step 2: Use a custom hashing algorithm to obscure credentials\n // Step 3: Compare hashed credentials against a list of hashes stored in multiple distributed databases\n // Step 4: Implement a series of non-standard security checks before granting access\n}",
        "choices": [
            "A: Step 1 demonstrates an adherence to the principle of 'Economy of Mechanism' by ensuring that credentials follow a specific format.",
            "B: Step 2 violates the principle by using a custom, potentially obscure hashing algorithm instead of a well-known and tested one.",
            "C: Step 3 is in line with the principle since it uses multiple databases to enhance security through redundancy.",
            "D: Step 4's use of non-standard security checks introduces unnecessary complexity, which could lead to misunderstandings and vulnerabilities."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityMechanism"
    },
    {
        "id": "9748edda-3056-40f2-a5e4-bc9df7ea0909",
        "source": "attck",
        "question": "An adversary is attempting to gain access to restricted information within an organization's network. They have identified several password storage locations on various systems. Which of the following techniques could the adversary use to access these credentials and potentially perform lateral movement?",
        "choices": [
            "A: Exploiting a vulnerability in the organization's WAF (Web Application Firewall) to gain access to the passwords.",
            "B: Using credential dumping tools such as Mimikatz to obtain account and password information from systems and resources.",
            "C: Performing a DDoS (Distributed Denial of Service) attack to overwhelm the system and reveal stored credentials.",
            "D: Phishing employees to install a keylogger that will capture keystrokes and send credentials directly to the adversary."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Credential Dumping"
    },
    {
        "id": "b3d0e8db-b36f-43f4-bc0f-cdb1b97b5588",
        "source": "apple_platform_security",
        "question": "A user has downloaded a custom shortcut and a JavaScript snippet from the internet to use with Safari on their Apple device. Select the security measures that the Shortcuts app and Safari will apply the first time the user attempts to run these downloads.",
        "choices": [
            "A: The Shortcuts app will sync the downloaded custom shortcut across the user's Apple devices using iCloud.",
            "B: Safari will prompt the user to allow shortcuts containing JavaScript to run on the current web page for the domain the first time it is invoked.",
            "C: The Shortcuts app will use updated malware definitions to identify malicious shortcuts at runtime.",
            "D: The Shortcuts app will require the user to rewrite the shortcut in a sandboxed environment before allowing it to run."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "ShortcutsAppSecurity"
    },
    {
        "id": "30d3fe13-548c-4432-baa5-574580a57afe",
        "source": "mit6.858",
        "question": "If a malicious app defines a widely-used but potentially dangerous permission name with 'normal' level before any legitimate app does, which of the following could be potential consequences? Choose the correct outcomes based on the Android permission system:",
        "choices": [
            "A: The malicious app's definition of the permission takes precedence, and any subsequent app requesting this permission will be granted it without alerting the user, due to the 'normal' level assigned.",
            "B: All apps that define the permission after the malicious app will have the 'dangerous' level ignored, as the permission level has already been set by the first registration.",
            "C: The malicious app would be prevented from defining an existing dangerous permission as 'normal' due to built-in protection mechanisms in the Android operating system.",
            "D: Legitimate apps will prompt the user for approval despite the permission being registered as 'normal', because the system recognizes the permission's inherent risks."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "PermissionConflict"
    },
    {
        "id": "3ac37ab1-c53a-459c-ae80-a685fbd4fd84",
        "source": "apple_platform_security",
        "question": "Select the correct statements regarding the security features of Apple IDs and Managed Apple IDs.",
        "choices": [
            "A: Apple employs active fraud monitoring and regular policy reviews to adapt to new security information that could affect user security.",
            "B: Managed Apple IDs can be inspected by any member of the organization without any hierarchical restrictions.",
            "C: Two-factor authentication is a mandatory security measure for all Apple IDs.",
            "D: For Managed Apple IDs, services such as Apple Pay and Find My are disabled."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AppleIDSecurity"
    },
    {
        "id": "7eea03ea-9ef9-45c1-991a-a2a0c1ecf698",
        "source": "cs161_textbook",
        "question": "Considering the prevention of eavesdropping during user authentication, which of the following statements are true regarding the use of SSL/TLS over HTTPS compared to a hypothetical browser-based challenge-response protocol using JavaScript for password handling?",
        "choices": [
            "A: SSL/TLS encrypts the entire communication channel, thereby offering broader security beyond just the password.",
            "B: A browser-based challenge-response protocol would prevent the password from being sent over the network, which is not always true for SSL/TLS.",
            "C: The browser-based protocol may not be as widely supported or standardized as SSL/TLS, leading to potential compatibility issues.",
            "D: SSL/TLS is less secure than the browser-based protocol because it only encrypts the password, not the entire session."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "eavesdropping"
    },
    {
        "id": "d14b8a9b-0086-47f2-8b6d-104be4ea9f8b",
        "source": "windows_security",
        "question": "An IT professional is configuring security policies on a Windows-based system. They need to apply best practices for the Optional subsystems security policy setting. Which of the following actions should the professional take to adhere to best practices for system security?",
        "choices": [
            "A: Enable all optional subsystems to ensure maximum compatibility with various software.",
            "B: Restrict the use of optional subsystems to only those that are necessary for business operations.",
            "C: Configure the system to prompt the user for permission before loading any optional subsystem.",
            "D: Disable the security policy settings to allow the operating system to manage optional subsystems automatically."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Optional subsystems security policy"
    },
    {
        "id": "e7a1e2e3-fc3e-4b9c-aefb-50dba93f4af5",
        "source": "owasp_wstg",
        "question": "A penetration tester is assessing a web application for security vulnerabilities and discovers that certain user input is being directly reflected in the server's HTTP response without proper validation or encoding. While testing various vectors for reflected Cross-site Scripting (XSS) attacks, the tester decides to use different character encodings to bypass potential input filters. Which of the following actions is most likely to succeed in executing a reflected XSS attack if the web application is improperly handling character encoding?",
        "choices": [
            "A: Injecting a script tag with a straightforward payload such as `<script>alert('XSS')</script>` into the input.",
            "B: Encoding the script tag using hexadecimal encoding, such as `%3Cscript%3Ealert('XSS')%3C%2Fscript%3E`, before injecting it.",
            "C: Avoiding script tags entirely and only using plain text to test the input validation process.",
            "D: Uploading a .js file containing the payload to the server and linking to it from the input."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Reflected Cross-site Scripting (XSS)"
    },
    {
        "id": "a1a3d520-8217-43af-adf6-a67c97ff04c2",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating an incident where an organization's files have been encrypted and a ransom demand has been issued. The malware used in the attack exhibited worm-like characteristics, propagating across the network and encrypting user files such as documents, images, and source code. Which of the following attack techniques did the malware most likely leverage to maximize its impact on the organization?",
        "choices": [
            "A: Leveraging Valid Accounts and SMB/Windows Admin Shares for propagation.",
            "B: Exploiting unpatched vulnerabilities in email server software.",
            "C: Injecting malicious code into the organization's public website.",
            "D: Conducting a Distributed Denial of Service (DDoS) attack to overwhelm network resources."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "ransomware"
    },
    {
        "id": "9781f102-ee11-40ee-9b3f-3428228a5f39",
        "source": "attck",
        "question": "In an effort to detect attempts at data exfiltration via physical media, such as USB drives, which of the following detection methods would likely be least effective?",
        "choices": [
            "A: Monitoring for the execution of commands associated with data transfer to removable drives.",
            "B: Keeping an audit log of drive letter assignments or mount points to removable storage devices.",
            "C: Setting up alerts for email attachments sent from company accounts after hours.",
            "D: Tracking file access patterns on removable media to identify unusual data retrieval or copying activities."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Detection Methods"
    },
    {
        "id": "96a723be-c611-4964-831d-16fad95d8d13",
        "source": "owasp_wstg",
        "question": "In reviewing source code, you identify a function that retrieves and displays image metadata in a web gallery application. Based on best practices for preventing incubated cross-site scripting (XSS) attacks, which aspect of the function would you scrutinize to reduce the risk of such an attack being successful?",
        "choices": [
            "A: The function's data validation routines when processing uploaded image metadata.",
            "B: The amount of metadata displayed to ensure it does not overwhelm the user interface.",
            "C: The efficiency of the algorithm used to retrieve metadata from the database.",
            "D: The protocol used for transferring image data between the server and client."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "cross-site scripting (XSS)"
    },
    {
        "id": "96c3a6ad-dd1f-4d27-80ac-f20068c875c7",
        "source": "owasp_wstg",
        "question": "An organization is considering the implementation of a `security.txt` file and a `humans.txt` file within their website's `.well-known` directory. Evaluate the benefits and drawbacks of this decision by selecting the most accurate statements:",
        "choices": [
            "A: The `security.txt` file enhances the security of the website by providing encryption details that safeguard the website's data.",
            "B: The `humans.txt` file increases transparency by acknowledging individual contributors, but may inadvertently expose team structure to potential attackers.",
            "C: Implementing a `security.txt` file may facilitate communication with security researchers, but could also lead to an increased risk of targeted attacks if sensitive contact details are exposed.",
            "D: The `humans.txt` file serves as an encrypted channel for secure communication between the website's users and its administrators."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "security.txt"
    },
    {
        "id": "d72fcae9-edf0-4833-8ca0-9dc9d7408a96",
        "source": "mozilla_security",
        "question": "A web developer is preparing to deploy a new e-commerce platform. To ensure the security and integrity of the website, what must the developer verify regarding the resource loading prior to deployment?",
        "choices": [
            "A: All resources, including JavaScript and images, must be loaded insecurely to ensure compatibility with all browsers.",
            "B: Only JavaScript resources have to be loaded over secure channels, while images can be loaded insecurely without any impact.",
            "C: All resources, whether on the same origin or not, should be loaded over secure channels to avoid browser blocks and degraded user experience.",
            "D: Resources should be loaded over secure channels, but it is acceptable to load JavaScript insecurely if the website is already using HTTPS."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "mixed content"
    },
    {
        "id": "067c49dc-94bf-4c8c-9b4d-5e42cac621b0",
        "source": "owasp_mastg",
        "question": "An iOS mobile application developer is advised to adopt a layered security approach to protect sensitive operations within the app. Which of the following scenarios would NOT be improved by following this advice?",
        "choices": [
            "A: Storing user authentication tokens in the iOS keychain to avoid plain text storage.",
            "B: Hardcoding encryption keys within the app's source code to simplify the encryption process.",
            "C: Utilizing Touch ID or Face ID for biometric authentication to enhance user access control.",
            "D: Implementing certificate pinning to prevent man-in-the-middle (MITM) attacks over network connections."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Layered Security"
    },
    {
        "id": "e8e9aaac-c612-461f-a253-053144455c95",
        "source": "mozilla_security",
        "question": "Why is it recommended to avoid redirection from HTTP to HTTPS on a different host as the initial step?",
        "choices": [
            "A: It increases the complexity of the website's URL structure and can confuse users.",
            "B: It can introduce significant performance issues due to the increased number of handshakes required.",
            "C: It prevents the proper setting of HTTP Strict Transport Security (HSTS) which is crucial for web security.",
            "D: It is generally more expensive because it involves more DNS lookups and server resources."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HSTS"
    },
    {
        "id": "1ed36536-5865-4414-8a42-69d6a22ba7de",
        "source": "attck",
        "question": "In the context of maintaining reliable command and control communications, which technique would an advanced persistent threat (APT) group LEAST likely use to ensure continuity in the event that their primary communication channel is compromised?",
        "choices": [
            "A: Switching to secondary command and control servers.",
            "B: Using a different network protocol for communication.",
            "C: Utilizing a hard-coded list of backup domains for command and control.",
            "D: Isolating the infected hosts from the network to prevent fallback to alternate channels."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command and Control Continuity"
    },
    {
        "id": "4d42f1c3-b756-49b0-9ce3-d84fe5c613c2",
        "source": "mit6.858",
        "question": "A developer is creating an Android application that needs to change the device's wallpaper and access the user's contact information. Considering Android's permissions model, select the permission types that the developer must declare in the application's manifest to accomplish these tasks.",
        "choices": [
            "A: Normal permission for changing the wallpaper",
            "B: Dangerous permission for changing the wallpaper",
            "C: Normal permission for accessing contact information",
            "D: Dangerous permission for accessing contact information"
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Android Permissions"
    },
    {
        "id": "e82f3efd-9d1b-4ba6-8b38-fb479c19ef3e",
        "source": "cwe",
        "question": "When implementing a security control to prevent path traversal vulnerabilities, what is the primary disadvantage of only checking for '../' at the beginning of user input compared to other more comprehensive methods?",
        "choices": [
            "A: It is computationally more expensive and can lead to performance issues.",
            "B: It fails to account for encoded variations of path traversal sequences that could be used in an attack.",
            "C: It does not prevent path traversal sequences that appear in the middle or end of the user input.",
            "D: It may cause false positives by blocking legitimate user requests that incidentally contain '../'."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityControl"
    },
    {
        "id": "060a9000-19b0-4b20-b4a5-b8b092339b09",
        "source": "attck",
        "question": "While reflective code loading allows adversaries to execute payloads within the memory of a legitimate process, potentially evading file-based detection mechanisms, what is a potential drawback of this technique that a well-configured defensive system might exploit to identify malicious activity?",
        "choices": [
            "A: The inability to execute payloads in the memory of systems with robust network security measures.",
            "B: The execution of arbitrary code may still be detected by monitoring for abnormal process behavior or API usage.",
            "C: Reflective loading exclusively targets Linux platforms, making it ineffective against Windows or macOS systems.",
            "D: The technique can be easily thwarted by regularly updating the operating system and software applications."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Process Monitoring"
    },
    {
        "id": "4a27ae02-21a0-4fc2-83e6-8fc85ad9f567",
        "source": "cwe",
        "question": "A software development team is working on a web application that allows administrators to execute system commands for maintenance purposes. The application is written in Java and runs with elevated privileges. The team wants to ensure that the application is not vulnerable to an untrusted search path attack. Which of the following strategies should the team implement to mitigate this risk?",
        "choices": [
            "A: Use a centralized, easily-modifiable location within the source code for fully-qualified pathnames to external programs.",
            "B: Allow users to specify search paths in a web form that the application will use to locate external programs.",
            "C: Set the PATH environment variable to include directories writable by users to ensure ease of access to common utilities.",
            "D: Remove or restrict all environment settings that could influence the search path before invoking external programs."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "UntrustedSearchPath"
    },
    {
        "id": "480ab3ac-ad12-47bc-bbdf-cb6a125204cd",
        "source": "windows_security",
        "question": "An administrator wants to ensure that the Memory Integrity feature in Windows 10 is managed centrally and not by individual users. To achieve this, the administrator decides to edit the system registry. Which of the following commands should the administrator execute to gray out the memory integrity UI and display the message 'This setting is managed by your administrator'?",
        "choices": [
            "A: reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity /v \"Locked\" /t REG_DWORD /d 1 /f",
            "B: reg delete HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity /v \"WasEnabledBy\" /f",
            "C: reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard /v \"EnableVirtualizationBasedSecurity\" /t REG_DWORD /d 1 /f",
            "D: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\" /v \"Unlocked\" /t REG_DWORD /d 1 /f"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "HypervisorEnforcedCodeIntegrity"
    },
    {
        "id": "5241e793-69ec-40aa-9dfe-b36886fbe247",
        "source": "cs161_textbook",
        "question": "In a scenario where an organization needs to optimize the encryption and decryption processes to handle a high volume of data in a parallel computing environment, which of the following statements correctly reflect the capabilities of CBC mode and CTR mode regarding parallelization?",
        "choices": [
            "A: CBC mode supports parallel encryption but requires sequential decryption.",
            "B: CTR mode supports parallel decryption but requires sequential encryption.",
            "C: CBC mode does not support parallel encryption but allows for parallel decryption.",
            "D: CTR mode allows for both parallel encryption and parallel decryption."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Parallelization"
    },
    {
        "id": "0706a389-ac25-4cf2-9445-f970851e36d2",
        "source": "cwe",
        "question": "Consider a scenario where a company is developing a new System-on-Chip (SoC) with a Root-of-Trust (RoT) implemented in ROM for secure booting. As an architect, you are tasked with proposing design strategies to mitigate the risk of immutable ROM code that could contain vulnerabilities. Which of the following strategies would be effective in addressing the risk associated with the inability to patch ROM code?",
        "choices": [
            "A: Incorporate secure patch support to allow ROM code to be patched on the next boot, understanding that certain hardware initialization aspects will remain unpatchable.",
            "B: Enable runtime patching capabilities by storing patch code in volatile memory, which can be updated continuously to respond to new vulnerabilities.",
            "C: Design the SoC to support hardware fuses, allowing for limited in-field or manufacturing patching of ROM code for the next batch of devices.",
            "D: Implement a dual-ROM system where one ROM is used for booting while the other contains updatable firmware that can override the first ROM's code."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ROM-Patching"
    },
    {
        "id": "286852f8-7a49-4525-988b-8f3ff35dec37",
        "source": "attck",
        "question": "As an administrator, you are tasked with ensuring the security of embedded network devices against adversaries who might attempt to weaken defenses by modifying the operating system image. Which of the following measures would be effective in preventing or detecting such unauthorized modifications? (Select TWO)",
        "choices": [
            "A: Implement boot integrity with cryptographic signing to ensure the integrity of the operating system images.",
            "B: Decrease the complexity of password policies to reduce the potential attack surface for password cracking.",
            "C: Regularly update the network device's firmware to the latest version available from the vendor.",
            "D: Use multi-factor authentication for user and privileged accounts."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "boot integrity"
    },
    {
        "id": "996c2ee3-5c38-47c8-aeb1-2d88c5a35884",
        "source": "cwe",
        "question": "Consider a web application that uses dynamic variable access based on user input to display personalized content. Which of the following practices would MOST effectively prevent unintended variable manipulation and ensure secure handling of dynamically-identified variables?",
        "choices": [
            "A: Restrict user input to a predefined list of allowed variable names using input validation techniques.",
            "B: Encrypt all user input before using it to dynamically identify variables.",
            "C: Allow dynamic variable identification only for variables that have been declared within the last 5 minutes.",
            "D: Refactor the code to utilize direct references to variables rather than dynamic identification."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "DynamicVariableControl"
    },
    {
        "id": "3e053bda-2526-404d-8ca5-a0865fb4d085",
        "source": "owasp_wstg",
        "question": "What inherent characteristics of XPath, compared to SQL, can make XPath injection attacks more versatile and potentially more dangerous?",
        "choices": [
            "A: XPath does not require a semicolon to terminate queries, making it less strict and easier to manipulate.",
            "B: XPath has more powerful functions within its specifications, unlike SQL which relies on the dialect used by the target database.",
            "C: XPath is case-sensitive, providing attackers with more ways to bypass authentication mechanisms.",
            "D: XPath queries are shorter in length, making them easier to inject without detection."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "XPath vs SQL"
    },
    {
        "id": "4e8194d1-cfd0-406e-8f86-c5dff33cfe55",
        "source": "attck",
        "question": "A penetration tester is evaluating the security of a corporation's internal network. They are specifically looking for methods through which an adversary could leverage peripheral devices or misuse applications to capture sensitive audio conversations. Which of the following could be indicative of such behavior?",
        "choices": [
            "A: Use of SOUNDWAVE utility by APT37 to capture microphone input.",
            "B: Modification of BIOS settings to enable boot from external devices.",
            "C: Execution of an application employing 'Get-MicrophoneAudio' module by PowerSploit.",
            "D: Deployment of a keyboard layout manager for custom hotkey configurations."
        ],
        "answer": "AC",
        "topics": [
            "PenTest",
            "ApplicationSecurity"
        ],
        "keyword": "Audio Capture"
    },
    {
        "id": "2da0f6cc-903a-4a12-bbef-ff1c8fb4cc0c",
        "source": "apple_platform_security",
        "question": "What are the security mechanisms implemented for the transmission of identity data in Apple Wallet, and what potential weakness does each mechanism address?",
        "choices": [
            "A: Identity data integrity and anti-forgery prevent tampering and ensure that only requested data elements are shared.",
            "B: Device binding safeguards against the cloning of a user's ID by storing the private key in the device's Secure Element.",
            "C: Informed consent requires users to manually input a passcode for each transaction to confirm their intention.",
            "D: User data confidentiality over radio links encrypts the session data to protect personal information during transmission."
        ],
        "answer": "ABD",
        "topics": [
            "NetworkSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Transmission"
    },
    {
        "id": "c0234be8-e9ae-410c-a59a-6085436e74c9",
        "source": "apple_platform_security",
        "question": "An organization is implementing a secure Bluetooth communication system between various Apple devices. As a cybersecurity specialist, you are asked to ensure that the security features align with the devices' capabilities. Select the security features that are correctly matched with the respective Bluetooth technologies used by Apple devices:",
        "choices": [
            "A: Bluetooth Classic uses AES-CMAC for pairing and HMAC-SHA256 for message integrity.",
            "B: Bluetooth Low Energy (BLE) stores pairing information in a secure location on iOS, iPadOS, macOS, tvOS, and watchOS devices.",
            "C: The Secure Connections feature was added to Bluetooth Low Energy (BLE) for protection against man-in-the-middle attacks in version 4.1.",
            "D: Both Bluetooth Classic and BLE use AES-CCM cryptography for encryption and message integrity."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Bluetooth"
    },
    {
        "id": "0a548965-03b2-4f2b-9a05-ee7b106268a9",
        "source": "windows_security",
        "question": "An IT department is reviewing their organization's Windows security policies. They are considering whether to enable or disable the 'Switch to the secure desktop when prompting for elevation' setting as part of their User Account Control (UAC) configuration. Which of the following statements best reflects a security advantage of enabling this setting?",
        "choices": [
            "A: Enabling this setting will improve user experience by allowing them to view and interact with the elevation prompt within their usual working environment.",
            "B: Enabling this setting will allow administrators to remotely interact with elevation prompts, thereby facilitating remote support.",
            "C: Disabling this setting will reduce the system's performance overhead by not switching to a separate desktop environment for elevation prompts.",
            "D: Enabling this setting will isolate the elevation prompt to prevent interference from potentially malicious software."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Secure Desktop"
    },
    {
        "id": "7a05e606-5ee6-41f4-aace-8464fdfc9f3c",
        "source": "owasp_wstg",
        "question": "You are conducting a web application security assessment and you suspect there are hidden applications on the target web server. Which of the following approaches could help you uncover these hidden applications? Select two.",
        "choices": [
            "A: Using a vulnerability scanner to probe for common administrative interface paths like /admin or /manage.",
            "B: Analyzing the robots.txt file to find disallowed entries that might reveal hidden directories.",
            "C: Executing a denial-of-service attack to trigger error messages that may disclose hidden application paths.",
            "D: Performing a full 64k TCP port address space scan to identify web services running on non-standard ports."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Web Application Discovery"
    },
    {
        "id": "a4ee6e19-9d98-48e4-a8dc-89dd4266da8d",
        "source": "windows_security",
        "question": "An IT administrator is assessing whether to enable Kernel DMA Protection on company devices. Which of the following statements would serve as the strongest argument against enabling Kernel DMA Protection?",
        "choices": [
            "A: Kernel DMA Protection does not require Virtualization-based Security (VBS), simplifying deployment.",
            "B: Graphics devices with WDDM 3.0 driver model are supported by Kernel DMA Protection in Windows 11.",
            "C: Peripherals with DMA Remapping-incompatible drivers are blocked from starting until an authorized user logs in.",
            "D: Kernel DMA Protection is not effective against DMA attacks through 1394/FireWire, and other older interfaces."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "DMA Remapping"
    },
    {
        "id": "3dad8437-fb58-4b65-9057-21d905c1898e",
        "source": "cs161_textbook",
        "question": "An architect proposes that for a new secure messaging platform, the TCB should include not just the messaging protocol and cryptographic components but also the user interface (UI) to ensure consistency and user experience. Which of the following is the best counterargument to including the UI in the TCB?",
        "choices": [
            "A: Including the UI in the TCB increases complexity and contradicts the principle of keeping the TCB small and verifiable.",
            "B: The UI should be included in the TCB because it enhances the security of the messaging protocol.",
            "C: A smaller TCB would make the system less secure, as more components would be unprotected.",
            "D: The UI is critical for user experience and should be prioritized over security considerations."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "TCB_Principles"
    },
    {
        "id": "dfc7546b-9114-4a92-9b83-128b238161b8",
        "source": "windows_security",
        "question": "In a Windows security context, what are the possible implications of a monitored security event pattern occurring?",
        "choices": [
            "A: It indicates a potential security breach that requires immediate investigation.",
            "B: It signifies that normal maintenance tasks are being performed by the system administrator.",
            "C: It is an indication of a scheduled system backup being initiated.",
            "D: It could be a sign of a false positive that needs to be checked for system efficiency."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Event Pattern"
    },
    {
        "id": "36400ca6-65eb-4dc6-acc4-3c44864261de",
        "source": "apple_platform_security",
        "question": "Which of the following features contribute to the security and usability of password and credential management on Apple devices? Select all that apply.",
        "choices": [
            "A: iCloud Keychain syncs passwords across devices without exposing them to Apple by encrypting the contents so only the user's devices can decrypt them.",
            "B: Credential provider extensions can provide metadata about saved credentials for autofill suggestions, but they do not include passwords in the metadata.",
            "C: The kSecAttrSynchronizable attribute is automatically assigned to all keychain items, including third-party app data, to facilitate syncing across devices.",
            "D: iCloud Keychain enables users to recover their passwords even if their device is lost, without compromising the security of the password data."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Credential Management"
    },
    {
        "id": "021e7297-a382-4359-888e-e3d23dd010aa",
        "source": "cs161_textbook",
        "question": "In an attempt to mitigate DHCP spoofing attacks, a network administrator is considering various configurations. Which of the following configurations could potentially strengthen the network's resistance to such attacks?",
        "choices": [
            "A: Implementing DHCP snooping on switches to filter out untrusted DHCP messages.",
            "B: Decreasing the DHCP lease time to force more frequent renewals of client configurations.",
            "C: Disabling DHCP entirely and using static IP address assignments for all devices.",
            "D: Configuring all client machines to accept DHCP offers based on the fastest response time."
        ],
        "answer": "",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "41aadf67-8972-4c80-9f45-7dca303143c2",
        "source": "cs161_textbook",
        "question": "In the context of polymorphic malware, why might an attacker opt to use a weaker encryption algorithm like ECB instead of a more secure option?",
        "choices": [
            "A: Weaker encryption algorithms are less resource-intensive, allowing the malware to spread more quickly.",
            "B: The primary goal of the attacker is to obfuscate the malware to avoid detection, not to ensure confidentiality.",
            "C: Strong encryption algorithms can be easily reverse-engineered, revealing the malware's signature.",
            "D: Strong encryption algorithms make it more difficult for the malware to execute its payload."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "f0cf2363-137c-46cf-9736-6bca83f5dccd",
        "source": "apple_platform_security",
        "question": "An individual has just purchased an Apple Watch and is curious about the security features that protect their device and data. Which of the following security features of the Apple Watch are designed to protect the device's integrity, secure its communications, and provide convenience through automated unlocking mechanisms?",
        "choices": [
            "A: The watch performs secure boot and maintains operating system integrity to prevent unauthorized firmware/software modifications.",
            "B: Apple Watch uses an animated pattern for secure pairing with iPhone, which contains an encoded secret for Bluetooth Low Energy (BLE) out-of-band pairing.",
            "C: Auto Unlock allows an iPhone to be unlocked by an Apple Watch when a user's nose and mouth are covered, using a mutually authenticated Station-to-Station (STS) protocol.",
            "D: The watch encrypts its communications using an outdated Bluetooth encryption method that does not support AES-256-GCM or ChaCha20-Poly1305 (256-bit keys)."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "watchOS"
    },
    {
        "id": "41a66ec2-7e5f-4ca6-be52-c814b8579ac2",
        "source": "cs161_textbook",
        "question": "A network administrator is considering the implications of the OSI model's layering for managing a large network. Which statements accurately reflect the consequences of this layered structure on network management?",
        "choices": [
            "A: Layering restricts a network administrator from monitoring network traffic at different levels of abstraction.",
            "B: The independence of layers permits the administrator to implement security measures such as firewalls and intrusion detection systems at appropriate layers.",
            "C: Network management is complicated by the layered structure as it requires administrators to have expertise in only one specific layer.",
            "D: The abstraction between layers aids in network scalability, as expanding the network does not require reconfiguration of existing protocols."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "OSI Model"
    },
    {
        "id": "67d28089-913e-4c69-beb1-59e52c0728d5",
        "source": "android_sec_doc",
        "question": "You are developing an Android application that requires performing cross-process calls with high performance. Which of the following IPC mechanisms would be most suitable for your application, and what is a significant advantage of using it?",
        "choices": [
            "A: Binder, because it is designed for high performance in cross-process calls.",
            "B: Intents, because they can broadcast system-wide events.",
            "C: ContentProviders, because they provide access to the user's list of contacts.",
            "D: Services, because they can run in the background without user interaction."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Android IPC"
    },
    {
        "id": "8793c56e-832c-4fa0-822a-5712af3012e4",
        "source": "windows_security",
        "question": "Which of the following is the LEAST valid reason for registering a trusted logon process with the Local Security Authority?",
        "choices": [
            "A: To facilitate the use of custom authentication methods for user logon procedures.",
            "B: To ensure system security by allowing a specific process to participate in the logon process.",
            "C: To reduce the system's exposure to potential vulnerabilities by limiting logon capabilities.",
            "D: To comply with an external regulation that mandates the use of specific software for logon."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Trusted Logon Process"
    },
    {
        "id": "4915c448-2e4c-4349-bda7-ccb95cb112c8",
        "source": "android_sec_doc",
        "question": "A developer is designing a feature for an Android app that involves playing music in the background while the user navigates between different activities within the app. The music should continue to play uninterrupted regardless of user interactions with the app's UI. Which Android application component should be used to implement this feature, and what is a major advantage of using this component for such a task?",
        "choices": [
            "A: Activity, because it directly interacts with the user interface and can run background processes efficiently.",
            "B: Service, because it can perform long-running operations in the background without needing a user interface.",
            "C: Broadcast Receiver, because it can continuously listen for and respond to broadcast intents, making it suitable for background music playback.",
            "D: AndroidManifest.xml, because it defines the app's components and can handle background processes like music playback."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Service component"
    },
    {
        "id": "8e79f6a2-5848-461e-a778-3453fb2a3385",
        "source": "cs161_textbook",
        "question": "You are developing a text-editing application for a secure environment. According to the principle of least privilege, which of the following measures should you take to ensure the application has the least privilege necessary for its operation?",
        "choices": [
            "A: The application should only be able to open and edit files that are explicitly opened by the user within the editor.",
            "B: The application should run with the same privileges as the system administrator to ensure it has sufficient access to all system resources.",
            "C: The editor should automatically have access to the clipboard, all system files, and network resources to enhance user experience.",
            "D: The application should be granted only the permissions necessary to edit files and should explicitly request additional permissions only when required for specific features."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "LeastPrivilege"
    },
    {
        "id": "517936e0-f232-4d26-8549-20c27d718b1c",
        "source": "attck",
        "question": "A cybersecurity specialist is analyzing a compromised system and observes the following indicators of compromise (IOCs): modification of the Registry to disable crash dumps, creation of a Registry subkey to register a malicious service, and modification of Registry keys to enable all macros. Which of the following groups of malware could be responsible for these activities?",
        "choices": [
            "A: HermeticWiper, Hydraq, and Kimsuky",
            "B: Rover, Mosquito, and NanoCore",
            "C: LuminousMoth, Koctopus, and Remcos",
            "D: RCSession, Naid, and Magic Hound"
        ],
        "answer": "AA",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Registry Modification Tactics"
    },
    {
        "id": "a686c676-676f-4a8a-9907-3e3480ff45b8",
        "source": "apple_platform_security",
        "question": "A user is required to authorize kernel extensions on their Mac. Identify the correct sequence of actions and conditions that apply to user-approved kernel extension loading based on the macOS version.",
        "choices": [
            "A: On macOS 10.15 or later, system extensions can be managed in user space, eliminating the need for kernel extensions and thus bypassing the authorization process.",
            "B: For macOS 10.13.2 and later, kernel extensions can automatically load without user consent if specified via mobile device management (MDM) on an MDM-enrolled Mac.",
            "C: On macOS 11, kernel extensions can be loaded on demand at any time during system operation, provided they have been previously approved by the user.",
            "D: For macOS 10.13 and later, user approval is required to load new kernel extensions, and administrator authorization is needed to approve them."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "KernelExtensionAuthorization"
    },
    {
        "id": "79a7f66d-c870-4723-b7fe-6ebd10f2d10a",
        "source": "owasp_wstg",
        "question": "You are tasked with creating a secure report for a recent web application penetration test. Which of the following elements should be included in the report to ensure it is comprehensive and understandable by both executive management and the technical staff?",
        "choices": [
            "A: A disclaimer stating the test provides an exhaustive representation of all security issues at all times.",
            "B: A technical summary that includes detailed exploit code and sensitive data such as passwords.",
            "C: A findings section with risk levels and a detailed description on how to replicate and remediate the vulnerability.",
            "D: An executive summary that focuses exclusively on the technical details of the vulnerabilities found."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Secure Report Writing"
    },
    {
        "id": "7a588568-aaaf-44c8-8f8a-8f2e9e731811",
        "source": "windows_security",
        "question": "A Windows Server system has just restarted after a CrashOnAuditFail event where CrashOnAuditFail was set to 2. As an administrator, you are assessing the situation. Which of the following actions should you take? (Select two)",
        "choices": [
            "A: Trigger an alert for the occurrence of the event, as it indicates the system halted due to inability to record an auditable event.",
            "B: Ignore the event if repeated frequently, as it is common for systems to reboot without recording all auditable activities.",
            "C: Verify if the CrashOnAuditFail flag is enabled, as its occurrence without the flag suggests deviation from baseline settings.",
            "D: Lower the CrashOnAuditFail setting to 1 to prevent future system halts, as frequent reboots can be disruptive."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "CrashOnAuditFail"
    },
    {
        "id": "df83f007-e2ef-43b6-b6be-c39c5dd79185",
        "source": "owasp_wstg",
        "question": "A web application has been reported to experience issues with its handling of HTTP requests. You have been tasked to evaluate the application's security measures against HTTP splitting and smuggling attacks. Based on your assessment, which of the following measures would be most effective in preventing such attacks?",
        "choices": [
            "A: Implementing strict input sanitization to prevent the insertion of control characters like CR and LF into HTTP headers.",
            "B: Enabling compression on all HTTP responses to minimize the attack surface.",
            "C: Using a static response header configuration that defines a strict Content Security Policy.",
            "D: Understanding the parsing behavior of different HTTP agents involved and ensuring consistent interpretation."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "HTTP Splitting"
    },
    {
        "id": "ee589d77-a1f7-41a8-a665-3764f228bbe6",
        "source": "attck",
        "question": "You are analyzing logs from a compromised system and suspect that an adversary has been gathering network configuration and settings information. Which of the following actions should you look for in the logs to support your suspicion? (Select TWO.)",
        "choices": [
            "A: Execution of system utilities such as ipconfig/ifconfig or arp with arguments that may reveal network settings.",
            "B: Use of the `GetAdaptersInfo()` or `GetIpNetTable()` API calls that can gather network configuration details.",
            "C: Frequent use of disk defragmentation tools which might indicate hiding of network reconnaissance activities.",
            "D: Consistent querying of the system's BIOS version, which can be a sign of network topology mapping."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command Execution"
    },
    {
        "id": "978ad75c-ebaa-4d34-aee5-b9d4ca44ac84",
        "source": "apple_platform_security",
        "question": "A cybersecurity analyst is reviewing the security measures implemented on Apple devices to prevent attacks based on IPv6 extension headers and fragmentation. Which of the following measures are enforced by Apple devices to mitigate such attacks?",
        "choices": [
            "A: Blocking all IPv6 traffic that contains extension headers.",
            "B: Implementing protection measures specified in RFC 6980, RFC 7112, and RFC 8021.",
            "C: Enforcing limits on the number of prefixes per interface for IPv6-related data structures.",
            "D: Disallowing the use of fragmented IPv6 packets altogether."
        ],
        "answer": "BC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "IPv6"
    },
    {
        "id": "4ed72ff0-e601-46bb-a7f7-4cb0fdacba25",
        "source": "attck",
        "question": "In designing a system to detect malware that employs virtualization/sandbox evasion techniques, which of the following would NOT be an effective approach based on observed adversary behaviors?",
        "choices": [
            "A: Monitoring for unexpected process spawning that gathers system information",
            "B: Checking for the absence of typical user activities on the system",
            "C: Implementing static signature-based detection mechanisms",
            "D: Looking for artifacts indicative of sandbox environments"
        ],
        "answer": "C",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Signature-based detection"
    },
    {
        "id": "92c2eb08-4bbf-47e4-badd-68c259e303ed",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating a security incident where several users' web session cookies were stolen, granting the adversary unauthorized authenticated access to a web application. Which of the following methods is the most likely way the adversary obtained these session cookies?",
        "choices": [
            "A: The adversary exploited a vulnerability in the users' web browsers to execute a cross-site scripting attack.",
            "B: The adversary set up a malicious proxy server to intercept and collect session cookies during a phishing campaign.",
            "C: The adversary sent a phishing email with a malicious attachment that, when opened, extracted cookies from the users' browsers.",
            "D: The adversary gained physical access to the users' devices and manually transferred the session cookies to their own device."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Malicious Proxy"
    },
    {
        "id": "49363144-ebc0-4ef4-9d69-0ab4b14f891d",
        "source": "owasp_wstg",
        "question": "You are reviewing the security measures of an online banking application. Which of the following actions should be taken to ensure proper session timeout management and to prevent unauthorized access after a user has been idle?",
        "choices": [
            "A: Implement client-side session timeouts using cookie values to track the duration of a session.",
            "B: Store session timeout data on the server-side and invalidate the user's session after the predefined idle period has passed.",
            "C: Allow unlimited session durations for user convenience, as long as the user does not explicitly log out.",
            "D: Reuse the same session for multiple users to reduce server load and improve performance."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Session Timeout"
    },
    {
        "id": "d3a74146-a3d8-4e4b-97ff-161b0d0cdf86",
        "source": "cwe",
        "question": "In designing a secure system, you are tasked with implementing mitigation strategies to prevent buffer overflow vulnerabilities. Evaluate the following strategies and select the ones that have limitations you need to consider while implementing them:",
        "choices": [
            "A: Using a language that performs its own memory management, like Java or Perl.",
            "B: Utilizing a vetted library that provides safer versions of overflow-prone functions.",
            "C: Implementing automatic buffer overflow detection offered by compiler extensions.",
            "D: Applying Data Execution Protection (DEP) at the CPU and operating system level."
        ],
        "answer": "ABCD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategies"
    },
    {
        "id": "9a80386d-14b5-4583-b189-0d26445fed16",
        "source": "android_sec_doc",
        "question": "Considering the process of validating SELinux policies, a developer wants to expedite the SELinux policy development by using a tool that takes `dmesg` denials and converts them into corresponding SELinux policy statements. They are considering `audit2allow` for this purpose. What is an advantage and a potential issue of using `audit2allow` for developing SELinux policies?",
        "choices": [
            "A: Advantage: It can quickly convert denial logs into policy statements. Potential issue: It might suggest overreaching permissions that could compromise security.",
            "B: Advantage: It can analyze the full call chain of denials including kernel and userspace. Potential issue: It requires a Linux kernel version higher than 5.10.",
            "C: Advantage: It prevents rate-limiting of SELinux error messages after boot complete. Potential issue: It may not support capturing boot time events.",
            "D: Advantage: It confirms enforcing mode is enabled through CTS tests. Potential issue: It cannot disable SELinux enforcement on production devices."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "81a18f0e-6369-493c-8eff-c1a2e29ec4a5",
        "source": "cs161_textbook",
        "question": "Alice suspects that one of the blocks in the blockchain she downloaded may have been compromised. She only has the hash of the final block from a trusted source. What method can she use to ascertain the integrity of the entire blockchain?",
        "choices": [
            "A: Alice can compare the hash of each downloaded block to the corresponding hash from the trusted source to identify any discrepancies.",
            "B: Alice can verify the integrity by checking the hash of the last block against the one from the trusted source; if they match, the blockchain is intact.",
            "C: Alice needs to find a new trusted source for each block to compare all individual block hashes.",
            "D: Alice can ignore the hash chain and instead rely on checking transaction data within each block for inconsistencies."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HashChainIntegrity"
    },
    {
        "id": "b5c396a3-3e03-4fc5-ac39-2773817effc0",
        "source": "attck",
        "question": "In designing a defense-in-depth strategy against phishing, a cybersecurity analyst is considering the use of software configuration to prevent spoofed emails. Which of the following measures should be prioritized to enhance the filtering of messages based on the validity checks of the sender domain and the integrity of the messages?",
        "choices": [
            "A: Implementing a strong password policy across the organization.",
            "B: Deploying anti-spoofing and email authentication mechanisms such as SPF and DKIM.",
            "C: Installing a web application firewall to filter incoming HTTP/HTTPS traffic.",
            "D: Enforcing encryption of all data at rest within the organization."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Email Spoofing Mitigation"
    },
    {
        "id": "b5fa9f90-00a3-4e92-bc14-b65ae7d1c90f",
        "source": "windows_security",
        "question": "As a security administrator, you are assessing the implementation of Remote Credential Guard to enhance the security of Remote Desktop credentials within your organization. Given the diversity of operating systems in your enterprise environment, which of the following Windows versions are compatible with the implementation of Remote Credential Guard?",
        "choices": [
            "A: Windows 11",
            "B: Windows 8.1",
            "C: Windows Server 2012",
            "D: Windows Server 2019"
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Remote Credential Guard"
    },
    {
        "id": "46430420-5811-4986-b9b3-10d174de9fae",
        "source": "attck",
        "question": "In the context of a sophisticated cyber attack, an adversary has compromised several systems within an organization’s network. They have used malware that is capable of downloading additional payloads from a C2 server. What could be a potential disadvantage of this malware capability for the adversary?",
        "choices": [
            "A: The need for persistent internet access increases the risk of detection",
            "B: The malware's ability to evade detection is enhanced",
            "C: It allows for quicker propagation across the network",
            "D: It enables the adversary to maintain a smaller footprint on the network"
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "C2 server"
    },
    {
        "id": "f8d517f5-8208-4ed2-b410-af9e9066c4be",
        "source": "android_sec_doc",
        "question": "You are implementing a Keymaster Hardware Abstraction Layer (HAL) for an Android device that needs to support a feature for an Android Wear device with on-body sensors. Which of the following Keymaster Authorization Tags should you implement to ensure that the feature is purely software-enforced?",
        "choices": [
            "A: Tag::ALLOW_WHILE_ON_BODY",
            "B: Tag::ALL_APPLICATIONS",
            "C: Tag::APPLICATION_ID",
            "D: Tag::ATTESTATION_ID_IMEI"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Keymaster HAL"
    },
    {
        "id": "b0f69a6f-5546-49a1-9861-639312eb67ff",
        "source": "owasp_wstg",
        "question": "In a user acceptance testing (UAT) environment, which of the following actions is most appropriate for validating the security of a web application prior to production deployment?",
        "choices": [
            "A: Ensuring the server that hosts the web application is configured with minimum privileges and a valid HTTPS certificate.",
            "B: Performing a large number of functional tests to ensure all features are working as expected.",
            "C: Focusing only on load testing to validate the application's performance under stress.",
            "D: Relying on automated unit tests to catch all possible security vulnerabilities."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "UAT"
    },
    {
        "id": "4acf5933-4190-47ac-94f0-7a1d060e841e",
        "source": "apple_platform_security",
        "question": "A healthcare application on an iOS device needs to securely share patient health data with a healthcare provider. The application is designed to comply with strict privacy regulations and ensures that the data remains confidential. Which of the following measures should the application implement to maintain the security and privacy of the health data being shared?",
        "choices": [
            "A: Use the Share with Provider feature in the Health app with end-to-end encryption for data shared.",
            "B: Store credentials in Keychain data partitioned with ACLs to prevent unauthorized access by other apps unless user-approved.",
            "C: Encrypt patient health data using per-message S/MIME and send it using the Mail app.",
            "D: Utilize smart cards with PIV for two-factor authentication when healthcare providers access the shared health data."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Data Sharing"
    },
    {
        "id": "43cc7654-8a82-448c-a9bc-c4d433e94fdf",
        "source": "windows_security",
        "question": "As an IT security professional, you are tasked with enhancing the threat protection capabilities of a company's Windows client systems. Which of the following security measures should you consider implementing to achieve this goal? (Select all that apply.)",
        "choices": [
            "A: Regularly updating Windows Defender Antivirus definitions and enabling real-time protection.",
            "B: Disabling the Windows Firewall to prevent conflicts with third-party antivirus software.",
            "C: Implementing User Account Control (UAC) to prevent unauthorized changes to the system.",
            "D: Enabling BitLocker drive encryption to protect data on lost or stolen devices."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Windows Defender Antivirus"
    },
    {
        "id": "6781cb3d-b669-416c-9d18-0a3268a7b6ee",
        "source": "cwe",
        "question": "Which of the following statements accurately describe the causality and implications associated with the different types of cross-site scripting (XSS) vulnerabilities?",
        "choices": [
            "A: Type 1 XSS is particularly dangerous when the attacker targets users with elevated privileges in the application.",
            "B: Type 0 XSS occurs when the server injects untrusted data into the web page without proper sanitization.",
            "C: Type 2 XSS can be mitigated by employing client-side input validation alone.",
            "D: In Type 1 XSS, URL encoding or Unicode could be used by attackers to disguise malicious scripts."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "XSS_Types"
    },
    {
        "id": "92440942-e4b4-492a-9af2-951c236c179c",
        "source": "owasp_wstg",
        "question": "An online store has a backend process where, after a purchase, if an item is out of stock, it automatically places an order with a partner warehouse. The partner warehouse ships the item and later claims reimbursement. An attacker has found a way to manipulate the system into believing that in-stock items are out-of-stock, triggering orders to the partner warehouse. What is the likely impact of this attack on the online store?",
        "choices": [
            "A: The partner warehouse will experience a stock surplus due to the miscommunication, leading to inventory management issues.",
            "B: The online store may incur financial losses by reimbursing the partner for items that they actually had in stock.",
            "C: The attack will result in customers receiving their orders faster as the partner warehouse is more efficient in processing orders.",
            "D: The partner warehouse will stop collaborating with the online store due to a breach of the partnership agreement."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Data Validation Vulnerability"
    },
    {
        "id": "96be588b-fe3e-401b-91f6-cd59f039c72d",
        "source": "owasp_wstg",
        "question": "You are a security analyst tasked with deriving security requirements for a new authentication feature in a web application. You have identified a functional scenario where users authenticate with a username and password, and a misuse case where attackers attempt to exploit validation errors from the authentication process. Based on this information, which of the following would be an appropriate security requirement to mitigate the risk posed by the misuse case?",
        "choices": [
            "A: Implement a system that automatically fills in the username after a successful login to reduce user inconvenience.",
            "B: Ensure that password complexity requirements are in accordance with current standards to prevent brute force attacks.",
            "C: Create detailed error messages to inform users about the exact reason for authentication failure.",
            "D: Disable all user accounts after three unsuccessful login attempts, regardless of the time interval between attempts."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Authentication Security Requirements"
    },
    {
        "id": "e6d248a2-00f2-4cae-8a2e-e5c5666deab3",
        "source": "attck",
        "question": "In an assessment of system compromise, a penetration tester determines that a particular piece of malware is responsible for the data breach. This malware is known for its ability to collect detailed system information but does not typically enumerate system drives or volume information. Which of the following malware types is least likely to have been involved based on its known capabilities?",
        "choices": [
            "A: Chrommme",
            "B: DEADEYE",
            "C: build_downer",
            "D: Crimson"
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "malware system information gathering"
    },
    {
        "id": "b32942d3-c3c5-42a2-a546-61acb7fb9e54",
        "source": "owasp_wstg",
        "question": "You have been tasked with securing a web application before its deployment. Which of the following actions should be taken to ensure that the security of the application's architecture is not compromised?",
        "choices": [
            "A: Leaving default configuration files in place for reference.",
            "B: Removing non-essential functionality such as application examples and test pages.",
            "C: Ensuring debugging code and extensions remain in the production environment for maintenance purposes.",
            "D: Reviewing and implementing appropriate logging mechanisms."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Application Architecture Security"
    },
    {
        "id": "004f3f07-40b6-48c5-9752-9cf7e18cea45",
        "source": "cs161_textbook",
        "question": "You are tasked with configuring a web server that needs to handle both HTTP and HTTPS requests. Given your knowledge of networking protocols and their use of port numbers, which of the following configurations should you implement to ensure the server correctly receives and processes incoming traffic?",
        "choices": [
            "A: Assign HTTP requests to port 80 and HTTPS requests to port 443, ensuring that only programs running as root can receive packets on these ports.",
            "B: Use arbitrarily assigned high number ports for both HTTP and HTTPS to avoid conflicts with other applications on the server.",
            "C: Set up the server to accept HTTP requests on any available port and only use port 443 for HTTPS requests.",
            "D: Configure the server to receive all HTTP and HTTPS requests on a single, unique port number that is not reserved."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PortNumbers"
    },
    {
        "id": "6f5efdae-73e6-434c-ad61-f012ce14efb0",
        "source": "mit6.858",
        "question": "A company is revising its cybersecurity strategy and is considering different approaches to threat modeling. As a cybersecurity consultant, you are asked to evaluate the following approaches. Which of these approaches to threat modeling could potentially improve the company's security posture? (Choose all that apply.)",
        "choices": [
            "A: Creating more explicit threat models to better understand specific weaknesses and tailor defenses accordingly.",
            "B: Adopting simpler, more general threat models that cover a broader range of potential threats without too much complexity.",
            "C: Assuming system design is secret and relying on security through obscurity as a foundation for the threat model.",
            "D: Implementing defense in depth to provide multiple layers of security and to compensate for any shortcomings in the threat model."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "threat_modeling"
    },
    {
        "id": "2816e2f2-dd5a-4a16-9f03-20d62d561aef",
        "source": "windows_security",
        "question": "A Windows Domain Controller logs security event 4769. Which of the following actions could have prompted this event?",
        "choices": [
            "A: A network administrator reset a user's account password.",
            "B: A user's account was locked out after multiple failed login attempts.",
            "C: A user presented a valid Ticket Granting Ticket (TGT) to request access to a file server.",
            "D: The system performed an automatic background refresh of group policies."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Security Event 4769"
    },
    {
        "id": "ce9f6d09-c86c-4df6-9a2b-c5f2520aaba1",
        "source": "d3fend",
        "question": "A security analyst is tasked with identifying and modeling the link connectivity of the network devices within a company's physical network to anticipate and mitigate physical security breaches. Which D3FEND technique should the analyst focus on to effectively achieve the objective?",
        "choices": [
            "A: Physical Link Mapping (D3-PLM)",
            "B: Logical Link Mapping (D3-LLM)",
            "C: Active Physical Link Mapping (D3-APLM)",
            "D: Passive Physical Link Mapping (D3-PPLM)"
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Physical Link Mapping (D3-PLM)"
    },
    {
        "id": "cc4cb2ef-ab6e-44ca-9405-2f17c07831b4",
        "source": "attck",
        "question": "In order for a malware to successfully search and collect sensitive data from connected removable media on a compromised system prior to exfiltration, which of the following system requirements is most likely to be necessary?",
        "choices": [
            "A: Privileges to modify the system's boot sequence.",
            "B: Privileges to access removable media drive and files.",
            "C: Privileges to alter the system's network configuration.",
            "D: Privileges to install system-wide software updates."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "System Privileges"
    },
    {
        "id": "39aac00c-93d6-481f-81bf-1a5f458f4855",
        "source": "attck",
        "question": "A cybersecurity analyst is assessing a network that utilizes Kerberos authentication. The analyst observes unusual Kerberos ticket requests and suspects that an adversary might be attempting to subvert the authentication process. Which of the following actions should the analyst consider to mitigate the potential threat? (Select TWO)",
        "choices": [
            "A: Monitor for irregular patterns of Kerberos TGS service ticket requests and investigate accounts making numerous requests within a small time frame.",
            "B: Decrease the KRBTGT account password length to below 15 characters to avoid detection by password spraying attacks.",
            "C: Enable AES Kerberos encryption instead of RC4, where possible, to enhance the security of Kerberos ticket exchanges.",
            "D: Limit domain admin account permissions exclusively to user workstations and non-critical systems to reduce the attack surface."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Kerberos TGS service ticket"
    },
    {
        "id": "0e4fd5ee-f4bb-4af9-b1c1-3531be1858fa",
        "source": "cs161_textbook",
        "question": "Why is it incorrect to state that a server can safely set cookies with domain attributes matching any top-level domain (TLD), such as '.com' or '.edu'?",
        "choices": [
            "A: Cookies with domain attributes matching a TLD are too specific and limit the browser's ability to manage sessions effectively.",
            "B: Setting a cookie with a TLD domain allows the cookie to be sent to all websites sharing the same TLD, which is a security risk.",
            "C: Browsers do not recognize TLDs in domain attributes and will, therefore, ignore such cookies by default.",
            "D: Using TLDs as domain attributes in cookies increases the risk of DNS hijacking and is considered a bad practice."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TLDRestriction"
    },
    {
        "id": "0de24da5-91c0-40e6-983e-256a57479451",
        "source": "attck",
        "question": "A security analyst is reviewing the company's Windows security policies to mitigate the risk of adversaries using signed scripts to execute malicious files. Which of the following mitigation strategies would be most effective in preventing the misuse of trusted scripts, like PubPrn.vbs, to proxy the execution of unauthorized files?",
        "choices": [
            "A: Implementing strict digital certificate validation processes for all scripts, regardless of origin.",
            "B: Enabling the execution of all scripts to ensure that monitoring tools can detect malicious activity.",
            "C: Configuring application control to block the execution of scripts known to be used for proxying malicious file execution.",
            "D: Disabling command-line interfaces to prevent the execution of any scripts that could be used maliciously."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Execution Prevention"
    },
    {
        "id": "7bc55574-72e3-4d13-8ccb-7e047d9389ba",
        "source": "owasp_wstg",
        "question": "A security analyst is testing a web application and notices that when a query string parameter is repeated with different values, the application seems to concatenate the values with a comma. The analyst suspects that the web application backend could be vulnerable to HTTP Parameter Pollution (HPP). Which of the following actions should the analyst take to confirm the vulnerability?",
        "choices": [
            "A: Submit a single parameter with a long string of random characters to test for buffer overflow vulnerabilities.",
            "B: Append the same parameter with a different value and analyze the response to determine how the values are parsed.",
            "C: Use an intercepting proxy to remove all query string parameters and observe if the application defaults to hidden parameters.",
            "D: Disable JavaScript in the browser to test if the parameter pollution is a result of client-side scripting."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Parameter Pollution"
    },
    {
        "id": "bacbd3ed-930a-47e5-863d-f23330a9bab0",
        "source": "attck",
        "question": "A company's security team has identified an unauthorized execution of commands in their Azure AD environment, which appears to be a result of compromised administrative credentials. Given their current situation, which of the following mitigation steps would be most effective to reduce the risk of such incidents in the future?",
        "choices": [
            "A: Increase the number of Global and Intune administrators to have better oversight over the environment.",
            "B: Limit the number of cloud accounts with permissions to remotely execute commands on virtual machines and avoid using these accounts for day-to-day operations.",
            "C: Permanently assign privileged access to virtual machines to a select few accounts to simplify management.",
            "D: Disable the Azure Virtual Machine Agent on all virtual machines to prevent remote script execution."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Privileged Account Management"
    },
    {
        "id": "255d8a70-06ca-495a-a2c2-8cddec41e9ff",
        "source": "attck",
        "question": "A security analyst is evaluating the effectiveness of various mitigation strategies against brute force attacks. Which of the following arguments best justifies the implementation of conditional access policies over a universal strict account lockout policy after a few failed login attempts?",
        "choices": [
            "A: Conditional access policies can create a denial of service condition, making them more secure against brute force attacks.",
            "B: Conditional access policies allow for more granular control, preventing lockouts from legitimate users while still deterring attackers.",
            "C: Strict account lockout policies are more user-friendly as they simplify the login process for users by removing additional security checks.",
            "D: Implementing strict account lockout policies is less resource-intensive compared to the continuous monitoring required by conditional access policies."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "conditional access policies"
    },
    {
        "id": "7a487fd8-f627-4ed5-b7c0-0ab83e23fde2",
        "source": "android_sec_doc",
        "question": "As an Android developer implementing inter-process communication (IPC) in a Trusty application, you are tasked with configuring a port that should allow connections both from other secure apps and the non-secure world. Which combination of flags should you specify for the `flags` parameter when creating this port to meet the requirements?",
        "choices": [
            "A: IPC_PORT_ALLOW_TA_CONNECT | IPC_PORT_ALLOW_NS_CONNECT",
            "B: IPC_PORT_ALLOW_TA_CONNECT & IPC_PORT_ALLOW_NS_CONNECT",
            "C: IPC_PORT_ALLOW_NS_CONNECT",
            "D: IPC_CONNECT_WAIT_FOR_PORT | IPC_CONNECT_ASYNC"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "IPC_PORT_ALLOW_TA_CONNECT"
    },
    {
        "id": "395d4ce4-6906-4098-b16d-cdfe10cbc721",
        "source": "owasp_wstg",
        "question": "When assessing a web application for CSRF vulnerabilities, you discover that the developers have implemented client-side defenses to mitigate the risk. Which of the following recommendations would you provide to strengthen the application's CSRF defenses further?",
        "choices": [
            "A: Encourage the use of HTTPS exclusively to ensure secure transmission of session cookies.",
            "B: Advise the implementation of server-side CSRF tokens that must be included in every state-changing request.",
            "C: Recommend disabling JavaScript in browsers to prevent automated CSRF attacks using malicious scripts.",
            "D: Suggest increasing the complexity of URL parameters to make it harder for attackers to guess the structure of requests."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "CSRF Tokens"
    },
    {
        "id": "2487ad79-4fee-4136-83f0-c86d66ab910d",
        "source": "attck",
        "question": "In the context of cybersecurity defenses, why would an organization configure their systems to monitor executed commands and arguments, particularly for those that may dump credentials?",
        "choices": [
            "A: To detect unauthorized changes to system files that could indicate malware installation.",
            "B: To identify potential credential dumping attempts to obtain login information and credential material.",
            "C: To monitor and prevent DDoS attacks by tracking anomalous command executions.",
            "D: To audit file access patterns and prevent data exfiltration."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Credential Dumping"
    },
    {
        "id": "568df606-4b7e-43d1-92e8-63c5ec617ab4",
        "source": "attck",
        "question": "The security team of XYZ Corporation is reviewing their current password policies after a series of attempted cyber attacks. They learned that adversaries could exploit weak password policies to perform dictionary and brute-force attacks. To enhance their security posture, the team is considering the implementation of new mitigation strategies. Which combination of strategies would most effectively reduce the risk of adversaries successfully discovering and exploiting their password policy?",
        "choices": [
            "A: Implementing account lockout policies and ensuring registration of only valid password filters in the domain controller's system registry.",
            "B: Decreasing the minimum password length requirement to reduce the complexity of user passwords, making them less prone to being cracked.",
            "C: Disabling the command shell utilities that adversaries could use to discover password policies, such as 'net accounts' on Windows.",
            "D: Educating users to avoid using complex passwords so that they do not write them down, reducing the chance of physical compromise."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Password Policy Discovery"
    },
    {
        "id": "076473f3-2a3f-4a35-bcac-1ca14970e924",
        "source": "attck",
        "question": "In the context of performing a penetration test to simulate an adversary's actions, which of the following methods would NOT be typically utilized for discovering Group Policy settings within an Active Directory environment?",
        "choices": [
            "A: Utilizing the 'gpresult' command to gather information on Group Policy settings.",
            "B: Employing PowerShell functions such as 'Get-DomainGPO' and 'Get-DomainGPOLocalGroup'.",
            "C: Executing a network scan to discover open ports and services on domain controllers.",
            "D: Analyzing file paths within the `\\<DOMAIN>\\SYSVOL\\<DOMAIN>\\Policies\\` directory."
        ],
        "answer": "C",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "LDAP Traffic Monitoring"
    },
    {
        "id": "edc6a7d3-f9ba-42fc-850b-1bf3c66a814b",
        "source": "cs161_textbook",
        "question": "Alice needs to securely send a message to Bob without having previously established a shared secret key. They decide to use public-key cryptography. Which of the following steps should Alice and Bob take to ensure secure communication? (Select all that apply)",
        "choices": [
            "A: Alice encrypts her message with her own private key and sends it to Bob, who then uses Alice's public key to decrypt the message.",
            "B: Alice generates a secret key for a symmetric-key cryptosystem, encrypts it with Bob’s public key, and sends him the ciphertext.",
            "C: Bob publishes a public key that Alice uses to encrypt her message before sending. Bob then decrypts the message using his private key.",
            "D: Bob sends Alice his private key so that she can encrypt messages with it, and Bob uses his public key to decrypt received messages."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Public-Key"
    },
    {
        "id": "1441eb93-8f33-463c-acd3-3f361a4f3eaa",
        "source": "android_sec_doc",
        "question": "Why is the AuthToken HMAC key regenerated on every boot of a device within the Android operating system, and not persisted across reboots?",
        "choices": [
            "A: To maintain the high performance of the device by resetting the cryptographic components to their default state.",
            "B: To prevent replay attacks by ensuring a unique HMAC key is used in each session that is never made available outside the TEE.",
            "C: Because the TEE lacks persistent storage capabilities and cannot retain the HMAC key across reboots.",
            "D: To comply with user privacy regulations that mandate the periodic reset of all security-related keys."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "AuthToken HMAC key"
    },
    {
        "id": "ecab667c-0062-4e2f-a56e-dd7908ca04b0",
        "source": "cs161_textbook",
        "question": "Consider a scenario where a new computer is joining a local network and is about to undergo the DHCP handshake process. Which of the following steps are correctly part of the DHCP handshake process, and which one is not?",
        "choices": [
            "A: Client Discover: The client sends a direct message to a known DHCP server requesting a configuration.",
            "B: Server Offer: The DHCP server responds with an offer that includes configuration settings and a DHCP lease.",
            "C: Client Request: The client broadcasts its choice of configuration to notify all potential DHCP servers on the network.",
            "D: Server Acknowledge: The chosen server confirms the configuration and assigns a static IP address to the client."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DHCP"
    },
    {
        "id": "af9fcea4-a1ef-4aa4-89c2-4740bfe84591",
        "source": "apple_platform_security",
        "question": "When making a payment with Apple Pay, the device requires authentication from the user. Under which of the following conditions is a passcode specifically required for the transaction to proceed?",
        "choices": [
            "A: Face ID has not been configured or is not enabled for Apple Pay.",
            "B: The user prefers to use a passcode over biometric authentication methods.",
            "C: There have been five unsuccessful attempts to match a face or fingerprint.",
            "D: The transaction is taking place on an Apple Watch that is currently locked."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "f9522b3d-ab7f-4536-ad03-be9e6ee3606e",
        "source": "owasp_wstg",
        "question": "In the context of security testing, why would a penetration tester pay special attention to HTTP methods such as PUT and DELETE beyond the commonly used GET and POST methods?",
        "choices": [
            "A: Because PUT and DELETE methods are often not properly secured and, if allowed, can expose vulnerabilities.",
            "B: Because PUT and DELETE methods are newer and less understood than GET and POST, making them inherently more secure.",
            "C: Because PUT and DELETE methods cannot be intercepted by proxies, thus they do not require thorough testing.",
            "D: Because PUT and DELETE methods are typically used for read-only operations, which are not relevant to security testing."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "HTTP Methods"
    },
    {
        "id": "0667a568-c043-47c5-be46-259d9e0c21e9",
        "source": "cwe",
        "question": "You have been tasked with securing a web application's deployment process. During a review, you discover that the version-control repository has been included in the web server's public directory. What measures should you take to prevent exposure of the version-control repository to unauthorized parties?",
        "choices": [
            "A: Remove any version-control directories and repositories from the production server and ensure they are not accessible via the web.",
            "B: Restrict write permissions on the server to prevent unauthorized modification of the repository.",
            "C: Implement a web application firewall (WAF) to filter out requests attempting to access version-control metadata.",
            "D: Create a robots.txt file to disallow web crawlers from indexing the version-control repository directories."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Version-Control_Security"
    },
    {
        "id": "bf07b95b-90a0-4d3d-9527-5893e83a606b",
        "source": "cs161_textbook",
        "question": "In an effort to bolster your web server's security against evasion attacks, you are considering deploying HIDS. A colleague claims that by installing HIDS, the server will be fully protected against path traversal attacks. Based on your understanding of how HIDS operates, which of the following would be the best counterargument to your colleague's claim?",
        "choices": [
            "A: HIDS is ineffective against path traversal attacks because it only analyzes network traffic and not the file system's interpretation of requests.",
            "B: To fully defend against path traversal attacks, HIDS must not only understand the contents of the end request but also how the underlying file system interprets these contents, which could still lead to parsing inconsistencies and evasion attacks.",
            "C: Path traversal attacks are not a concern for HIDS because they typically rely on exploiting the network layer, which HIDS is adept at monitoring and defending.",
            "D: Installing HIDS on the server would make the system more vulnerable to path traversal attacks, as it may introduce additional security flaws."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Path Traversal"
    },
    {
        "id": "6b7a4764-f6bf-4242-967e-78542946cbf1",
        "source": "apple_platform_security",
        "question": "Select the statements that correctly describe the key management and data security strategies used in the HomeKit framework.",
        "choices": [
            "A: HomeKit identity and security are based on RSA public-private key pairs, which are used to authenticate communication across devices.",
            "B: HomeKit data is encrypted using keys derived from the user’s HomeKit identity and a random nonce before being stored as an encrypted blob in iCloud.",
            "C: HomeKit accessories store their Ed25519 key pairs in iCloud for backup and synchronization purposes.",
            "D: HomePod and Apple TV receive HomeKit identity keys using tap-to-set-up or setup mode, and these keys are used to secure communication with accessories."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Key Management"
    },
    {
        "id": "ced9b1ef-23c2-4671-a91b-1ac1de414510",
        "source": "android_sec_doc",
        "question": "An Android device is being upgraded from version 1 (v1) to version 2 (v2) of its platform policy. As the security policy architect, you are tasked with ensuring that existing vendor policies continue to function correctly after the upgrade. Which of the following actions must be taken to appropriately handle the changes in type attributes and permissions?",
        "choices": [
            "A: Remove the `sysfs_A` type completely from the v2 platform policy as vendor policies do not rely on types removed in the platform upgrade.",
            "B: Maintain the definition of the `ZygoteConnection` object manager class and permissions in the v2 platform policy until the vendor version no longer uses it.",
            "C: Include a rule in the v2 platform policy that allows all domains that could have been created or extended by vendor policy to use new classes without obstruction.",
            "D: Automatically convert all vendor types to attributes in the v2 platform policy to ensure compatibility with the platform."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "Platform Policy Upgrade"
    },
    {
        "id": "97a5bba2-fe0c-47f0-b2f5-1189b032c11b",
        "source": "owasp_wstg",
        "question": "In the context of web application development, at which stage should security testing be integrated to ensure the most effective and cost-efficient identification and mitigation of security vulnerabilities?",
        "choices": [
            "A: Only after the application has been fully developed and is ready for deployment.",
            "B: At the end of each phase in the software development lifecycle, before moving on to the next phase.",
            "C: Exclusively during the design phase to establish security standards before any code is written.",
            "D: Only during the maintenance phase to handle any new vulnerabilities that arise after deployment."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Software Development Lifecycle (SDLC)"
    },
    {
        "id": "e578ec30-6641-47ae-b2f1-5956bc6c1023",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately reflect the security mechanisms in place for Mac computers regarding Direct Memory Access (DMA) protections and the operation of kernel extensions (kexts)?",
        "choices": [
            "A: On a Mac with Apple silicon, the IOMMU allows peripherals to access all memory regions indiscriminately to ensure maximum compatibility and performance.",
            "B: For an Intel-based Mac, the IOMMU operates on a default-allow policy until the operating system initializes it to block unauthorized DMA requests.",
            "C: Starting with macOS 11, third-party kernel extensions must be included in the Auxiliary Kernel Collection at boot and cannot be loaded on demand to enhance system security.",
            "D: Kernel extensions for a Mac with Apple silicon can be enabled in One True Recovery mode, requiring a downgrade to Reduced Security and an administrator password to authorize."
        ],
        "answer": "CD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "MacSecurity"
    },
    {
        "id": "55210ad2-6937-4622-bbad-3a1bddffa001",
        "source": "owasp_mastg",
        "question": "In an effort to optimize an Android application's performance while maintaining security, you are analyzing the different compilation methods used by the Android platform to execute applications. What are the advantages and disadvantages of using Ahead-Of-Time (AOT) compilation and Just-In-Time (JIT) compilation methods on Android?",
        "choices": [
            "A: AOT improves app start times but increases system update time due to recompilation of applications.",
            "B: JIT increases installation time since the entire application is compiled at install time.",
            "C: AOT results in less optimized code because it compiles without usage patterns, leading to slower execution.",
            "D: JIT allows for continuous optimization of frequently used code paths at runtime, but may introduce slight execution delays."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "AOT (Ahead-Of-Time) Compilation"
    },
    {
        "id": "0dcadcb0-1f20-4644-abf9-b2f28d302495",
        "source": "cs161_textbook",
        "question": "Imagine a state government has implemented a hierarchical PKI similar to the one described for California. The governor has delegated certificate issuance responsibilities to various department heads. In this scenario, which of the following statements are correct regarding the issuance and management of digital certificates within the hierarchical PKI system?",
        "choices": [
            "A: The governor, serving as the root CA, is responsible for issuing certificates for all public employees in the state.",
            "B: Certificate chains enable the delegation of certificate issuance, reducing the burden on a single authority.",
            "C: Each sub-CA can issue certificates within their domain, creating a scalable and manageable system.",
            "D: Employees must personally meet with the governor to have their public keys certified."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PKI"
    },
    {
        "id": "35c9b34d-ad77-4037-94a1-22fa5ac0d7fc",
        "source": "attck",
        "question": "A penetration tester is analyzing network traffic from a suspected compromised host and observes data being exfiltrated to a command and control (C2) server. Which of the following malware families is most likely to be responsible for this activity, based on its characteristic behavior of utilizing the same channel for both command and control communications and data exfiltration?",
        "choices": [
            "A: LuminousMoth, known for exfiltrating stolen data to its C2 server.",
            "B: Machete, which collects data and exfiltrates it over a separate dedicated exfiltration channel.",
            "C: MobileOrder, exfiltrating data to its C2 server over the same protocol as C2 communications.",
            "D: REvil, using a unique and separate protocol for data exfiltration."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "C2 (Command and Control) Channel"
    },
    {
        "id": "df923d9b-ab4c-42fd-a324-06ab1fbf85be",
        "source": "apple_platform_security",
        "question": "Suppose you are administering a group of Mac computers with Apple silicon for a development team that requires the ability to run both older versions of macOS and third-party kernel extensions for testing purposes. Given the security policies described, which security policies would you consider setting on these Macs, and what are the potential risks associated with each policy?",
        "choices": [
            "A: Setting the Macs to Reduced Security policy allows running older macOS versions but does not protect against rollback attacks and requires rebooting to load third-party kernel extensions.",
            "B: Configuring the Macs with Permissive Security policy enables signature verification along the secure boot chain but allows loading a custom XNU kernel, which may compromise decryption keys for trusted operating systems.",
            "C: Enabling No Security mode, similar to Permissive Security, will disable the signature verification process entirely, allowing any operating system kernel to be loaded without constraints.",
            "D: Applying Medium Security policy allows for the use of third-party kernel extensions without the risk of operating system compromise as it enforces kext signature verification at runtime."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SecurityPolicy"
    },
    {
        "id": "c4b4f4b8-4261-42ad-8782-6f06305e5457",
        "source": "attck",
        "question": "An organization is assessing its security posture against the risk of adversaries bridging network boundaries. Which of the following mitigation strategies would be least effective in preventing adversaries from bypassing traffic restrictions?",
        "choices": [
            "A: Strengthening password policies for network devices.",
            "B: Filtering network traffic to block malicious packets.",
            "C: Implementing network segmentation and internal proxies.",
            "D: Encrypting all data in transit between network segments."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Traffic Filtering"
    },
    {
        "id": "e2cb8e0e-db8e-4478-8550-2d3a9c49ceb8",
        "source": "windows_security",
        "question": "In the context of Windows security, what is the primary role of using Group Policy to manage Process Mitigation Options for applications?",
        "choices": [
            "A: To disable all process mitigation options to enhance system performance.",
            "B: To ensure that specific security policies are enforced for individual applications.",
            "C: To allow users to customize security settings for their own applications without administrative oversight.",
            "D: To provide a centralized database of all installed applications across the network."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Group Policy"
    },
    {
        "id": "e064003d-c2a9-45ee-a3a6-eb1f8c39e022",
        "source": "cs161_textbook",
        "question": "A company is considering using the Caesar cipher to encrypt their internal communication. As a security consultant, you are required to assess the suitability of the Caesar cipher for this purpose. Which of the following points would be valid in your security assessment report?",
        "choices": [
            "A: The Caesar cipher provides a high level of security due to its simplicity and ease of use.",
            "B: The Caesar cipher's fixed key space of 26 possible shifts makes it vulnerable to brute-force attacks.",
            "C: The Caesar cipher is suitable for real-time communication because it requires minimal computational resources.",
            "D: The Caesar cipher ensures message confidentiality, as long as the employees do not disclose the shift value to outsiders."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "CaesarCipher"
    },
    {
        "id": "f3738f8e-772e-4673-a519-556cb2c0d4ce",
        "source": "android_sec_doc",
        "question": "Consider an Android device that employs a Trusted Execution Environment (TEE) to manage cryptographic operations. Which of the following field values in the keymaster's AuthorizationList are most appropriate to ensure that the keys are securely managed and attestations can be trusted, even if the Android system is compromised?",
        "choices": [
            "A: The `securityLevel` should be set to `Software` to ensure that keys are securely managed within the Android system.",
            "B: The `keymasterSecurity` should be set to `TrustedEnvironment` because it is highly resistant to remote compromise.",
            "C: The `attestationIdBrand` should be an `ENUMERATED` type to maximize compatibility with various device brands.",
            "D: The `verifiedBootState` should be set to `Failed` to indicate a high-security posture."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Trusted Execution Environment"
    },
    {
        "id": "f6a101d9-e014-4d3f-9c75-19d085bd528d",
        "source": "attck",
        "question": "A cybersecurity analyst is tasked with enhancing the detection capabilities against adversaries who may buy, lease, or rent infrastructure for malicious purposes. Which of the following methods should the analyst consider implementing to improve detection efforts at various stages of the adversary lifecycle, particularly during Command and Control?",
        "choices": [
            "A: Monitoring for unusual spikes in network traffic that could indicate the presence of a botnet.",
            "B: Scanning the Internet for identifiable patterns such as listening services or SSL/TLS negotiation features associated with adversary command and control software.",
            "C: Deploying antivirus software on all endpoints to prevent adversaries from acquiring infrastructure.",
            "D: Utilizing WHOIS databases to track newly registered domains that adversaries might use for their operations."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Internet Scan"
    },
    {
        "id": "b32fd1b9-5649-462a-abfe-5f9f94821516",
        "source": "attck",
        "question": "A security analyst is tasked with enhancing their organization's detection mechanisms. Knowing that adversaries may acquire access through broker networks, which are difficult to observe directly, where should the analyst focus their detection efforts?",
        "choices": [
            "A: Initial Access to identify the use of compromised credentials.",
            "B: Purchase Technical Data to monitor for unusual data transactions.",
            "C: External Remote Services to detect unauthorized third-party access.",
            "D: Resource Development to track adversary attempts to gather resources."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Initial Access"
    },
    {
        "id": "18438aa4-2893-4921-ac32-af09a722a1ea",
        "source": "mozilla_security",
        "question": "A developer claims that setting the 'Secure' attribute alone on a session cookie is sufficient for ensuring its security. Which of the following is the best counterargument to this claim?",
        "choices": [
            "A: The 'Secure' attribute ensures that the cookie is only sent over HTTPS, but without 'HttpOnly', the cookie is still vulnerable to access through client-side scripts such as XSS.",
            "B: The 'Secure' attribute does not restrict the cookie to a specific domain, so it could be sent along with requests to any domain, potentially leaking session information.",
            "C: The 'Secure' attribute can prevent the cookie from being accessed by JavaScript, thus providing complete protection against XSS attacks.",
            "D: Setting the 'Secure' attribute could lead to performance issues due to the encryption overhead on all cookie transmissions."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Secure attribute"
    },
    {
        "id": "1522eda8-af42-4dc5-8b48-833f4288c985",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the security measures in place at a company to prevent adversaries from executing malicious content through system services. Which of the following would be appropriate mitigation strategies to implement? (Select TWO.)",
        "choices": [
            "A: Enable Windows Attack Surface Reduction (ASR) rules to prevent processes created by service modification tools from running.",
            "B: Allow users to install their own launch agents or launch daemons to increase monitoring points.",
            "C: Ensure that services running at a higher permission level can be created and interacted with by users with lower permission levels.",
            "D: Restrict file and directory permissions to prevent high permission level service binaries from being replaced or modified by unauthorized users."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Attack Surface Reduction (ASR)"
    },
    {
        "id": "4b828139-e59d-4742-9207-1da126e1d1cf",
        "source": "cs161_textbook",
        "question": "Alice is sending Bob a Bitcoin transaction. She wants to ensure that the transaction is verified as authentic and that its contents remain unaltered during transmission. Which cryptographic primitives should she employ, and for what purpose?",
        "choices": [
            "A: Alice should use a cryptographic hash to prevent Bob from denying the reception of the transaction.",
            "B: Alice should use a digital signature to authenticate the transaction and prove it has not been tampered with.",
            "C: Bob should use Alice's public verification key to decrypt the transaction and verify its content.",
            "D: Alice should use a cryptographic hash to map the transaction to a fixed-length output that ensures its integrity during transmission."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Transaction Security"
    },
    {
        "id": "5d668143-e53f-44b0-b81a-853269639ab1",
        "source": "owasp_mastg",
        "question": "Consider the following code snippets. Which of the following code examples does NOT introduce a language syntax error due to improper import statements?",
        "choices": [
            "A: import <stdio.h>",
            "B: #import \"MyCustomHeader.h\"",
            "C: import sys.types.h",
            "D: #include <stdlib.h>"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "import directives"
    },
    {
        "id": "321e0e0a-716f-4ffb-81cf-0c641a45a38f",
        "source": "attck",
        "question": "An advanced piece of malware was found to use a decryption routine as part of an executable physical patch rather than simply embedding the payload in the executable. What could be the most likely reason for this malware to employ such a technique?",
        "choices": [
            "A: To evade signature-based detection mechanisms by altering the malware signature",
            "B: To increase the size of the malware to consume more disk space on the victim's machine",
            "C: To simplify the process of updating the malware payload by the adversary",
            "D: To create a dependency on a specific version of an operating system library"
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "Executable Physical Patch"
    },
    {
        "id": "2ea04001-2940-4673-a1e4-c17749e02d02",
        "source": "attck",
        "question": "In the context of cybersecurity, what is a potential consequence of adversaries continuously repeating login attempts with valid credentials, and which mitigation technique could introduce additional challenges? (Select TWO.)",
        "choices": [
            "A: Resulting in 'MFA fatigue' where a user might accept an authentication request out of frustration.",
            "B: Decreasing the overall security of the system by introducing too many failed login attempts.",
            "C: Replacing simple push notifications with out-of-band 2FA mechanisms could increase user inconvenience.",
            "D: Enhancing system performance due to frequent validation of active user accounts."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "2FA/MFA mechanisms"
    },
    {
        "id": "f91c1c98-4ecc-4f57-959b-37ab8a62808c",
        "source": "cs161_textbook",
        "question": "As a web developer, you are tasked with designing a webpage that requires embedding external content. Considering web security best practices and the information provided, select the HTML elements from the list below that could introduce security risks if not properly managed, and those that could be safely used with modern browser security mechanisms in place.",
        "choices": [
            "A: Using `<iframe>` tags to embed external content from a trusted source.",
            "B: Creating links to external sites using `<a>` tags with `href` attributes.",
            "C: Including JavaScript code using `<script>` tags for client-side dynamics.",
            "D: Embedding images with `<img>` tags sourcing from external hosts."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTML Security Risks"
    },
    {
        "id": "073cf188-0a75-4b0f-8509-1385e264888f",
        "source": "owasp_wstg",
        "question": "You are conducting a security audit for a web application and you need to examine the HTTP headers of a particular request to identify potential security misconfigurations. Additionally, you aim to take a full-page screenshot of the application for your report. Which of the following sets of actions would you perform using Google Chrome Dev Tools to accomplish these tasks?",
        "choices": [
            "A: For HTTP headers: Select any URL in the Networking tab, then choose the Headers tab in the lower pane. For screenshot: Press 'Toggle Device Toolbar' or 'ctrl+shift+m', then click the 'kabob' menu and select 'Capture full size screenshot'.",
            "B: For HTTP headers: Go to the Console tab, then use the command 'view.headers()' to inspect headers. For screenshot: Use the 'Screenshot()' function in the Console tab.",
            "C: For HTTP headers: Navigate to the Application tab, find the request under the 'Cookies' section, and review the headers there. For screenshot: Click the 'kabob' menu and select 'Capture node screenshot'.",
            "D: For HTTP headers: Click on the Debugger tab, then select the request from the dropdown in the upper pane. For screenshot: Press 'F12' to open the Dev Tools, then use the 'Print Screen' key."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "HTTP Headers"
    },
    {
        "id": "270a310a-cde5-411d-9c87-8b29f8302035",
        "source": "attck",
        "question": "An adversary has gathered detailed information about a target organization by searching through social media, news sites, and public business records. What is the adversary's most likely next step following this reconnaissance?",
        "choices": [
            "A: Developing custom hardware to infiltrate the organization’s physical premises.",
            "B: Crafting spearphishing emails to gain initial access to the organization’s network.",
            "C: Launching a Distributed Denial of Service (DDoS) attack to disrupt the organization's online services.",
            "D: Creating fake social media profiles to spread disinformation about the organization."
        ],
        "answer": "B",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "spearphishing"
    },
    {
        "id": "3ab86d67-f9eb-40a6-a9e3-fb74f942aed3",
        "source": "attck",
        "question": "In an IaaS cloud environment, an adversary seeks to establish persistence by implanting a backdoored container image. What level of permission is most likely required for the adversary to successfully execute this attack?",
        "choices": [
            "A: Network configuration access to monitor traffic and reroute it to the malicious image.",
            "B: User-level permissions for interacting with image registries and implanting modified images.",
            "C: Database administration privileges to alter data and inject malicious code into images.",
            "D: Root access on the host machine to bypass all security controls and plant backdoors."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Permissions"
    },
    {
        "id": "ddcc58d5-7ff6-4c78-aa49-439b4f711c15",
        "source": "apple_platform_security",
        "question": "A user is considering enabling Advanced Data Protection for their iCloud account. What are the potential outcomes of turning on this feature? Choose all that apply.",
        "choices": [
            "A: The user's trusted devices will initiate the removal of available-after-authentication service keys from Apple data centres.",
            "B: Apple will have the ability to decrypt and access the user's data even after Advanced Data Protection is enabled.",
            "C: Once Advanced Data Protection is enabled, iCloud web servers will no longer have access to the keys required to decrypt and display the user’s data on iCloud.com by default.",
            "D: The user can recover their end-to-end encrypted iCloud data through Apple, even if all recovery mechanisms are lost."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "7bb40181-1ee1-4114-ba28-cffc874fcb95",
        "source": "apple_platform_security",
        "question": "A company's IT security team is reviewing the security protocols used for their macOS and iOS applications' network connections. They are concerned about the use of outdated encryption algorithms and want to improve their security posture. What would be the consequences of continuing to allow deprecated or insecure protocols? (Select all that apply)",
        "choices": [
            "A: Allowing SSL 3 connections could expose the network services to vulnerabilities due to its disallowance in modern Apple operating systems.",
            "B: Using SHA-1 certificates might be permitted for TLS connections if trusted by the user, even on newer versions of iOS and macOS.",
            "C: Persisting with RSA keys shorter than 2048 bits could prevent TLS connections from being established on updated Apple devices.",
            "D: Continuing to use the RC4 symmetric cipher suite could lead to compatibility issues with devices running iOS 10 and macOS 10.12 or later."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "EncryptionProtocols"
    },
    {
        "id": "5f154f3e-89d6-4c08-99d7-9b6a6b8bd7df",
        "source": "apple_platform_security",
        "question": "An incident responder is analyzing the security features of various Apple devices to prepare for potential forensic recovery situations. Considering the information about Apple's security features for different SoC families, select the statements that accurately describe the capabilities and protections provided by these features.",
        "choices": [
            "A: For devices with the A12 SoC, the Secure Enclave Boot ROM locks the passcode seed bit upon entering DFU mode, preventing any operation to change it.",
            "B: The Secure Enclave AES Engine's use of lockable software seed bits to create key hierarchies is discontinued starting with the A10 SoC.",
            "C: Sealed Key Protection (SKP) ensures cryptographic material is unavailable off device and is a feature exclusive to devices with Apple-designed SoCs.",
            "D: When a device with an A10 or later SoC boots into Diagnostics mode, user data is not cryptographically inaccessible as the media key required for file access remains available."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Apple SoC Security"
    },
    {
        "id": "25ac4805-c94f-4998-99c1-1fc035aecf2d",
        "source": "cs161_textbook",
        "question": "Which of the following statements accurately reflect the purpose and vulnerabilities associated with the transport layer protocols TCP and UDP?",
        "choices": [
            "A: TCP guarantees packet delivery in the correct order, while UDP establishes connections between individual processes on machines.",
            "B: UDP guarantees that packets are delivered successfully and in the correct order, while TCP is connectionless and does not provide delivery guarantees.",
            "C: Off-path attackers can easily intercept data by performing a man-in-the-middle (MITM) attack without guessing the sequence number.",
            "D: On-path and MITM attackers can inject data or reset (RST) packets into TCP connections, posing a threat to the transport layer."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "TransportLayerVulnerability"
    },
    {
        "id": "f7732d1e-1a00-415a-a455-9a1fd21c318f",
        "source": "owasp_wstg",
        "question": "A web application uses a session variable 'user_role' to store the role of the authenticated user. This variable is set upon successful login and is checked on subsequent requests to authorize access to sensitive areas of the application. An attacker discovers that the application also sets the 'user_role' variable to 'guest' for users who visit the public forum page without logging in. Considering the concept of Session Variable Overloading, which of the following attacks could the attacker potentially execute?",
        "choices": [
            "A: The attacker could modify the 'user_role' variable on the client-side to escalate their privileges.",
            "B: The attacker could visit the public forum page to set the 'user_role' to 'guest' and then exploit the session variable reuse to access sensitive areas without authentication.",
            "C: The attacker could create multiple accounts to generate concurrent sessions, leading to a denial of service.",
            "D: The attacker could intercept other users' traffic to steal their session cookies and impersonate them."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Session Variable Overloading"
    },
    {
        "id": "4659b684-0441-41ae-ba69-69050a625a98",
        "source": "mozilla_security",
        "question": "A web developer is configuring their server to implement HTTP Strict Transport Security (HSTS) to enhance security. Which of the following parameters should they include in the HSTS header to adhere to the standard?",
        "choices": [
            "A: max-age; includeSubDomains; preload",
            "B: max-time; encrypt; preload",
            "C: max-duration; includeParentDomains; no-redirect",
            "D: max-age; forceHTTPS; autoRenew"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Strict Transport Security (HSTS)"
    },
    {
        "id": "8f25008b-0434-40ca-b89c-6e98303f2556",
        "source": "apple_platform_security",
        "question": "Identify the statements that are incorrect with respect to the security features and protocols of Apple Pay.",
        "choices": [
            "A: The Secure Element on the Apple Watch hosts a specially designed applet to manage Apple Pay and stores Device Account Numbers.",
            "B: The NFC controller ensures that all contactless payment transactions are conducted with a point-of-sale terminal within close proximity to the device.",
            "C: Apple Pay servers store full card numbers and have direct access to the Device Account Numbers within the Secure Element.",
            "D: For in-field contactless payment transactions, payment authorisation details are contained to the local NFC field and not exposed to the Application Processor."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security_Features"
    },
    {
        "id": "c4fb3fcc-6765-45af-b815-0ff01e8b1b3a",
        "source": "windows_security",
        "question": "How does the Windows Hello for Business trust type impact the authentication process of a device in a corporate environment?",
        "choices": [
            "A: It determines whether the device will use a PIN or biometric gesture to unlock the screen before initiating the authentication process.",
            "B: It affects how the device authenticates to on-premises Active Directory, but not how it authenticates to Microsoft Entra ID.",
            "C: It changes the encryption method used when the device's private transport key decrypts the session key received from Microsoft Entra ID.",
            "D: It dictates whether the device will authenticate to Microsoft Entra ID or Active Directory first during the user sign-in process."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Trust Type"
    },
    {
        "id": "b5341e73-f339-4906-b836-62e65c986e7b",
        "source": "cwe",
        "question": "You are reviewing several function implementations in a codebase. For each function, determine whether it safely handles the conversion from signed to unsigned integers and avoids potential vulnerabilities. Select all that apply.",
        "choices": [
            "A: A function that checks for negative return values from subroutines and converts them to error codes before returning as unsigned integers.",
            "B: A function that accepts signed integers for arithmetic operations without validating the range before casting to unsigned types for further processing.",
            "C: A function that uses a signed integer to determine the number of elements to allocate for an array, then casts it to size_t for the allocation without range checking.",
            "D: A function that explicitly casts signed integers to unsigned and performs boundary checks before using them in potentially unsafe operations such as memory allocation."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Conversion Safety"
    },
    {
        "id": "04dbcba9-f202-43d2-8556-e37e256a0d2e",
        "source": "cwe",
        "question": "Why should all registers holding security-critical information be set to a specific value on reset, and what are the potential drawbacks of this approach?",
        "choices": [
            "A: To ensure a deterministic state and prevent attackers from exploiting indeterminate states; however, it may lead to predictability that can be leveraged by attackers.",
            "B: To reduce power consumption on reset; however, it may increase the overall complexity of the system.",
            "C: To speed up the system initialization process; however, it could lead to synchronization issues across different components.",
            "D: To comply with industry coding standards; however, it may not be necessary for non-security-critical registers."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Security-Critical Initialization"
    },
    {
        "id": "9b292455-3bc7-4779-859f-cb66f4ada24b",
        "source": "owasp_wstg",
        "question": "When developing a web application that incorporates WebSockets for real-time data exchange, you are considering the security implications of this technology. Which of the following practices should you adopt to enhance the security of the WebSocket implementation?",
        "choices": [
            "A: Verify the Origin header in the initial WebSocket handshake to prevent unauthorized cross-domain communication.",
            "B: Prefer the ws:// URI scheme for all WebSocket communications to enforce consistency in connection protocols.",
            "C: Avoid data sanitization of incoming messages since WebSockets provide built-in encoding mechanisms.",
            "D: Utilize the wss:// URI scheme when sensitive data is being transmitted to ensure the data is encrypted."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "WebSocket Security"
    },
    {
        "id": "7c11e198-9626-4f9c-ae86-7a45780cb2aa",
        "source": "cwe",
        "question": "Consider a scenario where an application decodes user input before validating it. What are the potential advantages and disadvantages of this approach?",
        "choices": [
            "A: Advantage: It allows the application to process encoded characters correctly. Disadvantage: It might decode input twice, leading to bypassing allowlist validation schemes.",
            "B: Advantage: Double decoding increases security by adding an extra layer of validation. Disadvantage: It may be computationally expensive.",
            "C: Advantage: It ensures that inputs are in a consistent internal format before validation. Disadvantage: It could allow dangerous inputs after they have been checked.",
            "D: Advantage: It simplifies the validation process by handling all inputs uniformly. Disadvantage: It may prevent the application from recognizing valid inputs that require encoding."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InputDecoding"
    },
    {
        "id": "e036b2d8-6082-41b8-8798-796b370a9c35",
        "source": "attck",
        "question": "An analyst observes a pattern of suspicious email activities in a corporate environment, with numerous accounts receiving messages from an unknown sender, some of which contain links to uncategorized websites. What detection methods should the analyst prioritize to identify and investigate these phishing attempts?",
        "choices": [
            "A: Application log monitoring for unusual sender patterns and URL inspection within emails.",
            "B: Real-time analysis of CPU and GPU loads to identify potential unauthorized computational activities.",
            "C: Deployment of an Intrusion Detection System (IDS) to monitor for network breaches.",
            "D: Reviewing code repositories for unauthorized commits that could indicate a breach."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Application Log Monitoring"
    },
    {
        "id": "2876ad88-0e1d-4826-9f51-e9448151bb03",
        "source": "attck",
        "question": "What are the potential benefits and drawbacks for an adversary in the process of gathering victim organization information such as business operations and employee roles?",
        "choices": [
            "A: Benefit: Tailoring of spearphishing efforts; Drawback: Increased likelihood of detection due to suspicious activities.",
            "B: Benefit: Immediate access to sensitive financial data; Drawback: Potential legal repercussions if caught.",
            "C: Benefit: Identification of physical security weaknesses; Drawback: Resource-intensive process with limited immediate payoff.",
            "D: Benefit: Revealing opportunities for other reconnaissance forms; Drawback: Mitigation is challenging due to activities occurring outside enterprise defenses."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Information Gathering"
    },
    {
        "id": "b97a932b-2e87-4d97-bdf3-76eca44a5223",
        "source": "owasp_wstg",
        "question": "In a security assessment of a GraphQL service, you utilize an introspection query to understand the schema and look for potential security issues. Which of the following would you typically NOT expect to find in the introspection query result?",
        "choices": [
            "A: A list of supported queries such as Query, Mutation, and Subscription types.",
            "B: Documentation of data types, including ENUM and OBJECT types, along with descriptions and fields.",
            "C: User session information, such as authentication tokens and session IDs.",
            "D: A list of directives, including their names, descriptions, and applicable arguments."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "GraphQL Schema"
    },
    {
        "id": "299c70fa-fcc9-41d6-8331-9b76fa0fb9b8",
        "source": "attck",
        "question": "In the context of malware analysis, why would an adversary program their malware to check the system's time or time zone on the infected host? (Choose two.)",
        "choices": [
            "A: To avoid triggering alerts from time-based intrusion detection systems.",
            "B: To bypass network time protocol (NTP) security measures.",
            "C: To determine if the malware is running in a sandbox by detecting accelerated time.",
            "D: To ensure malware activation during certain hours when the system is likely to be in use."
        ],
        "answer": "CD",
        "topics": [
            "PenTest",
            "ApplicationSecurity"
        ],
        "keyword": "Malware Sandbox Evasion"
    },
    {
        "id": "2ef39110-a42e-4c2e-b29d-dc07f9cd42e1",
        "source": "cwe",
        "question": "An application has recently been updated, and during the process, a user was inadvertently assigned to an administrative group instead of their standard user group. This change went unnoticed during the audit. Which of the following consequences might occur due to this misplacement?",
        "choices": [
            "A: The user may be unable to perform any actions, leading to a denial of service for that user.",
            "B: The user may be able to access resources or perform actions that are outside of their intended permissions, potentially bypassing security policies.",
            "C: The user's account may automatically be disabled due to inconsistent group membership, ensuring security.",
            "D: The application's performance might degrade due to the increased number of users in the administrative group."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "GroupAssignment"
    },
    {
        "id": "4a96d754-f396-4580-91d9-8285f5d14489",
        "source": "attck",
        "question": "An organization is reviewing its endpoint security measures to prevent potential attacks involving process injection, which has been observed in recent threat reports. As a security consultant, you are tasked to recommend effective mitigation strategies. Which of the following options should be included in your recommendations to enhance the organization's defenses against such attacks?",
        "choices": [
            "A: Implementing Attack Surface Reduction (ASR) rules to prevent office applications from code injection on Windows 10 systems.",
            "B: Allowing unrestricted use of the ptrace system call on Linux systems to enable legitimate debugging and monitoring activities.",
            "C: Monitoring for Windows API calls like 'CreateRemoteThread' and 'VirtualAllocEx/WriteProcessMemory' without context can be directly useful for defense.",
            "D: Deploying security kernel modules such as SELinux, grsecurity, and AppArmor to provide advanced access control and process restrictions."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Process Injection"
    },
    {
        "id": "d263a7ca-ebbb-4876-a1ed-d7ae38d8a75d",
        "source": "android_sec_doc",
        "question": "A mobile device manufacturer is preparing to release a new Android device. As a security consultant, you've been asked to ensure that the device utilizes robust security features to protect against unauthorized code execution and persistent exploits. Considering the evolution of Android's Verified Boot feature, which of the following statements accurately describe the improvements made to Verified Boot since Android 4.4, and what should be included to align with best practices?",
        "choices": [
            "A: Verified Boot 1 introduced with Android 4.4 included dm-verity and enforced strict boot integrity checks to prevent compromised devices from booting.",
            "B: Since Android 7.0, devices are warned about corruption but can still boot, whereas Android 8.0 introduced Android Verified Boot (AVB) which merely standardized partition formats without additional security features.",
            "C: Android 7.0 introduced forward error correction to improve reliability against non-malicious data corruption, and strict enforcement of Verified Boot was established.",
            "D: Android Verified Boot (AVB) introduced in Android 8.0 is a reference implementation that works with Project Treble and includes enhanced rollback protection features to prevent downgrading to vulnerable OS versions."
        ],
        "answer": "CD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Verified Boot"
    },
    {
        "id": "77bb9129-cc5f-4e9c-8167-5e6cca43ff04",
        "source": "windows_security",
        "question": "A large organization is implementing virtual smart cards for secure authentication and is evaluating different administrator key management strategies. Which of the following key management strategies would be most secure for this organization?",
        "choices": [
            "A: Using deterministic administrator keys derived from user IDs and a secret for regeneration as needed.",
            "B: Employing a central repository of static administrator keys for all cards, ensuring ease of access for management.",
            "C: Assigning random administrator keys for each card and storing them locally on user devices.",
            "D: Generating random administrator keys and storing them in a central location, independently for each card."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Virtual Smart Cards"
    },
    {
        "id": "13546507-f32f-4965-9ae7-2e55e10c0195",
        "source": "owasp_mastg",
        "question": "In C/C++ development for mobile applications, which of the following statements is a counterargument to the practice of duplicating include statements for the same header file?",
        "choices": [
            "A: Duplicating include statements can improve code readability by making dependencies more explicit.",
            "B: Duplicating include statements ensures that if one include directive fails, the other serves as a backup.",
            "C: Duplicating include statements can lead to code bloat and potential compilation issues due to repeated inclusions.",
            "D: Duplicating include statements helps in faster compilation as the compiler can cache the header file more efficiently."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Header File Inclusion"
    },
    {
        "id": "6cd7dbac-86c9-4082-9897-1cd7f747bae8",
        "source": "owasp_wstg",
        "question": "What are the advantages of having access to the application's source code during a security review?",
        "choices": [
            "A: It allows for a more thorough review by enabling the identification of vulnerabilities that may be missed during black-box testing.",
            "B: Source code access is essential for performing any kind of security testing and without it, security testing cannot be conducted.",
            "C: Access to source code enables the use of automated tools to perform the entire security review process without human intervention.",
            "D: Having source code is only necessary for compliance with certain regulations, and does not contribute to the security review process."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Black-box testing"
    },
    {
        "id": "8c147d57-09da-466e-bf03-9cc98089dc4b",
        "source": "owasp_wstg",
        "question": "An organization is updating its password policy and has proposed several changes. Which of the following proposed changes should be contested based on the best practices for password policy?",
        "choices": [
            "A: The password must include characters from different character sets, including uppercase and lowercase letters, digits, and special symbols.",
            "B: The organization decides to remove the requirement of regular password expiry.",
            "C: A user is permitted to use their username as part of their password if it is combined with sufficient special characters.",
            "D: The system will now prevent the use of the user's personal information, such as their first or last name, in their password."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Authentication Controls"
    },
    {
        "id": "71ed401d-afa9-47c1-a71e-d9a742f1d832",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing system logs to identify potential unauthorized persistence mechanisms. Which detection method would be the most effective in identifying modifications that allow a program to automatically execute during system boot or logon?",
        "choices": [
            "A: Monitoring network traffic for anomalies that could indicate command and control activities associated with persistent threats.",
            "B: Monitoring for additions or modifications to Windows Registry keys that could be used to trigger autostart execution.",
            "C: Analyzing email attachments and URLs for malicious content that could be part of an initial infection vector.",
            "D: Reviewing user account creation logs to find unauthorized accounts that may be used for persistent access."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Windows Registry"
    },
    {
        "id": "d150584b-1899-4a9d-b73c-e81544bae767",
        "source": "attck",
        "question": "An adversary seeks to maintain persistence on a compromised Windows system without creating new files or registry modifications and aims to bypass host firewalls. Which of the following methods would allow the adversary to achieve these goals while leveraging Windows system services?",
        "choices": [
            "A: Creating scheduled tasks using the Windows Task Scheduler service.",
            "B: Abusing BITS jobs to execute code and manage file transfers in the background.",
            "C: Exploiting the Windows Update service to download and execute malicious payloads.",
            "D: Utilizing the Remote Desktop Protocol (RDP) for persistent remote access."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "BITS jobs"
    },
    {
        "id": "a3090369-00c5-41a3-a120-d2e8efbc99ed",
        "source": "owasp_wstg",
        "question": "In the context of web application security, when designing a user registration process, one might believe that adding more fields for user information inherently increases security. Which of the following options provides the best counterargument to this belief?",
        "choices": [
            "A: Additional information fields can create a false sense of security if the information provided is not properly verified and could lead to an increased risk of identity theft.",
            "B: The more information fields there are, the more secure the registration process is because it makes it harder for attackers to guess the required information.",
            "C: Requiring users to provide more information can deter them from registering, thus reducing the overall number of potential attackers who have access.",
            "D: A higher number of information fields can improve the aesthetics of the registration page, leading to a better user experience and increased user trust."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Identity Verification"
    },
    {
        "id": "23d92a83-8f6e-4200-9e7a-f26059825e04",
        "source": "apple_platform_security",
        "question": "Which of the following statements correctly describe the security features and their evolution in Apple SoCs?",
        "choices": [
            "A: The A9 SoC introduced EEPROM with DPA protection as a secure storage service for the Secure Enclave.",
            "B: The S3 SoC featured a Secure Storage Component gen 2 with DPA protection and lockable seed bits for secure storage services.",
            "C: A13 SoCs released after autumn 2020 come with a 2nd-generation Secure Storage Component and include OS-bound keys and a Boot Monitor.",
            "D: The T2 SoC uses a Secure Neural Engine for handling Face ID data encryption and access control."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SoC Security"
    },
    {
        "id": "56a9b6d1-dda9-4c22-a9c2-5e58f2bc56a0",
        "source": "cs161_textbook",
        "question": "In the context of Message Authentication Codes (MACs), why is it necessary for MACs to be deterministic? (Select all that apply.)",
        "choices": [
            "A: Determinism ensures that the MAC value is unique for each different message, preventing replay attacks.",
            "B: A deterministic MAC ensures that the same message and key will always produce the same MAC value, necessary for the receiver to verify the message's integrity.",
            "C: Determinism is required to make the MAC computation process faster and more efficient.",
            "D: The deterministic nature of MACs allows for the use of multiple keys for the same message to produce different MAC values for added security."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "Determinism"
    },
    {
        "id": "e0e3e2a0-fde5-4183-bccd-3eec28d0fede",
        "source": "mozilla_security",
        "question": "A security breach occurred when unauthorized cross-origin requests were made to retrieve sensitive data from a web application. As a security engineer, you are tasked with investigating the breach. Which of the following is the most likely cause of the breach?",
        "choices": [
            "A: The CORS policy was too permissive, allowing any origin to access the resources.",
            "B: The crossdomain.xml file was not present on the server, leading to unrestricted access.",
            "C: A clientaccesspolicy.xml file was configured incorrectly, granting access to an unauthorized origin.",
            "D: The web application's same-origin policy was too restrictive, causing legitimate users to seek alternative methods to access resources, leading to the breach."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CORS policy"
    },
    {
        "id": "eba2a157-edf2-4bbc-b4c5-dee7b11aa440",
        "source": "android_sec_doc",
        "question": "A user, after initially enrolling a PIN with Gatekeeper, desires to change their credential. Considering the Android authentication system, which of the following statements correctly describe the impact of various actions taken during the credential change process?",
        "choices": [
            "A: If the user provides their existing credential successfully, a new user SID is generated and cryptographically bound to the new credential.",
            "B: Without presenting the existing credential, the new credential will inherit the old user SID, but access to keys under the old SID will still be permanently lost.",
            "C: If the existing credential is verified successfully, the user SID associated with the existing credential is transferred to the new credential.",
            "D: In case of an untrusted enroll, the new credential receives a newly generated user SID, and keys associated with the old SID become permanently inaccessible to the user."
        ],
        "answer": "CD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "User SID"
    },
    {
        "id": "c721b246-3924-448a-8ee8-6757af082657",
        "source": "cs161_textbook",
        "question": "In the DNSSEC query process, each server returns various types of records. Which of the following statements accurately reflect the purpose of the records returned during the DNSSEC query walkthrough for the domain 'eecs.berkeley.edu'?",
        "choices": [
            "A: The DNSKEY record contains the public ZSK and KSK, which are used to verify signatures on other records.",
            "B: The RRSIG record is associated with the DNSKEY record and provides a signature to verify the integrity of the DNSKEY records.",
            "C: The DS record contains a hash of the KSK of the next-level name server, which is signed by the current name server's ZSK.",
            "D: The A record in the final response contains the IP address of 'eecs.berkeley.edu', and the associated RRSIG record is used to verify its authenticity."
        ],
        "answer": "ABCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNSSEC"
    },
    {
        "id": "a4af6379-7f52-4fc4-ae00-2c0eb7bd0d9d",
        "source": "owasp_wstg",
        "question": "When performing a penetration test on a web application that interacts with a Microsoft Access database, which of the following statements are true regarding SQL injection vulnerabilities and their mitigation?",
        "choices": [
            "A: SQL injection vulnerabilities in Microsoft Access can be mitigated by using parameterized queries that prevent the execution of arbitrary SQL code.",
            "B: To prevent SQL injection attacks, Microsoft Access databases should be configured to disable all SQL functionality, rendering them immune to such vulnerabilities.",
            "C: SQL injection vulnerabilities are only a concern for web applications that use large-scale databases like MySQL or MSSQL, not Microsoft Access.",
            "D: Microsoft Access is immune to SQL injection vulnerabilities due to its file-based architecture."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "SQL injection"
    },
    {
        "id": "7a1f4cf2-b8fb-45fe-9799-4bc3a7991079",
        "source": "windows_security",
        "question": "In a Windows environment, a security event logs the change of permissions on an object, which could indicate potential security risks. What could be possible outcomes of this event, and which of the following is NOT a valid concern?",
        "choices": [
            "A: Increased security risks due to potential elevation of privilege.",
            "B: Audit failure if the new permissions violate compliance regulations.",
            "C: Improved system performance by streamlining access controls.",
            "D: Unauthorized data access if permissions are overly permissive."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Event 4670(S)"
    },
    {
        "id": "713b84c3-e45d-493b-995c-94760908691b",
        "source": "apple_platform_security",
        "question": "What are the primary security benefits of the Secure Enclave when it comes to processing biometric data from Face ID and Touch ID sensors? Select all that apply.",
        "choices": [
            "A: It allows for remote verification of biometric data, enhancing user convenience.",
            "B: It keeps user biometric data private and secure by processing the data locally.",
            "C: It enables the use of longer and more complex passcodes and passwords.",
            "D: It stores user biometric data on external servers for backup and recovery purposes."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "BiometricSecurity"
    },
    {
        "id": "3501acb4-7f8c-4133-966e-271e1f00611a",
        "source": "cs161_textbook",
        "question": "Which of the following are characteristics of a secure cryptographic hash function based on the provided description? (Select all that apply)",
        "choices": [
            "A: A secure hash function is keyed and requires a secret key to compute the hash of a message.",
            "B: If the same message is hashed twice using the same hash function, the result will be two identical hash values.",
            "C: Changing even a single bit in the message will result in an unpredictable change in the hash value.",
            "D: A secure hash function will always produce a variable-length output to ensure security."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CryptographicHashFunction"
    },
    {
        "id": "75dac808-c889-42bd-b24f-f2cf65989944",
        "source": "attck",
        "question": "An adversary has forged web cookies to access a web application without valid user credentials. To mitigate this threat, the organization's cybersecurity team should take which of the following actions? (Select TWO.)",
        "choices": [
            "A: Configure the browsers/applications to delete persistent web credentials like cookies regularly.",
            "B: Increase the session timeout intervals for web applications to reduce the frequency of user logins.",
            "C: Perform an audit of all access lists and permissions granted to access web applications and services.",
            "D: Allow unrestricted API calls such as `sts:GetFederationToken` to monitor for unusual patterns of use."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Web Cookie"
    },
    {
        "id": "ef70a02d-edd6-4da4-b8da-1644087fcaf4",
        "source": "owasp_wstg",
        "question": "In evaluating the security of a password change mechanism in a web application, which of the following factors would decrease the likelihood of unauthorized account access? (Select TWO.)",
        "choices": [
            "A: Using personal information, such as birthdate or address, as part of the password reset verification process.",
            "B: Mandating that password reset requests can only be initiated from previously recognized devices or IP addresses.",
            "C: Allowing unlimited attempts to answer security questions during a password reset process.",
            "D: Requiring the input of a one-time code sent via SMS along with the user's username."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Two-Factor Authentication"
    },
    {
        "id": "59e85d9a-477e-4eb6-b184-e6f73408e807",
        "source": "attck",
        "question": "An adversary has compromised a network and is now considering using a legitimate external web service for command and control (C2) operations to remain undetected. As a penetration tester, you are evaluating which of the following web services could offer the adversary an added level of protection due to SSL/TLS encryption and operational resiliency. Which service would be the most appropriate for the adversary's needs?",
        "choices": [
            "A: A local file-sharing server within the company's intranet.",
            "B: A publicly accessible web forum without SSL/TLS encryption.",
            "C: Social media platforms that are commonly used within the network.",
            "D: An outdated web service that is not commonly used and lacks encryption."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command and Control (C2)"
    },
    {
        "id": "42183b42-d996-42d4-b8b7-f753bc7f635b",
        "source": "android_sec_doc",
        "question": "An Android application with the type `untrusted_app` needs to perform read and write operations on a file labeled `app_data_file`. Based on SELinux policy rules in Android, which of the following rules would correctly allow the required operations while adhering to the principle of least privilege?",
        "choices": [
            "A: allow untrusted_app app_data_file:file { execute };",
            "B: allow untrusted_app app_data_file:file { read write };",
            "C: allow untrusted_app app_data_file:dir { read write };",
            "D: allow untrusted_app app_data_file:file rw_file_perms;"
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "225db329-bca6-4617-9304-a47703fba814",
        "source": "owasp_wstg",
        "question": "A web application development team is conducting a threat modeling session. One of the identified risks is a potential Man-in-the-Middle (MiTM) attack that could compromise the integrity and confidentiality of data in transit between the client and the server. To mitigate this threat, which of the following security requirements should be prioritized?",
        "choices": [
            "A: Implement account lockout mechanisms after a certain number of failed login attempts.",
            "B: Encrypt authentication data in transit using SSL/TLS to prevent eavesdropping and tampering.",
            "C: Validate input fields rigorously to prevent SQL injection attacks.",
            "D: Ensure passwords are stored using non-reversible hash functions with a unique salt."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Man-in-the-Middle (MiTM) attack"
    },
    {
        "id": "4897ec33-27af-48e4-b12d-f9d8116c2f14",
        "source": "android_sec_doc",
        "question": "While customizing SELinux policies for an Android device, you encounter the following denial:\n\navc: denied { open } for pid=1003 comm=\"mediaserver\" path=\"/dev/kgsl-3d0\" dev=\"tmpfs\" scontext=u:r:mediaserver:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1\n\nTo address this denial appropriately, which of the following actions should you take?",
        "choices": [
            "A: Assign a more specific label to '/dev/kgsl-3d0', such as 'gpu_device', and ensure the mediaserver has the necessary permissions to access the 'gpu_device'.",
            "B: Create a new allow rule in the SELinux policy that grants the mediaserver domain access to the 'device' type for all character files in '/dev'.",
            "C: Use audit2allow to generate a policy that allows mediaserver to open any file with the 'device' context, and implement this policy.",
            "D: Ignore the denial as it occurs in permissive mode and focus on other denials that may appear when the device is in enforcing mode."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "SELinux File Labeling"
    },
    {
        "id": "f9381558-28d9-469f-92de-0378827e2d58",
        "source": "cwe",
        "question": "You are reviewing the design of a new software module that includes exception handling. Which of the following design choices would NOT contribute to the weakness described as 'Improper Cleanup on Thrown Exception'?",
        "choices": [
            "A: Designing the module to catch all exceptions and log an error message without any resource cleanup.",
            "B: Implementing a finally block that ensures the cleanup code is executed regardless of whether an exception occurred.",
            "C: Utilizing a resource management library that automatically handles resource cleanup upon exceptions.",
            "D: Wrapping each critical section of code with individual try-catch blocks without cleanup code."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "DesignChoices"
    },
    {
        "id": "14bcba9a-38d5-4050-8d32-a076998c6a67",
        "source": "owasp_wstg",
        "question": "You are assessing the security of a web application's authentication process. Which of the following methods represents a valid approach to test for vulnerabilities that could allow an attacker to bypass the authentication schema?",
        "choices": [
            "A: Attempting to access a protected page directly through the address bar to see if the credentials are checked.",
            "B: Checking if the web application uses a fixed value parameter to verify a successful login and modifying it.",
            "C: Analyzing session ID generation for predictability to potentially find a valid session ID.",
            "D: Ensuring the application uses HTTPS for all pages, including static content, to prevent authentication bypass."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Authentication Bypass"
    },
    {
        "id": "9f2642f4-5696-4da5-925a-c36d84855bb6",
        "source": "cs161_textbook",
        "question": "Bob has received a message with a signature he needs to verify. He knows that if the message and signature were generated using a matching pair of keys, the verification should return true. Which algorithmic function should he employ to determine the validity of the signature?",
        "choices": [
            "A: He should use the signing algorithm with his own private key to check if he can generate the same signature.",
            "B: He should use the key generation algorithm to see if it can produce a matching pair of keys for the received message and signature.",
            "C: He should use the verification algorithm with the sender’s public key to determine if the signature is valid for the message.",
            "D: He should use a hashing function on the message to compare it with the received signature."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "VerificationProcess"
    },
    {
        "id": "032870af-52ef-4fb3-88c5-e25551dcdaae",
        "source": "cwe",
        "question": "An application is deployed in multiple environments: development, testing, and production. Each environment requires different database credentials, API keys, and service URIs. The developer has implemented a configuration file. Evaluate the following configurations and select the instances that would lead to the weakness described as using an invariant value in dynamically changing contexts.",
        "choices": [
            "A: The configuration file includes a section for each environment, with environment-specific values for each setting.",
            "B: Database credentials are hardcoded in the application source code and are the same for all environments.",
            "C: API keys are loaded from environment variables that are set differently on each deployment environment.",
            "D: A service URI defined as 'http://localhost/service' is used for service calls, regardless of the deployment environment."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InvariantValue"
    },
    {
        "id": "f7ce4962-608a-4cdd-adb1-602a92534135",
        "source": "apple_platform_security",
        "question": "An iOS developer is setting up a HomeKit-enabled application that will communicate securely with HomeKit accessories and synchronize data across iOS, iPadOS, and macOS devices. Which of the following statements are accurate regarding the security features and processes involved in the communication and data synchronization for HomeKit-enabled devices?",
        "choices": [
            "A: HomeKit uses Ed25519 public-private key pairs for identity and security, and the keys are stored in the keychain.",
            "B: To establish a connection, HomeKit accessories use Secure Remote Password protocol with a manufacturer-provided four-digit code for key exchange.",
            "C: HomeKit data synchronization between devices is facilitated by iCloud where the data is encrypted using user’s HomeKit identity and remains opaque during transmission.",
            "D: For Siri-enabled HomeKit accessories, audio streams for Siri requests are encrypted and no user data is stored on the accessory."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "HomeKit"
    },
    {
        "id": "7dd5e078-47cb-4897-8480-fae7f463c3d1",
        "source": "apple_platform_security",
        "question": "An Intel-based Mac without an Apple T2 Security Chip lacks the secure boot feature. To protect the integrity of the boot process, which of the following security mechanisms should be enabled by a user or MDM administrator?",
        "choices": [
            "A: Enable FileVault to encrypt the storage and prevent overwriting the booter through Target Disk Mode.",
            "B: Set a Firmware Password to restrict alternative boot modes and prevent booting from alternative media.",
            "C: Enable the secure boot feature in UEFI firmware settings.",
            "D: Activate System Integrity Protection (SIP) to safeguard the booter and kernel."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "BootIntegrity"
    },
    {
        "id": "b9cf6635-81c2-42fa-81c6-1f1fa65abf66",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security, why is it challenging to include rootkit-like defensive mechanisms, similar to those found in Windows software, in mobile applications?",
        "choices": [
            "A: The mobile industry does not allow for any defensive mechanisms to be implemented due to privacy concerns.",
            "B: Mobile operating systems are inherently secure and do not require additional defensive mechanisms.",
            "C: Mobile apps are sandboxed and deployed in a manner that makes implementing complex rootkit-like defenses unfeasible.",
            "D: Mobile devices lack the necessary processing power to handle the additional load from rootkit-like defensive mechanisms."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Rootkit-like defensive mechanisms"
    },
    {
        "id": "94c13d6d-3918-4e23-afe9-c60e6a04acaf",
        "source": "owasp_mastg",
        "question": "A mobile app security tester is examining an iOS application that claims to protect user privacy while accessing protected resources. The tester notes that the app includes 'UIBackgroundModes' with 'bluetooth-peripheral' and 'bluetooth-central' in the 'Info.plist' file. Why might the tester still be concerned about the app's access to Bluetooth peripherals?",
        "choices": [
            "A: The 'UIBackgroundModes' values alone do not prompt the user for permission to access Bluetooth peripherals.",
            "B: The app may crash on devices that do not support Bluetooth Low Energy (BLE) due to the 'UIBackgroundModes' configuration.",
            "C: Including 'bluetooth-peripheral' and 'bluetooth-central' in 'UIBackgroundModes' overrides the need for 'UIRequiredDeviceCapabilities'.",
            "D: The 'UIBackgroundModes' settings are likely to be ignored by the system since they are not part of 'UIRequiredDeviceCapabilities'."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "UIBackgroundModes"
    },
    {
        "id": "6a7c1834-a597-4410-aa9b-798f0992963f",
        "source": "android_sec_doc",
        "question": "When designing the hash tree for dm-verity, which of the following steps correctly outlines the process of constructing the hash tree for a system image?",
        "choices": [
            "A: Choose a random salt, unsparse the system image into 2k blocks, hash each block with SHA256, concatenate hashes, pad to 2k boundary, and repeat until a single hash remains.",
            "B: Choose a fixed salt, divide the system image into 4k blocks, hash each block with SHA1, concatenate hashes, pad to 4k boundary, and repeat until a single hash remains.",
            "C: Choose a random salt, divide the system image into 4k blocks, hash each block with SHA256, concatenate hashes, pad to 4k boundary, and repeat until a single hash remains.",
            "D: Choose a random salt, compress the system image into 8k blocks, hash each block with SHA512, concatenate hashes, pad to 8k boundary, and repeat until a single hash remains."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SHA256"
    },
    {
        "id": "e9c21b19-de0a-4de6-a19b-5a346346cc6e",
        "source": "android_sec_doc",
        "question": "A mobile application development team is working on a new Android app that will handle sensitive user data. The application needs to be executed in an environment where it has permissions to manage multiple user PII and maintain system integrity. Based on the definitions provided by Android's security team, which security context is most suitable for the application to run?",
        "choices": [
            "A: Constrained context",
            "B: Unprivileged context",
            "C: Privileged context",
            "D: Trusted Execution Environment (TEE)"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Security Context"
    },
    {
        "id": "265c7bfa-e4fc-4da2-9c01-5e7f9d4b58da",
        "source": "apple_platform_security",
        "question": "When designing a secure developer kit, which of the following features should be included to enhance its security? Select all that apply.",
        "choices": [
            "A: Sandbox environments for testing code execution in isolated instances.",
            "B: Hard-coded administrative credentials for ease of kit setup and deployment.",
            "C: Automated vulnerability scanning tools integrated into the development environment.",
            "D: Documentation with security best practices and guidelines."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "DeveloperKitSecurity"
    },
    {
        "id": "84e5ea5c-27b3-47fa-a811-c4007d7f6066",
        "source": "cwe",
        "question": "A developer is tasked with creating a web page that accepts user input for a comments section. Which of the following code snippets correctly neutralizes user input to prevent server-side include (SSI) injection vulnerabilities?",
        "choices": [
            "A: Response.Write(\"<!--#echo var='\" + Request.QueryString[\"userinput\"] + \"' -->\");",
            "B: Response.Write(Server.HtmlEncode(Request.QueryString[\"userinput\"]));",
            "C: Response.Write(\"<div>\" + Request.QueryString[\"userinput\"] + \"</div>\");",
            "D: Response.Write(\"<!--#include file='\" + Request.QueryString[\"userinput\"] + \"' -->\");"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "SSI_Injection"
    },
    {
        "id": "be499028-1453-403b-b685-4ae3ed291cbb",
        "source": "mozilla_security",
        "question": "A web development team is planning to implement a Content Security Policy (CSP) to enhance their website's security. They are considering various tools and directives to prevent XSS attacks and clickjacking. Which of the following would be the most effective combination to achieve their goals?",
        "choices": [
            "A: Adopting a strict CSP with a whitelist of allowed sources and using the Google CSP Evaluator to review it.",
            "B: Using the 'frame-ancestors' directive exclusively without a CSP to prevent clickjacking.",
            "C: Implementing only CSP Level 1 directives, as they are sufficient to prevent all framing and XSS attacks.",
            "D: Relying on 'Content-Security-Policy-Report-Only' header for immediate blocking of all suspicious activities."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Content Security Policy"
    },
    {
        "id": "ba58e416-aca3-4f3b-a5a0-a2bc97ea0631",
        "source": "owasp_wstg",
        "question": "A penetration tester is evaluating a web application for security vulnerabilities and suspects that the application may be prone to SSI injection. The tester has identified that the application is running on a server that supports SSI directives and has found potential user input vectors. To confirm the vulnerability, which of the following techniques should the tester use to determine if the SSI injection is exploitable?",
        "choices": [
            "A: Injecting SSI directives as user input to check if the server executes the directive.",
            "B: Scanning the application with an antivirus to detect the presence of SSI directives.",
            "C: Encrypting the user input to see if the application decrypts it and executes SSI directives.",
            "D: Performing a network sniffing attack to intercept SSI directives in transit."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "SSI Injection"
    },
    {
        "id": "295e5999-8a43-4aab-b6d9-1656e51ecaa7",
        "source": "owasp_wstg",
        "question": "A developer is creating a web application that requires the storage of sensitive user data. Which of the following is a secure practice for storing this data?",
        "choices": [
            "A: Utilizing Local Storage to store sensitive data with strong encryption.",
            "B: Storing sensitive data in Session Storage for the duration of the user's session.",
            "C: Keeping sensitive data on the server-side, in a secured manner following best practices.",
            "D: Saving sensitive data in Web SQL databases, ensuring access controls are in place."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Client-side storage"
    },
    {
        "id": "3a5ee894-ad28-47b4-a2cc-4d4c4962010b",
        "source": "cwe",
        "question": "A developer is creating a web application that accepts file uploads from users. To mitigate the risk of improper handling of alternate encoding vulnerabilities, which of the following input validation strategies should the developer implement? (Select all that apply)",
        "choices": [
            "A: Use a list of acceptable file types that strictly conform to specifications and reject any file that does not.",
            "B: Decode and canonicalize inputs to the application's current internal representation before validation.",
            "C: Only allow file names that contain alphanumeric characters, regardless of the file's actual content or type.",
            "D: Specify an output encoding that the downstream component can handle, such as UTF-8, to prevent injection attacks."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "bdc6d9c9-02bf-4560-bbff-18e41f9ea2fe",
        "source": "owasp_wstg",
        "question": "You are tasked with monitoring incoming and outgoing HTTP requests to a web server to identify any suspicious activities. Your goal is to achieve this without making any changes to the browser proxy settings or client-side applications, to simulate a production environment. Which of the following tools would you utilize to accomplish this task?",
        "choices": [
            "A: Fiddler",
            "B: TCPProxy",
            "C: Antivirus Software",
            "D: Content Delivery Network (CDN)"
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "HTTP monitoring tools"
    },
    {
        "id": "5fc115a4-3aa3-4269-84de-16980373f5a1",
        "source": "owasp_wstg",
        "question": "Considering the behavior of XSS filters in browsers such as IE8 and Chrome 4.0, an attacker aims to disable frame busting scripts by tricking the filters into believing that the frame busting code is part of an XSS attack. Which of the following techniques could an attacker use to achieve this goal?",
        "choices": [
            "A: Injecting a script tag into a request parameter that mimics the start of the frame busting script.",
            "B: Overwriting the `document.domain` property to match the attacker's domain.",
            "C: Adding a Content-Security-Policy header with an 'unsafe-inline' directive.",
            "D: Using the Strict-Transport-Security header to enforce secure connections."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "XSS Filter Evasion"
    },
    {
        "id": "2e5dcce8-94fc-4524-a0eb-a69787b77cfc",
        "source": "attck",
        "question": "A security team is tasked with improving the monitoring of their cloud compute infrastructure to detect potential adversarial modifications. Which of the following strategies would be MOST effective in identifying unauthorized modifications, such as the creation, deletion, or alteration of compute instances, snapshots, and configurations?",
        "choices": [
            "A: Monitor for quota increases across all regions, especially multiple increases in a short period of time or in unused regions.",
            "B: Routinely check the cloud service provider's website for new security features and updates.",
            "C: Implement a strict policy that prevents the creation of any new cloud instances or snapshots.",
            "D: Only allow cloud compute modifications during a predetermined maintenance window."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Service Metadata"
    },
    {
        "id": "e36944c4-14d3-4df5-97b1-24709850b445",
        "source": "attck",
        "question": "A cybersecurity analyst is tasked with finding a tool that is capable of searching for files with specific patterns across a network, but which of the following tools does NOT offer this capability?",
        "choices": [
            "A: Darkhotel",
            "B: Clop",
            "C: Elise",
            "D: Epic"
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "System Enumeration"
    },
    {
        "id": "a45a8d69-6b2a-4760-a15f-7c0825b9c97e",
        "source": "cs161_textbook",
        "question": "Why does the esp register increment after executing the pop instruction in x86 assembly?",
        "choices": [
            "A: To allocate additional space for future push operations.",
            "B: To deallocate space by moving esp past the popped value, effectively removing it from the stack.",
            "C: To prepare the stack for a function call by adjusting the stack frame.",
            "D: To overwrite the popped value for security reasons and prevent data leakage."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "esp"
    },
    {
        "id": "d30fac69-cd23-4cf6-8d9b-d2b0bfb69183",
        "source": "cs161_textbook",
        "question": "Consider a secure system that employs HMAC for message authentication. Given the security properties of HMAC and its construction, select all statements that are true:",
        "choices": [
            "A: HMAC can only be used with hash functions that produce a fixed output size of 256 bits.",
            "B: If a single bit in the message or key is altered, the output tag of HMAC will be unpredictable and substantially different.",
            "C: HMAC requires two unrelated keys for its operation, which must be provided separately and remain distinct throughout its usage.",
            "D: HMAC is efficient because its inner hash function call only hashes the message plus a constant number of additional bits."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HMAC"
    },
    {
        "id": "90be6a0d-1efc-4fd9-82cf-754adfbd61b3",
        "source": "cs161_textbook",
        "question": "An organization is evaluating different firewall technologies to protect its network infrastructure. They have a diverse network with a mix of web traffic, internal applications, and a need for detailed traffic inspection for security policy enforcement. Considering their requirements and the information provided on firewall types, which of the following statements are correct regarding the use of stateless packet filters, application-layer firewalls, and application proxies?",
        "choices": [
            "A: Stateless packet filters would be sufficient for the organization since they handle each packet as it arrives and require no memory or history.",
            "B: Application-layer firewalls would provide the ability to enforce more restrictive security policies by inspecting the content of the data fields.",
            "C: Using an application proxy might introduce performance bottlenecks due to funneling all outbound traffic through a few systems.",
            "D: Stateless packet filters would be the most complex to implement since they need to understand all details of the application protocols they mediate."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Firewalls"
    },
    {
        "id": "179996e9-39cc-4221-9ee7-9c3ecb78a77c",
        "source": "owasp_wstg",
        "question": "A web application has a security mechanism in place to deny list certain SQL injection payloads. An attacker discovers that the application is vulnerable to HTTP Parameter Pollution. How could the attacker leverage the HPP vulnerability to bypass the security mechanism?",
        "choices": [
            "A: The attacker could send a SQL payload in fragmented form as multiple HTTP parameters and the server might concatenate them into a malicious string after passing the security checks.",
            "B: The attacker could repeatedly send the same SQL payload to overload the security mechanism and cause a denial of service.",
            "C: The attacker could encrypt the SQL injection payload to avoid detection by the security mechanism.",
            "D: The attacker could use the HPP vulnerability to directly disable the security mechanism on the server."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "bb669984-d478-4eb5-9440-eed026eb7745",
        "source": "cs161_textbook",
        "question": "In the context of defending against ARP spoofing attacks, which of the following countermeasures could be considered effective? Select all that apply.",
        "choices": [
            "A: Deploying intrusion detection systems (IDS) that can detect anomalies in ARP traffic.",
            "B: Enforcing a strict routing policy to ensure that all traffic flows through a firewall.",
            "C: Limiting the rate of ARP responses allowed from a single device on the network.",
            "D: Increasing the ARP cache timeout value to reduce the number of ARP requests."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "ARP Defense"
    },
    {
        "id": "ea7afbdc-ea4e-44d8-a0d2-357617db0529",
        "source": "android_sec_doc",
        "question": "An Android developer is designing an application that will handle sensitive user data. The developer must choose an encryption method that allows the device to boot directly to the lock screen while still providing quick access to essential features like alarms and accessibility services, even before the user has entered their credentials. Which encryption method should the developer implement?",
        "choices": [
            "A: Full-disk encryption",
            "B: File-based encryption",
            "C: Metadata encryption",
            "D: Asymmetric encryption"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "File-based encryption"
    },
    {
        "id": "b8519767-7e16-4211-be00-7044d8a1f7d2",
        "source": "android_sec_doc",
        "question": "You are tasked with creating a device-specific SELinux policy for a new Android device. After putting the device in permissive mode and addressing the majority of denials, you must transition to enforcing mode to ensure security and functionality. Which of the following approaches would be the most appropriate in this context?",
        "choices": [
            "A: Start in permissive mode, address the denials by core services with proper file labeling, and switch to enforcing mode as early as possible.",
            "B: Begin with enforcing mode immediately to reveal the denials, and then address them by creating a general policy allowing all services access to necessary files.",
            "C: Use permissive mode throughout the device bring-up process to avoid any interruptions and address the denials only after all other tasks are completed.",
            "D: Ignore the core services denials initially, and focus on labeling new services and addressing their denials before considering the transition to enforcing mode."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "SELinux Policy"
    },
    {
        "id": "e055330e-c32a-48f1-abe8-33846e29bb0f",
        "source": "owasp_wstg",
        "question": "A web application development team is preparing to deploy a business-critical application that handles sensitive transactions. The team wants to ensure that the application is protected against common web vulnerabilities, such as Cross-Site Scripting (XSS) and Clickjacking. Which of the following Content Security Policy (CSP) configurations should the team implement to achieve a strict CSP that provides a high level of security?",
        "choices": [
            "A: script-src 'self'; object-src 'self'; base-uri 'self';",
            "B: script-src 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; base-uri 'none';",
            "C: script-src '*'; object-src '*'; base-uri '*';",
            "D: script-src 'unsafe-inline'; object-src 'none'; base-uri 'none';"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Content Security Policy"
    },
    {
        "id": "ca4b35e5-75c7-49a0-814d-131dc3a4ed5b",
        "source": "attck",
        "question": "As a penetration tester simulating an advanced persistent threat (APT), you are attempting to discover vulnerable services within a target network. Which of the following tools or methods would you likely employ to effectively identify services that may be susceptible to remote software exploitation?",
        "choices": [
            "A: Utilizing a mDNS query, such as `dns-sd -B _ssh._tcp .`, to discover services running on macOS hosts within the network.",
            "B: Conducting a physical security audit to inspect the hardware connected to the network.",
            "C: Employing social engineering tactics to coerce employees into disclosing information about the network services.",
            "D: Running a proprietary office suite software to automatically detect network services."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "mDNS Query"
    },
    {
        "id": "5ec6df4a-afb5-4728-93f6-8f2db43732b2",
        "source": "attck",
        "question": "A penetration tester is analyzing methods used by malware to achieve persistence on compromised hosts. While reviewing the registry query techniques of different malware samples, which of the following would most likely provide the malware with persistence through system reboots?",
        "choices": [
            "A: Querying HKCU\\Software\\Microsoft\\Terminal Server Client\\Default to gather information about remote servers.",
            "B: Querying HKLM\\Software\\NFC\\IPA to read specific values related to Near Field Communication settings.",
            "C: Querying HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated for privilege escalation opportunities.",
            "D: Checking for the existence of HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run to set auto-start programs at boot time."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Registry Persistence"
    },
    {
        "id": "6b79cc3e-cdc3-47c0-9cb7-58a740011f24",
        "source": "cs161_textbook",
        "question": "Alice and Bob want to communicate securely over the internet. They are considering several cryptographic schemes to ensure that their messages remain confidential and unaltered. Evaluate the scenarios and select the ones where the cryptographic scheme effectively counters the given type of adversary:",
        "choices": [
            "A: Using symmetric encryption, where Alice and Bob share a secret key, to prevent Eve from understanding the messages.",
            "B: Employing digital signatures so that any tampering by Mallory can be detected by Alice and Bob.",
            "C: Implementing a hashing function to ensure message integrity against active tampering by Mallory.",
            "D: Relying on steganography alone to hide the existence of a message from Eve."
        ],
        "answer": "ABC",
        "topics": [],
        "keyword": "Cryptography"
    },
    {
        "id": "95e6888c-63d2-4d0e-9dd0-df58d80735a7",
        "source": "attck",
        "question": "An organization is reviewing their cybersecurity strategies to mitigate the risk of attacks that exploit file and directory permissions as well as user behavior. Which of the following strategies would NOT contribute significantly to mitigating these risks?",
        "choices": [
            "A: Implementing strict file system access controls on critical system folders such as C:\\Windows\\System32.",
            "B: Training users to disable all macros in documents, regardless of the document's source or purpose.",
            "C: Restricting user permissions to prevent the installation of unauthorized software.",
            "D: Training users not to open email attachments or click unknown links."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "User Training"
    },
    {
        "id": "54e77c73-e28b-478a-a015-a1a340a1e3f3",
        "source": "apple_platform_security",
        "question": "A developer is creating a new application for iOS and iPadOS. They are considering security features to incorporate into the app's design to enhance its protection against common cyber threats. Which of the following features or mechanisms could the developer leverage as part of the operating systems' built-in security?",
        "choices": [
            "A: Implement Address Space Layout Randomisation (ASLR) to randomise all memory regions of the built-in apps upon launch.",
            "B: Use the Execute Never (XN) feature to mark memory pages as non-executable and prevent writable pages from executing without proper authorization.",
            "C: Enable the app to directly access the memory spaces of other apps for improved performance.",
            "D: Request an Apple-only dynamic code-signing entitlement to allow the app to make multiple mmap calls for executable and writable pages."
        ],
        "answer": "AB",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "SecurityFeatures"
    },
    {
        "id": "a5082d39-fd57-4477-b419-8df279a97bd5",
        "source": "owasp_wstg",
        "question": "In a web application, how would you distinguish between a vertical privilege escalation and a horizontal privilege escalation event, and what are the potential implications of each?",
        "choices": [
            "A: Vertical escalation involves accessing resources of a more privileged account, like administrative privileges, which could potentially disrupt system integrity, while horizontal escalation involves accessing resources of a similarly configured account, which mainly affects user privacy.",
            "B: Horizontal escalation occurs when users can access system-level resources, which is a severe threat to application security, whereas vertical escalation is limited to accessing another regular user's data, posing less risk.",
            "C: Vertical escalation refers to gaining access to another user's session, while horizontal escalation means escalating one's own privileges without authentication, both leading to unauthorized data access.",
            "D: Horizontal escalation is about acquiring the privileges of a system administrator, an action that can compromise the entire application infrastructure, while vertical escalation is about accessing another user's information without significant system-wide implications."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Vertical Escalation"
    },
    {
        "id": "dd8dc0b4-a129-4be6-9b51-17458f4a29d0",
        "source": "mit6.858",
        "question": "In the context of TCP/IP security, what are the potential consequences of an adversary being able to predict or guess the initial sequence numbers (ISNs) in TCP connections? Select all that apply.",
        "choices": [
            "A: An adversary could forge the IP source address to impersonate a host from a trusted list in services like rlogin.",
            "B: An adversary could hijack existing connections by injecting data, potentially taking over an authenticated session.",
            "C: An adversary could reduce the effectiveness of cryptographic protocols like ssl and ssh by predicting sequence numbers.",
            "D: An adversary could perform a denial of service attack by sending a reset (RST) packet with a guessed sequence number."
        ],
        "answer": "ABD",
        "topics": [
            "NetworkSecurity",
            "Vulnerability"
        ],
        "keyword": "Sequence Number Prediction"
    },
    {
        "id": "3720deea-6d3b-4810-b52d-c85d3e28589d",
        "source": "owasp_wstg",
        "question": "A tester intercepts an HTTP response from a web application during a security audit. The response contains the following headers:\n\n\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Credentials: true\n\n\nWhat is the likely outcome in a browser that adheres to the CORS specification when these headers are present in the response?",
        "choices": [
            "A: The browser will ignore the Access-Control-Allow-Credentials header because the wildcard in Access-Control-Allow-Origin is incompatible with credentials being true.",
            "B: The browser will allow the response to be read by the requesting script even with credentials passed, due to the wildcard in Access-Control-Allow-Origin.",
            "C: The browser will block the response because the Access-Control-Allow-Origin header contains a wildcard, which is considered a security risk.",
            "D: The response will be cached indefinitely in the browser because the Access-Control-Allow-Credentials header implies permission for long-term storage."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CORS Header Configuration"
    },
    {
        "id": "b021d5d1-4b87-4dc1-ae6f-df4e0e5969c2",
        "source": "owasp_mastg",
        "question": "When developing a mobile application that handles sensitive data, which of the following practices is NOT recommended to ensure the security of the app?",
        "choices": [
            "A: Implementing certificate pinning to prevent man-in-the-middle (MITM) attacks.",
            "B: Storing encryption keys in plain text within the app's source code.",
            "C: Using secure coding practices to mitigate common vulnerabilities such as SQL injection.",
            "D: Regularly updating the app to address security patches and vulnerabilities."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Mobile Application Security"
    },
    {
        "id": "8da52677-a449-49d1-b40e-388059030673",
        "source": "owasp_wstg",
        "question": "A penetration tester is assessing the security of a web server that hosts multiple web applications. The tester suspects that the web server is vulnerable to Host header injection attacks. Which of the following could potentially occur if the Host header is not properly validated by the web server? (Choose two)",
        "choices": [
            "A: The web server may serve content from a different virtual host, leading to internal application exposure.",
            "B: A Host header injection will always cause the server to crash, leading to a denial of service.",
            "C: The tester may cause the application to generate incorrect password reset links, potentially leading to account compromise.",
            "D: Valid Host header values are cached by the server and reused for subsequent requests, preventing Host header attacks."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Host Header Injection"
    },
    {
        "id": "836617f0-7044-48fb-8fe2-4d8a33f8f716",
        "source": "owasp_mastg",
        "question": "Consider the following code snippet correctly used in a mobile application to include a system header file for ptrace functionality in C:\n\n    #include <sys/ptrace.h>\n\nWhich of the following code modifications would NOT introduce a potential security vulnerability?",
        "choices": [
            "A: Removing the #include directive altogether.",
            "B: Using double quotes instead of angle brackets: #include \"sys/ptrace.h\"",
            "C: Including the header file multiple times: #include <sys/ptrace.h> #include <sys/ptrace.h>",
            "D: Typing an incorrect header file name: #include <sys/ptarce.h>"
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "#include directive"
    },
    {
        "id": "837f9b7a-3e00-43e3-b91d-e75ab49e23b7",
        "source": "owasp_wstg",
        "question": "During a security assessment, you discover that a web application using the Web SQL Database technology is vulnerable to client-side SQL injection due to inadequate input validation. If an attacker exploits this vulnerability, what actions can they potentially perform on the client-side database?",
        "choices": [
            "A: Hijack user sessions to impersonate legitimate users within the web application.",
            "B: Decrypt sensitive information stored in the database without the encryption key.",
            "C: Read, modify, or delete information stored within the database.",
            "D: Increase their user privileges on the operating system hosting the web server."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Client-side Database Manipulation"
    },
    {
        "id": "46605378-381d-478f-9f77-cd66355ecded",
        "source": "cs161_textbook",
        "question": "In the context of network communication, why are headers significant, and what are potential drawbacks of their usage that designers must consider?",
        "choices": [
            "A: Headers facilitate the delivery of messages by containing metadata, but can increase the size of packets, potentially impacting transmission efficiency.",
            "B: Headers are used to encrypt the contents of a message, but can be a point of vulnerability if encryption algorithms are outdated.",
            "C: Headers help in routing the message through the correct network path, but excessive header information may result in privacy concerns.",
            "D: Headers are primarily used for aesthetic purposes to structure data, and thus do not have significant drawbacks."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Headers"
    },
    {
        "id": "89a8424e-adce-4fb6-a11a-0bcd75792308",
        "source": "cwe",
        "question": "In the context of a device's sensor data protection, which of the following strategies is likely to be the least effective in preventing untrusted software from manipulating sensor output and why?",
        "choices": [
            "A: Using cryptographic techniques to sign and verify parametric data values.",
            "B: Implementing role-based access control to restrict which user roles can modify sensor parametric data.",
            "C: Relying on physical tamper-proofing of the device to prevent unauthorized access to hardware.",
            "D: Allowing unrestricted access to sensor calibration data with the expectation that system monitoring tools will detect and prevent misuse."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SensorDataProtection"
    },
    {
        "id": "e917cc8a-31d0-49f7-b698-0d4152004878",
        "source": "owasp_wstg",
        "question": "You are reviewing the security of a web application's transport layer and find that it uses outdated encryption algorithms, making the communication susceptible to interception and decryption. Which of the following practices would NOT enhance the security of the application's transport layer?",
        "choices": [
            "A: Implementing a Content Security Policy (CSP) header.",
            "B: Enforcing the use of TLS 1.3 for all connections.",
            "C: Disabling support for weak cipher suites.",
            "D: Using HSTS to ensure connections use HTTPS."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Transport Layer Security"
    },
    {
        "id": "61a52083-6d04-4992-aac8-c1506f57d903",
        "source": "windows_security",
        "question": "As an IT security analyst, you are assessing the risk of Pass-the-Hash attacks in your organization's Windows 10 environment. Which Windows 10 security feature would be most effective in mitigating this specific type of threat?",
        "choices": [
            "A: Windows Defender SmartScreen",
            "B: Credential Guard",
            "C: Enterprise certificate pinning",
            "D: Microsoft Defender Antivirus"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Pass-the-Hash attack mitigation"
    },
    {
        "id": "d41e602e-108a-4738-a981-8b87eef9846c",
        "source": "attck",
        "question": "As a security architect, you are tasked with choosing a mitigation to protect against the abuse of command and scripting interpreters in a corporate environment with a high reliance on automated administrative tasks. Which mitigation would provide the most robust defense while maintaining the necessary functionality for automation?",
        "choices": [
            "A: Disable or remove any unnecessary or unused shells or interpreters.",
            "B: Implement application control to prevent the execution of all scripts.",
            "C: Restrict PowerShell execution policy to administrators and apply PowerShell Constrained Language mode.",
            "D: Install script blocking extensions on all browsers to prevent the execution of scripts."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "PowerShell Constrained Language mode"
    },
    {
        "id": "1984dc00-72ae-49f9-b460-41d2e2cf47e1",
        "source": "cwe",
        "question": "Analyze the following code snippets that implement input validation in different applications. Which code snippet does NOT exhibit a too permissive list of allowed inputs, potentially leading to security weaknesses?",
        "choices": [
            "A: String[] allowedPatterns = {\"[a-zA-Z]+\", \"[0-9]+\"}; if (Arrays.asList(allowedPatterns).contains(inputPattern)) { processInput(input); }",
            "B: Regex allowedPattern = new Regex(\"^[a-zA-Z0-9]{0,10}$\"); if (allowedPattern.IsMatch(input)) { processInput(input); }",
            "C: List<String> allowedExtensions = new ArrayList<>(Arrays.asList(\".jpg\", \".png\", \".gif\")); if (allowedExtensions.stream().anyMatch(input::endsWith)) { processInput(input); }",
            "D: if (input.length() > 0 && !input.matches(\".*[<>\\\\/].*\")) { processInput(input); }"
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "5f68a75e-3093-4dbf-8f40-16de6ddb497c",
        "source": "cwe",
        "question": "Consider a scenario where a class in a Java application includes a method that returns a reference to a private array of sensitive user data. This exposure represents a security vulnerability since the returned reference allows external modification of the private data. Which of the following approaches would be effective in mitigating this security risk while maintaining functionality?",
        "choices": [
            "A: Modify the method to return a new array containing a copy of the private data.",
            "B: Keep the method public, but change the array to a non-mutable collection.",
            "C: Declare the method as synchronized to prevent concurrent access.",
            "D: Remove the method and require direct access to the private array."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "c6c46ade-35eb-40f5-b780-f76aeb1c8e66",
        "source": "mit6.858",
        "question": "In an effort to safeguard its infrastructure from unauthorized hardware and software modifications, a company follows certain security practices. Based on the text, select the methods that contribute to ensuring the integrity and authenticity of the server's hardware and software:",
        "choices": [
            "A: The company designs its own motherboards and security chips to reduce reliance on third-party hardware.",
            "B: The security chip is programmed to bypass the boot process, making it faster to deploy servers.",
            "C: Servers authenticate with services by providing a signed statement from the security chip, which includes the identity of the booted BIOS and O/S.",
            "D: A database of security chip public keys and acceptable BIOS and O/S hashes is maintained to verify the genuineness of the server hardware and software."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Server Integrity"
    },
    {
        "id": "64b5de39-e030-4fa2-817c-58c49b31d287",
        "source": "mozilla_security",
        "question": "An application needs to specify its Cross-Origin Resource Sharing (CORS) policy. Which of the following CORS configurations correctly allows a JavaScript library to be read by any site for subresource integrity purposes and also allows a specific dashboard at 'https://random-dashboard.example.org' to read the results of an API? Identify the advantages and disadvantages of each configuration.",
        "choices": [
            "A: Set 'Access-Control-Allow-Origin: *' to allow any site to read the JavaScript library and specify 'Access-Control-Allow-Origin: https://random-dashboard.example.org' for the API.",
            "B: Set 'Access-Control-Allow-Origin: https://random-dashboard.example.org' for the JavaScript library and the API to restrict access to a single origin for security reasons.",
            "C: Implement a cross-domain policy for Flash and Silverlight with domain 'random-dashboard.example.org' to control access while allowing 'Access-Control-Allow-Origin: *' for the JavaScript library.",
            "D: Use a strict cross-domain policy that does not specify any 'Access-Control-Allow-Origin', ensuring maximum security and no access to the JavaScript library or API."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Cross-Origin Resource Sharing (CORS)"
    },
    {
        "id": "738308b7-aa49-434d-ae43-bdc8ce92aa64",
        "source": "windows_security",
        "question": "You are configuring a Windows Event Forwarding (WEF) system and expect to handle an average of 25,000 events per second. Which data store should you employ for optimal performance, and what are the benefits of this choice?",
        "choices": [
            "A: SQL or SEM, because they are optimized for quick access and real-time analysis.",
            "B: SEM, because it is capable of inspecting, correlating events, and generating alerts quickly.",
            "C: Hadoop/HDInsight/Data Lake, because they are designed for handling very high volumes of data.",
            "D: A custom-built in-memory database, because it offers the fastest data processing capabilities."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Windows Event Forwarding (WEF)"
    },
    {
        "id": "95df2f1a-0320-4620-acc4-ca079f2c62f5",
        "source": "windows_security",
        "question": "When evaluating the efficacy of implementing a bug bounty program for your organization, what are potential advantages and disadvantages you should consider?",
        "choices": [
            "A: Advantages: Incentivizes researchers; Disadvantages: Can be costly and may not cover all security vulnerabilities",
            "B: Advantages: Guarantees elimination of all security bugs; Disadvantages: Can lead to negative publicity",
            "C: Advantages: Replaces the need for a security team; Disadvantages: Can be difficult to manage",
            "D: Advantages: Ensures compliance with security regulations; Disadvantages: May not incentivize researchers enough"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "bug bounty program"
    },
    {
        "id": "16926b4e-36fd-4a10-b02a-014cf8906d18",
        "source": "cs161_textbook",
        "question": "In the context of an off-by-one vulnerability that allows an attacker to overflow a buffer by one byte, which steps are critical for the attacker to manipulate the control flow of a program to execute arbitrary code?",
        "choices": [
            "A: Changing the least significant byte of the saved frame pointer (sfp) to point inside the buffer during the overflow.",
            "B: Placing the address of the shellcode four bytes above where the forged saved frame pointer (sfp) points.",
            "C: Overwriting the most significant byte of the saved instruction pointer (rip) to alter the return address.",
            "D: Inserting the shellcode at the top of the stack before the saved instruction pointer (rip)."
        ],
        "answer": "AB",
        "topics": [
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "Off-by-One"
    },
    {
        "id": "bc646d4b-3f83-4ab3-9a40-3f7a5e15074e",
        "source": "windows_security",
        "question": "A company's file server is using user claims to control access to files, and the server needs to support client principals whose accounts might be in a domain running a version of Windows before Windows 8 or Windows Server 2012. Given this scenario, how should the 'Microsoft network server: Attempt S4U2Self to obtain claim information' security policy setting be configured to best support this environment?",
        "choices": [
            "A: The setting should be set to 'Not defined' to allow the file server to automatically evaluate whether claims are needed for the user.",
            "B: The setting should be set to 'Default', which is the same as 'Enabled', to ensure the server can obtain a claims-enabled access token if needed.",
            "C: The setting should be set to 'Disabled' to prevent the server from using Kerberos S4U2Self to obtain claim information unnecessarily.",
            "D: The setting should be explicitly configured to 'Enabled' in this scenario to ensure the file server will obtain a claims-enabled access token if the client principals' claims are not present."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Kerberos S4U2Self"
    },
    {
        "id": "b01335c1-6e44-4642-bd11-7209d57684be",
        "source": "apple_platform_security",
        "question": "An organization is considering the deployment of iOS and iPadOS devices for their employees. As part of their risk assessment, they need to understand specific security features of these devices. Select the security measures and features that correctly describe how iOS and iPadOS devices and APFS ensure data security. (Choose all that apply)",
        "choices": [
            "A: iOS and iPadOS devices require biometric authentication or a passcode to establish new data connections if no connection has been made in the past 3 days.",
            "B: APFS is optimized for HDD storage and features weak encryption, but provides efficient directory sizing and atomic safe-save primitives.",
            "C: APFS allows multiple volumes in a single container to share free space, allocating it to individual volumes as needed.",
            "D: The keychain in Apple's operating systems is protected by two different AES-256-GCM keys, with the metadata key cached in the Application Processor for fast queries."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityFeatures"
    },
    {
        "id": "20e7685f-fd17-4b6e-a127-19b7508dabe2",
        "source": "owasp_wstg",
        "question": "An e-commerce web application uses drop-down menus to allow users to select quantities of items for purchase. These quantities are defined server-side and are displayed as non-editable on the client-side. Which of the following scenarios poses a security risk that violates business logic integrity?",
        "choices": [
            "A: A user can view different quantities based on their membership level, and the server validates the quantity before processing.",
            "B: The server uses client-side drop-down values directly for processing orders without server-side validation.",
            "C: The server maintains a separate, server-side copy of the quantity and compares it with the client's selection before processing.",
            "D: The server restricts users from selecting quantities based on their account type and provides appropriate error messages."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Business Logic Integrity"
    },
    {
        "id": "0b73c283-7dca-4108-bb31-d140f44011cf",
        "source": "owasp_wstg",
        "question": "You are leading a web application security project. Your team is tasked with various activities including threat modeling, reviewing server metafiles for information leakage, and testing for default credentials. According to the OWASP Testing Framework, during which phases would these activities MOST appropriately take place?",
        "choices": [
            "A: Threat modeling in Phase 1, reviewing server metafiles in Phase 3, and testing for default credentials in Phase 5.",
            "B: Threat modeling in Phase 2, reviewing server metafiles in Phase 4, and testing for default credentials in Phase 3.",
            "C: Threat modeling in Phase 1, reviewing server metafiles in Phase 3, and testing for default credentials in Phase 4.",
            "D: Threat modeling in Phase 2, reviewing server metafiles in Phase 2, and testing for default credentials in Phase 4."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "OWASP Testing Framework"
    },
    {
        "id": "2452864d-a7a1-4b82-89f9-953326e22a5c",
        "source": "owasp_wstg",
        "question": "In reviewing the DNS configurations of a web application, you notice that several subdomains are using different types of DNS records. From a security perspective, which DNS record type, if incorrectly configured, poses the highest risk of subdomain takeover with the most significant impact?",
        "choices": [
            "A: `A` record, as it directly maps the subdomain to an IP address and can be easily hijacked.",
            "B: `MX` record, since it deals with email servers and can compromise communication.",
            "C: `NS` record, because it allows control over the entire DNS zone if taken over.",
            "D: `TXT` record, as it can be exploited to verify domain ownership for SSL/TLS certificates."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "DNS record types"
    },
    {
        "id": "ca2b46c8-0944-4af2-a2df-34a153e2e78d",
        "source": "mozilla_security",
        "question": "A web development team is implementing Subresource Integrity (SRI) checks for their website. They are including third-party JavaScript libraries from CDNs to enhance their application's functionality. To ensure the integrity of the files fetched from the CDNs, they should:",
        "choices": [
            "A: Configure the server to reject any requests that don't include a valid 'integrity' attribute in the HTML script tag.",
            "B: Use the 'integrity' attribute in the HTML script tag with a hash generated from the expected content of the script.",
            "C: Enable cross-origin resource sharing (CORS) for all CDN-hosted script files without validating their content.",
            "D: Generate a random hash value for the 'integrity' attribute to guarantee the uniqueness of the script each time it's loaded."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Subresource Integrity"
    },
    {
        "id": "a50af7df-b139-400b-a274-f2d97bac9a10",
        "source": "cwe",
        "question": "A developer is designing a security-sensitive application that handles encryption keys and must ensure these keys are not written to swap files. Which of the following actions should the developer take to mitigate the risk of sensitive data exposure due to swapping, and what are the considerations that must be taken into account for selecting the appropriate mitigation?",
        "choices": [
            "A: Use the VirtualLock() function on Windows and check the return value to confirm the lock's success; be aware of its limitations on legacy Windows versions.",
            "B: Apply the mlock() call on POSIX systems and ignore return values since mlock() guarantees that pages will stay resident in memory.",
            "C: Opt for proprietary, third-party locking mechanisms that provide cross-platform consistency and do not require supervisor privileges.",
            "D: Employ mlock() on Linux systems for sensitive data, ensuring to check the return values; understand that this behavior might not be portable."
        ],
        "answer": "AD",
        "topics": [
            "MemorySafety",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SensitiveDataProtection"
    },
    {
        "id": "08f679b8-b7e2-4461-8b25-a6f45205d7a7",
        "source": "android_sec_doc",
        "question": "An Android application developer wishes to ensure that files created by their app are secure from access by other applications. Which of the following practices should the developer implement to achieve this security objective?",
        "choices": [
            "A: Run the application with root permissions to prevent other apps from accessing its files.",
            "B: Store files on an external storage medium with custom encryption.",
            "C: Use the default file permissions model where each app runs as its own user.",
            "D: Implement a custom kernel module to manage file access."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Filesystem Permissions"
    },
    {
        "id": "c1a7e1a8-65b1-4d7d-847b-dcb778570dd1",
        "source": "cs161_textbook",
        "question": "Consider the following scenarios where developers are constructing HTTP requests for a web application. Select the valid HTTP request(s) and identify the potential issues with any incorrect requests.",
        "choices": [
            "A: GET /home HTTP/1.1\nHost: example.com\nContent-Type: application/json",
            "B: POST /submit HTTP/1.1\nHost: example.com\nReferer: http://example.com/form\nContent-Length: 0",
            "C: DELETE /user/12345 HTTP/1.1\nHost: example.com\nDnt: 1",
            "D: PUT /update-profile HTTP/2.0\nHost: example.com\nAccept: text/html,application/xhtml+xml"
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP"
    },
    {
        "id": "6fe3098b-bb55-40f8-ba86-864e0f46633f",
        "source": "cwe",
        "question": "Why is using base 64 encoding to obscure passwords before storing them in an application's properties or configuration file considered an insecure practice?",
        "choices": [
            "A: Base 64 encoding is computationally intensive and can slow down the application's performance.",
            "B: Base 64 encoding can be easily reversed, revealing the original password to anyone with access to the encoded value.",
            "C: Base 64 encoding increases the size of the password, making it more difficult to manage.",
            "D: Base 64 encoding is not supported by modern databases and can cause compatibility issues."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "EncodingWeakness"
    },
    {
        "id": "aaa8c0a9-e5d5-4547-bdf9-6127cdcf36d7",
        "source": "mit6.858",
        "question": "In the context of web security, the Same-Origin Policy (SOP) has certain exceptions. Analyze the security implications of these exceptions and select the statements that are true.",
        "choices": [
            "A: The SCRIPT tag exception allows JavaScript to be fetched from any origin, which can lead to running untrusted code with the privileges of the fetching origin.",
            "B: IFRAMEs are completely isolated from the parent page, preventing any form of interaction and thus pose no security risk.",
            "C: Cross-Origin Resource Sharing (CORS) is considered safe because it allows servers to explicitly control cross-origin requests, defaulting to denial if not understood.",
            "D: Using the IFRAME tag without restrictions enhances security because it allows embedding content from trusted sources."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SOP Exceptions"
    },
    {
        "id": "0cf6a7c1-cc20-4554-b022-4e6923169542",
        "source": "owasp_wstg",
        "question": "You are assessing a web application's security and notice that session IDs are being cached due to a misconfiguration. What is the primary security concern associated with this observation?",
        "choices": [
            "A: Caching session IDs can lead to a decrease in the application's performance due to increased memory usage.",
            "B: Cached session IDs may be accessed by unauthorized parties, leading to session hijacking.",
            "C: Frequent caching might result in session IDs being outdated, causing user authentication errors.",
            "D: Enabling caching for session IDs will enhance user privacy by reducing the need for repetitive authentication."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Session Hijacking"
    },
    {
        "id": "19c9e763-ce52-4980-8bf4-a548ae8c9192",
        "source": "cwe",
        "question": "An application developer insists that their web application is secure against Execution After Redirect (EAR) attacks because they have implemented a whitelist for IP address validation. What is the most effective counterargument to this claim?",
        "choices": [
            "A: IP address whitelisting does not prevent the execution of code after an HTTP redirect, which is the primary concern of an EAR vulnerability.",
            "B: Whitelisting IP addresses can be bypassed through DNS poisoning, rendering the security measure ineffective against EAR.",
            "C: IP address whitelisting is a strong security measure and will make the application immune to EAR attacks.",
            "D: Implementing a whitelist for IP addresses can prevent SQL injection, which is often confused with EAR."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "EAR-mitigation"
    },
    {
        "id": "ae28ad19-0e87-4a14-8fc5-836d5404288b",
        "source": "cs161_textbook",
        "question": "Given the AT&T x86 assembly instruction `movl 8(%ebp), %edx`, translate the instruction into the correct pseudocode representation:",
        "choices": [
            "A: EDX = *(EBP + 8)",
            "B: EDX = EDX + 8(EBP)",
            "C: 8(EBP) = EDX",
            "D: EDX = EBP + 8"
        ],
        "answer": "A",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "x86 Assembly"
    },
    {
        "id": "67c070a2-3270-4599-87e0-a88ee24079f9",
        "source": "windows_security",
        "question": "You are designing a security framework for a new Windows application. Which of the following measures should you consider implementing to ensure robust security? (Select two)",
        "choices": [
            "A: Enabling Data Execution Prevention (DEP) for the application to prevent code execution from non-executable memory regions.",
            "B: Disabling User Account Control (UAC) to allow the application to perform administrative tasks without interruption.",
            "C: Implementing Address Space Layout Randomization (ASLR) to reduce the risk of buffer overflow attacks.",
            "D: Configuring the application to run with the highest possible privileges to ensure it has access to necessary system resources."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Data Execution Prevention"
    },
    {
        "id": "4023cd5b-05c9-4007-8129-db2d641d9a6b",
        "source": "cs161_textbook",
        "question": "In the context of networking, why would an engineer choose to use an IP address instead of a MAC address to enable communication between devices in different local area networks (LANs)?",
        "choices": [
            "A: Because MAC addresses are only unique within a single LAN and cannot be used to route traffic between different networks.",
            "B: Because IP addresses provide a 16-bit number that allows for more devices to be addressed compared to the 48-bit MAC address.",
            "C: Because MAC addresses are primarily used for encryption and message integrity within a LAN, not for routing purposes.",
            "D: Because IP addresses are used to identify processes within a machine, allowing for multiple connections per device on different networks."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Routing"
    },
    {
        "id": "1b509813-d583-4e78-8f86-7ccb33e44b75",
        "source": "attck",
        "question": "A penetration tester is tasked with identifying shared network resources within a Linux-based environment. The goal is to gather information for later stages of the engagement, without raising alarms through noisy network traffic. Which of the following tools or commands would be most appropriate for the tester to use in this scenario?",
        "choices": [
            "A: Using the `nmap` utility with aggressive scan options to quickly identify all open ports and services.",
            "B: Employing the `net view \\remotesystem` command to enumerate shared resources on a target system.",
            "C: Utilizing the `sharing -l` command to discretely list all shared points used for SMB services.",
            "D: Executing the `net share` command on a compromised system to query for locally shared resources."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Share Discovery"
    },
    {
        "id": "36041960-6745-4b20-a042-5868cd109b9c",
        "source": "cs161_textbook",
        "question": "Considering the essential properties of a reference monitor, which of the following scenarios could potentially compromise a firewall's effectiveness in enforcing an access control policy?",
        "choices": [
            "A: The firewall is placed on a network segment where it can inspect all traffic flowing between the internal and external networks.",
            "B: A user connects an unauthorized wireless access point to the internal network, allowing devices to bypass the firewall.",
            "C: The firewall's software complexity prevents systematic verification of its correct operation.",
            "D: The firewall is hardened to minimize its attack surface by not running any unnecessary services."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "vulnerability"
    },
    {
        "id": "f9ad54de-9c0c-42b4-bfc7-963c9807e85b",
        "source": "cwe",
        "question": "An application developer is implementing a function to process user-supplied data. Which of the following strategies would best prevent an out-of-bounds read vulnerability given the need to handle a wide range of inputs?",
        "choices": [
            "A: Using a denylist to block known bad inputs and relying on this exclusively for input validation.",
            "B: Employing an 'accept known good' input validation strategy, where inputs are checked against a list of acceptable values.",
            "C: Adding sentinel values such as a NUL character at the end of data inputs to signal the end of input.",
            "D: Choosing a programming language that does not provide memory abstractions."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Input Validation"
    },
    {
        "id": "588b953a-a218-42ce-93ce-2c5b02ccf278",
        "source": "owasp_mastg",
        "question": "In a security testing scenario, a tester inadvertently uses an incorrect command to start the hostapd service, resulting in a failed attempt to establish a host access point. What are the potential consequences of this misconfiguration for the security testing process?",
        "choices": [
            "A: The mobile application may bypass the host access point, limiting the tester's ability to intercept and analyze traffic.",
            "B: The misconfiguration can enhance the encryption of data packets, making them harder to intercept.",
            "C: An incorrect command may start a different service that could interfere with the security testing environment.",
            "D: The mobile application's performance could be drastically improved, skewing testing results."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "hostapd misconfiguration"
    },
    {
        "id": "08006dda-e127-4fd9-b98b-4913545e5a8d",
        "source": "cs161_textbook",
        "question": "A colleague argues that to avoid costly damages from undetected attacks, it's best to have an intrusion detection system with a 0% false negative rate. How would you counter this argument based on the concepts of false positives and false negatives?",
        "choices": [
            "A: A system with a 0% false negative rate will report an attack every time and never miss an actual attack, but it would result in an unmanageable number of false alerts.",
            "B: A 0% false negative rate is highly desirable as it ensures maximum security, even if it means more resources are spent on investigating false alerts.",
            "C: It's impossible to achieve a 0% false negative rate without compromising on other aspects of the detection system, like its ability to handle high volumes of requests.",
            "D: Having a 0% false negative rate would lead to a detector that never triggers an alarm, thus no false alerts to worry about."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "DetectionStrategy"
    },
    {
        "id": "e5eb8b71-f00d-48bf-964d-e7d0c452b561",
        "source": "attck",
        "question": "In the context of cybersecurity defense, which data source and component combination would most likely contribute to the detection of an adversary's attempt to obtain capabilities, and why?",
        "choices": [
            "A: Certificate Registration - to track new certificates that may be associated with adversary infrastructure.",
            "B: Email Content - to monitor phishing attempts used to gather information on vulnerabilities.",
            "C: Network Traffic - to identify anomalies in outbound traffic suggesting data exfiltration.",
            "D: Malware Metadata - to analyze identifiable configuration information that may indicate a shared malware source."
        ],
        "answer": "AD",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Certificate Registration"
    },
    {
        "id": "e7d6110e-225d-4cb9-9e63-08d5255cefb9",
        "source": "apple_platform_security",
        "question": "A cybersecurity specialist is evaluating the resilience of hardware security features in various devices. In the context of Apple's hardware microphone disconnect feature, which of the following statements accurately describe the design of the hardware logic used to disable the microphone? Select all that apply:",
        "choices": [
            "A: The hardware logic includes a debounce mechanism to prevent accidental triggering of the microphone disconnect.",
            "B: Calibration of the sensors involved in the microphone disconnect can be adjusted post-production using software tools.",
            "C: The hardware logic is designed to delay microphone disconnection for a period of time after the lid sensor detects closure.",
            "D: The microphone disconnect logic allows certain firmware, such as the one on the T2 chip, to enable the microphone even when the lid is closed."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "HardwareLogic"
    },
    {
        "id": "be776a3b-c799-4ad5-a246-d7cd33b8a2e0",
        "source": "cwe",
        "question": "An attacker is attempting to exploit a CSRF vulnerability on a web application by crafting a malicious page that forces a browser to submit a POST request with a session cookie. Which of the following code snippets for configuring the session cookie would not prevent this CSRF attack?",
        "choices": [
            "A: response.cookie('sessionid', sessionId, { httpOnly: true, secure: true })",
            "B: response.cookie('sessionid', sessionId, { sameSite: 'Strict', secure: true })",
            "C: response.cookie('sessionid', sessionId, { sameSite: 'Lax', secure: true })",
            "D: response.cookie('sessionid', sessionId, { domain: 'example.com', path: '/securePath' })"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "73ea8b90-bd82-4e7f-8695-848ea4f1b2f6",
        "source": "attck",
        "question": "An adversary is attempting to evade detection through the use of stealth techniques such as encrypted strings, obfuscated payloads, and encoded configuration files. Which mitigation technique is most likely to thwart this evasion attempt?",
        "choices": [
            "A: Improving the security of the physical environment to prevent unauthorized access.",
            "B: Implementing strict network access controls and segmentation.",
            "C: Enabling Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads.",
            "D: Increasing the verbosity level of system logs to capture more event details."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Attack Surface Reduction (ASR)"
    },
    {
        "id": "400d0595-809e-4174-9f5e-bfd275471f09",
        "source": "owasp_mastg",
        "question": "In an effort to protect a mobile application from reverse engineering, which of the following techniques would be LEAST effective?",
        "choices": [
            "A: Applying code obfuscation to make the source code difficult to understand.",
            "B: Utilizing non-reversible hash functions for storing user passwords.",
            "C: Employing runtime application self-protection (RASP) mechanisms.",
            "D: Including verbose logging of all application activities."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Reverse Engineering"
    },
    {
        "id": "ada35d96-4a1a-4660-b83d-6a6d0a15035f",
        "source": "cwe",
        "question": "You are reviewing a web application's source code and notice that IMG tags within the application are dynamically generated with user-provided data. You need to ensure that the application is not vulnerable to XSS attacks through these IMG tags. Which of the following strategies should be implemented to mitigate such attacks?",
        "choices": [
            "A: Encode output for the IMG SRC attribute using consistent character encodings like UTF-8.",
            "B: Set the session cookie to be HttpOnly to prevent access by malicious client-side scripts.",
            "C: Restrict user input lengths to reduce the attack surface for potential script injections.",
            "D: Implement CAPTCHA challenges on each page load to verify user authenticity."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "XSS"
    },
    {
        "id": "1c1e1359-13bf-4116-8401-67412212dcc7",
        "source": "android_sec_doc",
        "question": "In a supported Android device running Android 9 or higher, an application leverages the Android Protected Confirmation feature for a high-assurance financial transaction. Which of the following best describes the sequence and interaction of components involved in this process?",
        "choices": [
            "A: The app calls ConfirmationUI to generate a confirmation token, which is then used by Trusted UI to query the user for confirmation, and Keymaster asserts the user’s approval.",
            "B: The app invokes Protected Confirmation, which then calls Trusted UI to query the user. Upon user's approval, Keymaster works with ConfirmationUI to generate a cryptographic statement.",
            "C: The app directly interacts with Keymaster to assert the user's approval without the need for Trusted UI or the generation of confirmation tokens.",
            "D: The app utilizes Trusted UI to directly encrypt the transaction data, bypassing the need for Keymaster or ConfirmationUI in the process."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Android Protected Confirmation"
    },
    {
        "id": "23221291-bc53-4f55-8e46-3b7502583194",
        "source": "attck",
        "question": "An adversary has gained initial access to your company's network and is now attempting to move laterally to gain more privileged access. They decide to use internal spearphishing as part of their strategy. Which of the following actions would be most effective for the adversary to undertake next to succeed in their internal spearphishing efforts?",
        "choices": [
            "A: Send phishing emails from an external email address claiming to be a senior executive to trick employees into divulging their credentials.",
            "B: Control a user's device with previously installed malware to send authentic-looking emails to other employees within the organization.",
            "C: Publicly post on social media impersonating an employee to gather information about internal systems and spread malware links.",
            "D: Launch a brute force attack on the company’s external web server to obtain employee usernames and passwords."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Internal Spearphishing"
    },
    {
        "id": "5d8e7d80-18e4-4e06-9296-eb4b481a828c",
        "source": "owasp_mastg",
        "question": "An Android application developer needs to securely store encryption keys to ensure that sensitive data remains protected. Which of the following methods should the developer use to enhance the security of the encryption keys?",
        "choices": [
            "A: Store the encryption keys using SharedPreferences and ensure the file is readable only by the application.",
            "B: Hardcode the encryption keys in the source code for easy retrieval during application runtime.",
            "C: Encrypt Data Encryption Keys (DEKs) with Key Encryption Keys (KEKs) and store them securely using AndroidKeyStore.",
            "D: Use a predictable key derivation function based on stable, device-specific attributes to generate encryption keys."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Envelope Encryption"
    },
    {
        "id": "fa5fe341-069e-494b-a090-7e91ea5e280d",
        "source": "cwe",
        "question": "An administrator is setting up a new industrial control system for a critical infrastructure facility. To enhance the security of the system, what steps should the administrator take during the initial configuration to address the risk associated with the use of default credentials?",
        "choices": [
            "A: Maintain the default credentials but monitor system logs for unauthorized access attempts.",
            "B: Disable the default login mechanism and require all users to establish new credentials before initial use.",
            "C: Implement a policy that forces users to change their passwords every 90 days.",
            "D: Set up the system with unique default credentials for each installation, prohibiting reuse across different organizations."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "DefaultCredentials"
    },
    {
        "id": "e25bbdd9-20c7-4a24-87e7-7438fdd4ba26",
        "source": "cwe",
        "question": "Consider the following scenario: A software engineer is working on a large codebase and notices multiple instances where the same complex mathematical calculation is duplicated in different parts of the application. The engineer has decided to refactor the code to improve maintainability and reduce the risk of inconsistent updates in the future. What would be the most effective approach to refactoring the code to meet these objectives?",
        "choices": [
            "A: Create a new class dedicated to mathematical operations and move all complex calculations to this class, replacing duplicates with calls to the respective methods.",
            "B: Add comments to each duplicated code block to ensure that future updates are consistently applied across all instances.",
            "C: Duplicate the code blocks into a common base class that other classes inherit from, to centralize future updates.",
            "D: Extract the complex calculations into a single method and replace all duplicate code blocks with calls to this method."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Refactoring"
    },
    {
        "id": "867bd867-80a8-4850-ba17-5a2e8266ac14",
        "source": "cs161_textbook",
        "question": "You are working with RSA signatures and have been given two large odd prime numbers p and q. You need to compute a number d satisfying the condition 3d = 1 mod phi(pq). Which of the following must be true to successfully compute d and what is a direct consequence of computing it?",
        "choices": [
            "A: Primes p and q must satisfy p = 2 mod 3 and q = 2 mod 3, and once d is computed, it can be used to efficiently compute inverses modulo n.",
            "B: Primes p and q must be congruent to 1 mod 4, and computing d allows one to find the totient function phi(pq).",
            "C: It is necessary for p and q to be twin primes, and computing d will enable the decryption of messages encrypted with RSA.",
            "D: No specific congruence relationships are required for p and q, and computing d makes it possible to factorize n."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "computation"
    },
    {
        "id": "73e09b23-7146-401b-8152-e6d121353c3a",
        "source": "owasp_mastg",
        "question": "You are reviewing an Android application to determine if it is ready to implement fingerprint authentication. Given the following conditions, select which ones must be satisfied before offering fingerprint authentication to users. (Select all that apply)",
        "choices": [
            "A: The device must run Android 6.0 or higher (API 23+).",
            "B: The user must have at least one credit card registered on the device.",
            "C: The application must have the 'android.permission.USE_FINGERPRINT' permission.",
            "D: The application must be able to access the Internet."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "android.permission.USE_FINGERPRINT"
    },
    {
        "id": "245e5aa5-ca50-4bf2-ac97-832de07e6a42",
        "source": "attck",
        "question": "If an adversary decides to purchase information from closed sources, such as dark web markets or technical data vendors, which of the following reasons could explain this action according to a framework analyzing adversary tactics and techniques based on real-world observations?",
        "choices": [
            "A: To gain information that could assist in phishing or establishing operational resources.",
            "B: To test their own security systems against potential breaches by external actors.",
            "C: To attract attention from law enforcement and security researchers as a form of misdirection.",
            "D: To invest in legitimate market research for competitive business intelligence."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Information Gathering"
    },
    {
        "id": "a2458509-f3b0-46bb-96ef-7d16d51496c3",
        "source": "cs161_textbook",
        "question": "In a scenario where Alice and Bob are using a shared secret key to ensure the secure exchange of messages, why is it crucial for the effectiveness of Message Authentication Codes (MACs) that the secret key remains known only to Alice and Bob?",
        "choices": [
            "A: If an adversary knows the secret key, they could decrypt the message contents, violating the confidentiality of the communication.",
            "B: Knowledge of the secret key by an adversary would allow them to generate valid MACs, compromising the integrity and authenticity of the messages.",
            "C: The secret key is required for the recipient to decrypt the message and is irrelevant to the function of MACs.",
            "D: Sharing the secret key with third parties would increase the computational overhead for generating and verifying MACs."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Secret Key"
    },
    {
        "id": "36c5c864-7dca-4d27-9797-9bc65bf50d6f",
        "source": "apple_platform_security",
        "question": "A user intends to add their corporate badge to Apple Wallet on their iPhone and Apple Watch. Consider the process and the security features Apple has implemented for such operations. From the options below, select the correct statements that apply to this scenario:",
        "choices": [
            "A: The user can automatically add the badge to their paired Apple Watch without installing the partner's app.",
            "B: The badge can be used to seamlessly access office amenities utilizing express mode.",
            "C: The provisioning process for the badge does not require multifactor authentication for the user's account.",
            "D: Apple or Apple servers store details about when or where the user uses their corporate badge."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Apple Wallet"
    },
    {
        "id": "0d59d765-fa2d-4d6a-a405-a1aa5c76ada4",
        "source": "mit6.858",
        "question": "An attacker is targeting an online service with the intent of exploiting security mechanism flaws. Based on common issues with security mechanisms, which of the following scenarios could allow the attacker to succeed? (Choose all that apply.)",
        "choices": [
            "A: The online service's website has rate-limiting on login attempts, but an API used for a password recovery feature does not implement rate-limiting.",
            "B: A credit card web application performs proper access control checks on the login page but fails to verify the user's session when direct URLs to account pages are accessed.",
            "C: The random number generator used in the service's cryptographic functions has been thoroughly vetted and is seeded properly with high-quality entropy sources.",
            "D: The service uses a complex encryption algorithm that has not been publicly analyzed, believing that its obscurity provides an additional layer of security."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "security_mechanisms"
    },
    {
        "id": "b38726cd-82cd-4477-ada1-bd191fda19c1",
        "source": "owasp_wstg",
        "question": "Consider a web application built using a framework that allows automatic binding of user input to model objects. A developer has created the following controller to handle new user sign-ups in a Java web application:\n\njava\n@RequestMapping(value = \"/signup\", method = RequestMethod.POST)\npublic String signUp(User newUser) {\n    userRepository.save(newUser);\n    return \"success\";\n}\n\n\nThe associated `User` model is as follows:\n\njava\npublic class User {\n   private String name;\n   private String email;\n   private boolean isVerified;\n   // Getters and Setters\n}\n\n\nWhich of the following HTTP POST requests could potentially exploit a Mass Assignment vulnerability, assuming no additional security measures are in place?",
        "choices": [
            "A: POST /signup name=alice&email=alice@example.com",
            "B: POST /signup name=alice&email=alice@example.com&isVerified=true",
            "C: POST /signup name=alice&email=alice@example.com&isAdmin=true",
            "D: POST /signup name=alice&email=alice@example.com&accountBalance=100000"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Mass Assignment"
    },
    {
        "id": "6f705495-73e4-45ea-ad41-1aa86f6592ab",
        "source": "attck",
        "question": "In the context of network security, when monitoring for potential encrypted command and control (C2) communications, which of the following anomalies should be considered indicative of malicious activity?",
        "choices": [
            "A: Traffic patterns that strictly adhere to well-known protocol standards.",
            "B: Extraneous packets that are part of established traffic flows.",
            "C: Traffic flows that include packets not adhering to the expected protocol standards.",
            "D: A decrease in the volume of traffic during peak business hours."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "10fb6e78-dd36-42b5-b54b-e1277ea0cccb",
        "source": "apple_platform_security",
        "question": "A user has enabled Advanced Data Protection for iCloud to secure their cloud data. However, the user later decides to enable web access to their data at iCloud.com. What must the user do each time they attempt to sign in to iCloud.com following this change?",
        "choices": [
            "A: The user must perform two-factor authentication with an SMS code received on a trusted device.",
            "B: The user must authorise the web sign-in on one of their trusted devices each time they visit iCloud.com.",
            "C: The user will be able to access their data without additional steps since the keys are stored in iCloud Hardware Security Modules.",
            "D: The user must reset their Apple ID password to re-sync their service keys for web access."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Advanced Data Protection"
    },
    {
        "id": "3d34c08c-a1ff-47fd-b0c5-5e56a0d7161b",
        "source": "cwe",
        "question": "When designing a system that processes numerical data, which of the following strategies should be employed to mitigate the risk of integer overflow or wraparound, and why might other options be less effective?",
        "choices": [
            "A: Always use the largest available integer type to prevent overflow situations.",
            "B: Implement strict protocol conformance to ensure out-of-bounds behavior is identified.",
            "C: Rely exclusively on client-side validation for performance efficiency.",
            "D: Utilize a vetted library that provides constructs to handle integers safely."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategy"
    },
    {
        "id": "43d90b11-4a76-41ec-8b00-4342a15ebe04",
        "source": "cwe",
        "question": "Consider a scenario where a Java object's finalize method is implemented without a call to super.finalize(). What are the potential consequences of this approach?",
        "choices": [
            "A: It can cause the object to be ineligible for garbage collection, leading to memory leaks.",
            "B: It may result in the incomplete finalization of an object's superclass, potentially leaving allocated resources unfreed.",
            "C: The object might be collected too soon, causing premature disposal of its resources.",
            "D: It could lead to a more efficient garbage collection process as there are fewer method calls involved."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "garbage_collection"
    },
    {
        "id": "3629347a-d25a-41f3-9816-90b36677b918",
        "source": "attck",
        "question": "A penetration tester has been tasked with evaluating the security of a macOS-based application. During the assessment, they identify that the application's plist file could be modified to facilitate malicious activity. Which of the following actions could an adversary potentially perform by modifying key-value pairs in plist files?",
        "choices": [
            "A: Increase the encryption strength of data stored by the application.",
            "B: Enable persistence by adding a malicious application path to the `~/Library/Preferences/com.apple.dock.plist` file.",
            "C: Prevent the application from ever being executed again on the system.",
            "D: Run the application in the background by modifying the `LSUIElement` key."
        ],
        "answer": "BD",
        "topics": [
            "PenTest",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Plist File Modification"
    },
    {
        "id": "d437b927-daa1-45d4-bc9f-9ec6d522ab8b",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the behavior of various malware strains that have been reported to download additional files or tools to a compromised system. Which of the following is NOT an accurate method of file transfer or update as demonstrated by the specific malware examples?",
        "choices": [
            "A: Using the Dropbox API to request and download files.",
            "B: Employing MSI files to download and execute additional files.",
            "C: Downloading payloads via GIF images disguising as backdoors.",
            "D: Sending files to a remote printer queue for execution."
        ],
        "answer": "D",
        "topics": [
            "PenTest"
        ],
        "keyword": "Malware payload delivery"
    },
    {
        "id": "ba70e36b-6460-4bef-947b-cf55b6f62024",
        "source": "owasp_mastg",
        "question": "In the context of mobile application security testing, why is it necessary to install the CA certificate of your interception proxy on the mobile device you are testing?",
        "choices": [
            "A: To prevent the mobile application from detecting and blocking the interception proxy.",
            "B: To allow the interception proxy to decrypt and analyze encrypted HTTPS traffic.",
            "C: To increase the speed of the network traffic between the mobile device and the interception proxy.",
            "D: To enable the interception proxy to inject malicious payloads into the traffic for vulnerability assessment."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CA Certificate Installation"
    },
    {
        "id": "1e4fb44e-fd63-47f3-8a7e-d33d9f944e0c",
        "source": "owasp_mastg",
        "question": "You are tasked with securing a mobile application that must encrypt sensitive data before storage. Which of the following approaches to initializing the encryption process is recommended for ensuring the confidentiality and integrity of the data?",
        "choices": [
            "A: Using a cryptographically secure random number generator to produce a unique and non-predictable initialization vector (IV) for each encrypted message.",
            "B: Reusing a single, hard-coded initialization vector (IV) for all encrypted messages to maintain consistency across application sessions.",
            "C: Employing a predictable IV that increments with each new message to simplify the decryption process for authorized users.",
            "D: Choosing a well-known string as the IV to ensure that the encryption algorithm can be easily implemented on different platforms."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Initialization Vector (IV)"
    },
    {
        "id": "287a7599-6e41-4a30-b53e-be09d4dd2177",
        "source": "windows_security",
        "question": "In the context of Windows security, consider the implications of a security event that indicates a user account has been locked out. What are the potential causes that could trigger this security event, and what should be considered when investigating it?",
        "choices": [
            "A: Repeated login attempts with incorrect credentials",
            "B: Scheduled tasks with outdated credentials",
            "C: An attempt to change the account's password",
            "D: Automated services running with the correct credentials"
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Event Logging"
    },
    {
        "id": "dda9364e-c19c-4674-991c-14b089338275",
        "source": "cwe",
        "question": "A developer claims that their code is self-explanatory and therefore doesn't need detailed documentation for each callable function. Select the most compelling counterargument that highlights the security risk of skipping detailed documentation.",
        "choices": [
            "A: Well-documented code is easier to maintain and update, which is good for the organization's codebase health.",
            "B: Lack of detailed documentation can lead to misuse or misunderstanding of the function, potentially introducing security vulnerabilities.",
            "C: Documenting code can be a time-consuming process, and in fast-paced development environments, it might slow down release cycles.",
            "D: Detailed documentation is often required by industry standards and regulations, and not following them can result in compliance issues."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Counterargument"
    },
    {
        "id": "2bd1645d-ecc0-49b1-8a3e-ddc2f0c68ab5",
        "source": "apple_platform_security",
        "question": "A user with Advanced Data Protection enabled on their iCloud account loses access to all trusted devices and has outdated recovery contact information. Which of the following statements accurately reflect the user's situation and data recovery prospects?",
        "choices": [
            "A: Apple can help the user recover most of their data because the iCloud HSMs store a copy of the service keys.",
            "B: The user's iCloud Backup keybag, which contains asymmetric keys, is used for restoring their files from the iCloud Backup service.",
            "C: If the user's recovery methods fail, Apple cannot assist in recovering the user's end-to-end encrypted iCloud data.",
            "D: Changing the iCloud password will invalidate existing backups, preventing data recovery."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Data Recovery"
    },
    {
        "id": "fa4ab592-ad7c-494e-9a41-5f1bf5f6fa93",
        "source": "attck",
        "question": "An adversary is attempting to perform a remote system discovery to facilitate lateral movement within a compromised network. Which of the following techniques would NOT commonly be used for this purpose?",
        "choices": [
            "A: Analyzing local Arp cache entries to discover remote systems.",
            "B: Using network scanning tools such as NBTscan to identify available servers.",
            "C: Leveraging email phishing to trick users into revealing their system IP addresses.",
            "D: Executing the `net view` command to enumerate domain machines."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Remote System Discovery"
    },
    {
        "id": "0cfb0d06-083d-4df1-8502-878579c7aa64",
        "source": "android_sec_doc",
        "question": "Which Keymaster Authorization Tag would be least beneficial to use when generating or importing a key that requires high entropy binding to application-specific data?",
        "choices": [
            "A: Tag::APPLICATION_DATA",
            "B: Tag::ATTESTATION_ID_MODEL",
            "C: Tag::ATTESTATION_CHALLENGE",
            "D: Tag::ASSOCIATED_DATA"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "High Entropy Binding"
    },
    {
        "id": "af868820-1a0f-4ee3-81a6-8443c261aca1",
        "source": "android_sec_doc",
        "question": "You are tasked with customizing SELinux policies for an Android device as part of the manufacturer's development team. Your goal is to ensure compatibility with existing applications while implementing necessary security measures for new system components. Which of the following actions align with the recommended practices for customizing SELinux on Android?",
        "choices": [
            "A: Remove existing SELinux policies that appear to be redundant with your new policies to streamline the policy files.",
            "B: Submit your customized SELinux policy changes to the Android Open Source Project (AOSP) if they may benefit others.",
            "C: Allow end-users to customize SELinux policies to enhance the user experience by providing more flexibility in security settings.",
            "D: Make new domains permissive initially to monitor for any denials and refine your domain definitions based on the results."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux"
    },
    {
        "id": "4893133e-2282-4250-be9c-4a6ca1f2a8e7",
        "source": "owasp_wstg",
        "question": "Consider the following code snippet from a web application using the Flask framework with the Jinja2 templating engine. The code is intended to display personalized greetings to users by embedding user input into the template:\n\npython\n@app.route(\"/greet\")\ndef greet_user():\n    user_name = request.args.get('name')\n    greeting = render_template_string(\"Hello {{ user_name }}!\")\n    return greeting\n\n\nWhich of the following statements is true regarding the security of this code snippet?",
        "choices": [
            "A: The code is secure against SSTI because Flask's render_template_string method automatically sanitizes user input.",
            "B: The code is vulnerable to SSTI because user input is not sanitized before being passed to the template engine.",
            "C: The code is secure against SSTI because the 'name' parameter is directly used within the template without any control structures.",
            "D: The code is vulnerable to XSS but not to SSTI, as Jinja2 does not execute server-side code."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Server-Side Template Injection (SSTI)"
    },
    {
        "id": "3af82b04-1f15-4f5c-a9fa-ece25b85e9c6",
        "source": "attck",
        "question": "A network security analyst is reviewing logs and notices unusual activity that suggests an adversary may be performing system network configuration discovery. Which pair of techniques would provide the adversary with configuration and settings details, such as IP addresses, MAC addresses, and route information? Select two.",
        "choices": [
            "A: Analyzing the HTTP headers for X-Forwarded-For to reveal internal IP configurations.",
            "B: Issuing `show ip route` on a network device CLI to view static and dynamic routes.",
            "C: Deploying a rogue DHCP server to force reallocation of IP addresses and collect network information.",
            "D: Running `nbtstat` to list NetBIOS over TCP/IP statistics, including name tables and resolved names."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "show ip route"
    },
    {
        "id": "19417ef5-3eab-4aa1-aeda-84ebd15b2719",
        "source": "cwe",
        "question": "Which of the following code snippets likely contains a function call with an incorrect argument type that could lead to weaknesses?",
        "choices": [
            "A: function calculateInterest(principal, rate) { /* ... */ }\ncalculateInterest('1000', 0.05);",
            "B: function authenticateUser(userId, passwordHash) { /* ... */ }\nauthenticateUser(1023, calculateHash(password));",
            "C: function setItemPrice(itemCode, price) { /* ... */ }\nsetItemPrice('A01', true);",
            "D: function appendLog(logs, message) { /* ... */ }\nappendLog(currentLogs, 'User logged in at ' + new Date());"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "TypeSafety"
    },
    {
        "id": "10c18dfa-5306-448e-8d51-3ad3becc59a1",
        "source": "mit6.858",
        "question": "In a system where Key Transparency is implemented, a corrupt key server decides to deceive a user by returning a false key. What are the potential outcomes of this deception, considering the mechanisms of Key Transparency?",
        "choices": [
            "A: The server must put the false key-to-user mapping in the log, risking exposure when the legitimate user checks the log.",
            "B: The server doesn't change the log but returns the false key anyway, risking exposure when key requesters verify the log.",
            "C: The server can avoid detection indefinitely by using sophisticated encryption methods to mask the false key.",
            "D: The server can fork the log, maintaining different versions for different users, without any risk of exposure."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Key_Transparency"
    },
    {
        "id": "8ef323bb-d6db-4464-a612-4875aff3ad16",
        "source": "mit6.858",
        "question": "A software team is working to enhance the security of their application's sandbox environment. They need to ensure that certain data structures are not susceptible to double-fetch bugs. Which of the following approaches would be effective in achieving this objective?",
        "choices": [
            "A: Implement a mechanism that marks data structures as 'freezable', preventing reads unless they are frozen.",
            "B: Allow the sandbox to modify the original data structure directly to ensure consistency.",
            "C: Create a snapshot of the entire data structure when it is frozen, which is then used for reads.",
            "D: Use a mutable global state accessible by both the sandbox and the main application for shared data."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "Sandbox"
    },
    {
        "id": "d2589dec-e16e-4534-bfb4-90041a4e15dd",
        "source": "attck",
        "question": "In the context of monitoring cloud environments for security threats, which of the following detection techniques would NOT be suitable for identifying data exfiltration through the creation and transfer of backups to another account within the same cloud provider?",
        "choices": [
            "A: Monitoring account activity for attempts to share snapshots or backups with untrusted or unusual accounts.",
            "B: Observing network traffic content for evidence of data exfiltration, such as gratuitous internal traffic containing collected data.",
            "C: Periodically baselining snapshots to identify malicious modifications or additions.",
            "D: Scanning for malware signatures in network traffic to detect the presence of unauthorized data backups."
        ],
        "answer": "D",
        "topics": [
            "PenTest",
            "NetworkSecurity",
            "WebSecurity"
        ],
        "keyword": "Network Traffic Content"
    },
    {
        "id": "91d8a1a1-560d-47af-9241-9993e52545ac",
        "source": "owasp_mastg",
        "question": "A mobile application utilizes Android Keystore for storing cryptographic keys. When implementing a secure key attestation process, which steps should the server take to ensure the integrity and security of the attestation process? Select two.",
        "choices": [
            "A: The server should generate a random number using a simple random number generator and send it to the client as a challenge.",
            "B: The server should verify the signature in the key attestation response and extract the attestation certificate extension data.",
            "C: The server should use a static value as a challenge for the attestation to ensure consistency between sessions.",
            "D: The server should verify the client's status including verified boot key, locked bootloader, and verified boot state."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Key Attestation"
    },
    {
        "id": "fc480623-c9e0-40ad-931c-c334fb62007c",
        "source": "owasp_wstg",
        "question": "An attacker is attempting to use an XML External Entity (XXE) attack to read the contents of the /etc/passwd file on a server hosting a web application that processes XML input. Which of the following XML payloads would potentially allow the attacker to accomplish this goal?",
        "choices": [
            "A: <?xml version=\"1.0\"?><!DOCTYPE data [<!ENTITY file SYSTEM 'file:///etc/passwd'>]><credentials>&file;</credentials>",
            "B: <?xml version=\"1.0\"?><credentials><username>&file;</username><password>&file;</password></credentials>",
            "C: <?xml version=\"1.0\"?><!DOCTYPE data [<!ENTITY file PUBLIC 'file:///etc/passwd'>]><credentials>&file;</credentials>",
            "D: <?xml version=\"1.0\"?><!DOCTYPE data [<!ELEMENT credentials ANY><!ENTITY file ELEMENT 'file:///etc/passwd'>]><credentials>&file;</credentials>"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "XML External Entity (XXE) Attack"
    },
    {
        "id": "ac4ac102-50d1-42a4-adc0-5d602a3b6fce",
        "source": "windows_security",
        "question": "Which of the following security measures would be most effective in protecting a Windows device from unauthorized memory access through PCI-connected devices when they are plugged in after the system has booted?",
        "choices": [
            "A: Implementing full disk encryption to protect data at rest.",
            "B: Enabling a hardware-based firewall to monitor inbound and outbound traffic.",
            "C: Activating a protection mechanism against direct memory access attacks via PCI hot plug devices.",
            "D: Applying regular expression matching to inspect and filter out malicious payloads in network traffic."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Kernel DMA Protection"
    },
    {
        "id": "94ad635a-ff05-4af0-b521-798e7f3ff9f0",
        "source": "owasp_wstg",
        "question": "Consider a web application for an online bookstore that allows users to browse books, add them to their cart, and proceed to checkout. If a user discovers that by intercepting the request during checkout and modifying the price parameter, they can reduce the cost of the book to a lower, unauthorized price, which of the following is the most likely outcome of exploiting this business logic flaw?",
        "choices": [
            "A: The application will complete the transaction at the reduced price, resulting in financial loss to the bookstore.",
            "B: The application will recognize the price discrepancy, alert the user, and request to proceed at the correct price.",
            "C: The application will automatically generate a discount coupon equal to the price modification attempted by the user.",
            "D: The application will donate the equivalent amount of the price discrepancy to a literacy charity."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Business Logic Vulnerability"
    },
    {
        "id": "ee2b0f00-0514-4c31-b320-ea25027825bb",
        "source": "cwe",
        "question": "In the context of software design, which of the following design examples could potentially result in a 'Resource Leak' due to improper management of private resources?",
        "choices": [
            "A: Implementing a singleton pattern for a database connection pool that restricts the number of simultaneous connections.",
            "B: Designing an event logging mechanism that inadvertently logs sensitive user information to a public log file.",
            "C: Creating a user authentication module that hashes and salts passwords before storing them.",
            "D: Using a third-party library to handle payment processing without vetting the library for compliance with security standards."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Design Vulnerability"
    },
    {
        "id": "313bf095-5e6c-4458-85a1-4fbb5416d9ee",
        "source": "attck",
        "question": "An organization is evaluating different defense strategies to mitigate phishing attacks. Which of the following strategies can help prevent initial access through phishing but may require additional user training to be effective?",
        "choices": [
            "A: Automatically quarantining suspicious files using antivirus/antimalware solutions.",
            "B: Restricting web-based content to block websites or attachment types commonly used in phishing.",
            "C: Monitoring call logs from corporate devices for patterns of voice phishing.",
            "D: Implementing a strict bring-your-own-device policy to reduce the attack surface."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Phishing Mitigations"
    },
    {
        "id": "b47d62b5-faca-40ea-9694-de9a565dae0b",
        "source": "windows_security",
        "question": "As an IT administrator, you are configuring the 'Network access: Remotely accessible registry paths' policy on your company's Windows servers. Your goal is to enhance security without disrupting essential remote management tools. Which of the following options aligns with the recommended best practices?",
        "choices": [
            "A: Disable the policy setting entirely to prevent any remote access to the registry.",
            "B: Enable the policy setting and specify only the paths that remote management tools require.",
            "C: Set the policy to a null value, enabling the setting but leaving the paths text box empty.",
            "D: Enable the Remote Registry service without setting any policy to simplify management."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Network access: Remotely accessible registry paths"
    },
    {
        "id": "2d206ff3-110f-4004-bb2c-1fe3cf5a331b",
        "source": "windows_security",
        "question": "A system administrator is tasked with configuring System Guard Secure Launch to enhance the startup security of their organization's Windows 11 devices. Which of the following sets of steps correctly describes a method to enable this feature?",
        "choices": [
            "A: Open Windows Security, navigate to Device security > Core isolation > Firmware protection, and enable Secure Launch.",
            "B: In the Group Policy editor, go to User Configuration > System > Device Guard and enable Secure Launch Configuration.",
            "C: Create a new DWORD named 'Enabled' with a value of '0' within the 'SystemGuard' key in the Windows Registry to enable Secure Launch.",
            "D: Configure DeviceGuard policies using Policy CSP for Mobile Device Management (MDM) to enable System Guard Secure Launch."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "System Guard Secure Launch"
    },
    {
        "id": "b7184eb8-efee-4edf-a2d7-116a58944e93",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating a potential breach in an enterprise network. During the investigation, they notice multiple instances of external queries for system time information. Which of the following could be potential reasons for adversaries to collect this information? (Choose two.)",
        "choices": [
            "A: To maintain time synchronization between systems for legitimate network operations.",
            "B: To perform timing-based attacks such as executing a payload with a Scheduled Task/Job.",
            "C: To generate rainbow tables for password cracking using time-stamped data.",
            "D: To determine locality information for victim targeting or for use in a time bomb."
        ],
        "answer": "BD",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "System Time Discovery"
    },
    {
        "id": "de0831ea-456d-4125-90eb-5dafba7e9d4b",
        "source": "android_sec_doc",
        "question": "A Trusted Execution Environment (TEE) implementer is deciding on the appropriate tooling for specifying hardware interfaces within an Android environment. They want to ensure that the chosen tooling will allow for efficient and language-independent interface specification. Which tooling should the implementer select and why might the other options not be as suitable?",
        "choices": [
            "A: Java interfaces because they provide a more secure environment for TEE implementation.",
            "B: C++ tooling provided by HIDL as it is expected to be more convenient for TEE implementers.",
            "C: Python tooling because it simplifies the process of code maintainability and readability.",
            "D: Kotlin interfaces as they offer better integration with modern Android development practices."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "HIDL"
    },
    {
        "id": "96522387-c49f-469a-84a2-de327d97f5fb",
        "source": "cwe",
        "question": "A developer is reviewing a section of code before deployment and comes across a comment stating '// TODO: Implement error handling here.' What is the most likely consequence of ignoring this comment and proceeding with deployment?",
        "choices": [
            "A: Increased code clarity as the comment clearly indicates areas for future improvement.",
            "B: Potential security risks due to the lack of proper error handling, which might lead to unhandled exceptions or crashes.",
            "C: Improved application performance since error handling can sometimes add unnecessary processing overhead.",
            "D: No impact on the application as comments are ignored at compile time and do not affect the runtime behavior."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "ErrorHandling"
    },
    {
        "id": "2d30e5f3-589d-40a2-9ce2-3011abeeb0b2",
        "source": "android_sec_doc",
        "question": "A developer is tasked with managing SELinux policy files for an Android device. The developer must decide where to install mapping files for the system_ext and product partitions to ensure compatibility and ease of maintenance. What are the advantages of placing a CIL file containing the mapping information in `{SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS}/compat/{ver}/{ver}.cil` and `{PRODUCT_PRIVATE_SEPOLICY_DIRS}/compat/{ver}/{ver}.cil`, and adding them to `PRODUCT_PACKAGES`?",
        "choices": [
            "A: It guarantees automatic compatibility with future platform versions without any additional intervention.",
            "B: It allows partners to maintain compatibility by providing their own versioned attributes for policy files.",
            "C: It ensures that the vendor partition will automatically export the designated public types without the need for mapping files.",
            "D: It prevents any future changes in the public sepolicy, ensuring that the private policy remains unchanged."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SELinux policy"
    },
    {
        "id": "59530205-2a88-409a-b32e-9583777735fb",
        "source": "attck",
        "question": "During a cybersecurity operation, you are tasked with monitoring potential adversary behavior. Which of the following would not be a typical data source or component to monitor based on standard detection practices?",
        "choices": [
            "A: Network traffic content for anomalies in established traffic flows or protocol standards.",
            "B: Social media activity for personas claiming affiliation with your organization or making numerous connection requests to your staff.",
            "C: USB device usage to identify unauthorized data transfer or malicious software introduction.",
            "D: Command line arguments associated with anomalous traffic patterns."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "40bb7f25-38cb-40f6-bc1f-d3f161088d84",
        "source": "windows_security",
        "question": "A company is auditing their Windows domain controllers to ensure that only appropriate accounts have certain privileges. Which of the following privileges should be carefully reviewed to prevent potential abuse? Select two.",
        "choices": [
            "A: A privilege that allows a process to impersonate any user without authentication, potentially accessing sensitive resources.",
            "B: A privilege that allows a user to adjust the brightness and contrast settings on the system's monitor.",
            "C: A privilege that enables a user to synchronize all directory service data, which could include sensitive information.",
            "D: A privilege that allows a user to modify system sounds and notification settings."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Windows Security Privileges"
    },
    {
        "id": "7c7607cc-6038-450b-9eeb-101589d71f50",
        "source": "cwe",
        "question": "An application uses the following regular expression to validate filenames before passing them to a command that lists the file details: /^[\\w\\-]+$/. Despite this validation, the application is still vulnerable to command injection. Why is the validation not effective in preventing this vulnerability?",
        "choices": [
            "A: The validation does not enforce the presence of a file extension, which is necessary to prevent command injection.",
            "B: The regular expression allows filenames to start with a '-', which could be interpreted as an option flag by the command-line interpreter.",
            "C: Using regular expressions for validation is inherently insecure and cannot prevent any form of injection.",
            "D: The validation allows whitespace characters, which can be used to separate commands and introduce malicious payloads."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Validation"
    },
    {
        "id": "7c413169-9154-4970-8d35-5ab53e754c82",
        "source": "attck",
        "question": "An adversary has gained user-level access to a corporate network and is performing reconnaissance. Which of the following reasons is most likely why the adversary would execute a command to obtain currently mounted disks and associated freely available space?",
        "choices": [
            "A: To prepare for data exfiltration by ensuring sufficient space is available on their own servers.",
            "B: To decide whether to fully infect the target based on available disk space for payload accommodation.",
            "C: To disrupt network services by filling up disk space with junk data.",
            "D: To assess the feasibility of a ransomware attack by analyzing data storage patterns."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "System Information Discovery"
    },
    {
        "id": "b8de5c0e-0ffe-4e0e-aa2f-aeb96ba377a0",
        "source": "attck",
        "question": "In a post-incident analysis of a ransomware attack, it was discovered that the malware had the capability to stop or disable various services on the victims' systems. One of the proposed mitigation strategies includes restricting file and directory permissions. Which statement provides the best counterargument to the claim that this strategy alone would be sufficient to prevent service disruptions?",
        "choices": [
            "A: Restricting file and directory permissions does not prevent adversaries from using operating system APIs to stop services directly.",
            "B: Adversaries might avoid detection by intrusion detection systems even if file and directory permissions are restricted.",
            "C: Restricting file and directory permissions can inadvertently hinder legitimate user access and disrupt business operations.",
            "D: Network segmentation is the only effective mitigation strategy, making other strategies like restricting permissions redundant."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "OS API Execution"
    },
    {
        "id": "6cceeba1-c6c0-42f5-9b5c-089e8ed0af8f",
        "source": "cwe",
        "question": "In the context of secure boot or verified boot for a System-on-Chip (SoC), which of the following practices would not contribute to the security of the attestation process?",
        "choices": [
            "A: Calculating the one-way hash of the code binary and extending it to the previous hash.",
            "B: Allowing measurement registers to be writable under specific conditions defined by a trusted agent.",
            "C: Ensuring the calculated hash is stored in a non-modifiable register post-boot.",
            "D: Using a Secure One-Way hash function for the measurement process."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "AttestationSecurity"
    },
    {
        "id": "240d278e-4930-4658-9a41-5dfd298e33dd",
        "source": "android_sec_doc",
        "question": "An Android developer proposes merging the FaceService and faced components into a single executable to streamline the face authentication process. Which of the following arguments provides the most substantial reason against this design change?",
        "choices": [
            "A: It would simplify the face authentication process, therefore reducing the security measures currently in place.",
            "B: Combining the components would violate the separation of concerns principle and potentially introduce stability and security issues.",
            "C: The merge would prevent apps from using the BiometricPrompt API, which is essential for face authentication.",
            "D: It would make it impossible for the FaceManager to maintain a connection with the FaceService, disrupting the authentication process."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "FaceService and faced components"
    },
    {
        "id": "9b968000-b54a-4fa5-8a39-1e1de223b43d",
        "source": "cwe",
        "question": "A debate is ongoing about the importance of firmware update capabilities in Internet-connected devices. One argument claims that external security measures are sufficient to protect devices without firmware update capabilities. Which of the following best counters this argument?",
        "choices": [
            "A: Firmware updates are not necessary if the device is not storing any sensitive information.",
            "B: Specifying requirements for firmware updates and ensuring integrity checks can prevent installing untrusted firmware, countering the need for external measures.",
            "C: Designing devices to be disposable after a short period can be more cost-effective than implementing firmware updates.",
            "D: External security measures cannot correct the root weakness in the firmware, leaving devices permanently vulnerable."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Firmware_Update"
    },
    {
        "id": "e46b299e-cc72-4515-b543-9036ad8c7e27",
        "source": "owasp_wstg",
        "question": "In reviewing the security controls of a web application, you notice that the application locks out accounts after three failed authentication attempts. Which of the following is a valid criticism of this defense mechanism?",
        "choices": [
            "A: Such a mechanism effectively prevents brute-force attacks by limiting the number of guesses an attacker can make.",
            "B: This control may lead to denial of service for legitimate users if an attacker deliberately fails authentication attempts.",
            "C: Locking accounts increases the complexity of the system, thus reducing overall security.",
            "D: The mechanism is ineffective because brute-force attacks are no longer a common threat vector."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Account Lockout"
    },
    {
        "id": "759c61b5-b5e3-44eb-8990-54a8ef08a949",
        "source": "windows_security",
        "question": "An application developer is creating a service that needs to create named file mapping objects accessible across different Terminal Services sessions. However, the service does not need to interact with the security log or backup files and directories. Which of the following privileges is essential for the developer to grant to the service?",
        "choices": [
            "A: SeCreateGlobalPrivilege",
            "B: SeBackupPrivilege",
            "C: SeAuditPrivilege",
            "D: SeCreatePermanentPrivilege"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Named File Mapping Objects"
    },
    {
        "id": "02e498af-67a1-4cc1-9c97-6b0a2b68aecc",
        "source": "attck",
        "question": "As an incident responder investigating a suspected data breach, you've observed that large amounts of data have been collected by an adversary. To minimize network detection, the adversary is likely to employ certain techniques before exfiltrating the data. Which of the following methods might the adversary use to achieve this goal? Select all that apply.",
        "choices": [
            "A: Compress the data using common archiving tools to reduce its size.",
            "B: Encrypt the data using a custom algorithm to alter its appearance.",
            "C: Increase the data size to exceed the monitoring threshold limits.",
            "D: Encode the data using an encoding scheme not commonly associated with binary data."
        ],
        "answer": "AB",
        "topics": [
            "PenTest",
            "Vulnerability",
            "NetworkSecurity"
        ],
        "keyword": "Data exfiltration"
    },
    {
        "id": "66628aa0-affe-4ee0-9c62-dc392f47a490",
        "source": "apple_platform_security",
        "question": "During the iCloud Keychain recovery process, which of the following conditions must be met for the escrow service to provide a copy of the user's keychain? (Select all that apply)",
        "choices": [
            "A: The user must authenticate with their iCloud account and password.",
            "B: The user must correctly answer security questions related to their Apple ID.",
            "C: The user must enter their iCloud security code after an SMS verification.",
            "D: The user must provide a fingerprint scan to authenticate their identity."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "KeychainRecovery"
    },
    {
        "id": "dd609dd9-1b2b-4b57-9eaa-bdba734e5279",
        "source": "attck",
        "question": "An organization's endpoint protection system flagged an alert indicating that a piece of malware is actively searching for files with specific extensions and modification times on compromised hosts. What could be the intention behind this targeted search by the malware?",
        "choices": [
            "A: The malware is attempting to identify the best network path for lateral movement.",
            "B: The malware is aggregating system metadata for a routine software update.",
            "C: The malware is collecting data for exfiltration or preparing for a data encryption attack.",
            "D: The malware is conducting a network scan to map out the organizational infrastructure."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Malware Data Collection"
    },
    {
        "id": "e55f1c19-3f92-47f1-9a54-3aee4f4ad84e",
        "source": "windows_security",
        "question": "A system administrator needs to perform maintenance on a fleet of company laptops, which includes undocking them without requiring users to log off. Which user privilege must be granted to the administrator to perform this action?",
        "choices": [
            "A: SeBackupPrivilege",
            "B: SeUnsolicitedInputPrivilege",
            "C: SeUndockPrivilege",
            "D: SeRestorePrivilege"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SeUndockPrivilege"
    },
    {
        "id": "9d69268f-e084-4609-a559-7b4dfd31f6d1",
        "source": "android_sec_doc",
        "question": "In the context of Trusty TEE's security, how does its isolation from the Android operating system contribute to its protection against security threats?",
        "choices": [
            "A: Isolation ensures that Trusty TEE can directly control all hardware components, reducing the risk of hardware-based attacks.",
            "B: Isolation by hardware and software prevents malicious apps and Android vulnerabilities from affecting Trusty TEE.",
            "C: Trusty TEE's isolation means it operates independently of the device's primary storage, making it immune to storage corruption.",
            "D: Isolated operation allows Trusty TEE to prevent any network-based attacks targeting the Android OS."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Trusty TEE Isolation"
    },
    {
        "id": "95727cd2-7327-4db4-9d8a-ec4f5b745271",
        "source": "owasp_wstg",
        "question": "When conducting web application security testing, which of the following is an activity that cannot be fully substituted by the use of in-browser developer tools and requires the use of specialized DAST or SAST tools, or extensive tester experience?",
        "choices": [
            "A: Editing and resending HTTP requests to test parameter handling",
            "B: Switching User-Agent strings to emulate different browsers",
            "C: Identifying and analyzing security vulnerabilities in source code",
            "D: Modifying cookie values to test session management"
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "SAST"
    },
    {
        "id": "5f0e6a39-332b-440f-b5d5-afe932413e01",
        "source": "owasp_mastg",
        "question": "A developer is preparing to release an Android application that needs to support devices running Android 6.0 (API level 23) up to the latest Android version. The developer wishes to ensure the application is securely signed and compatible with all supported versions. Which APK signing scheme(s) should the developer choose to sign the application?",
        "choices": [
            "A: APK Signature Scheme v3 (v3 scheme) only, as it is the most secure option provided by Android.",
            "B: APK Signature Scheme v2 (v2 scheme) or JAR signing (v1 scheme), to ensure compatibility with Android 6.0 and above.",
            "C: JAR signing (v1 scheme) only, as it is the most compatible across all Android versions.",
            "D: The developer should use a custom signing scheme that is not officially supported by Android for enhanced security."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "APK Signing"
    },
    {
        "id": "0b79c7d5-d38d-420a-a6e1-b23d012fa303",
        "source": "owasp_wstg",
        "question": "A team is developing a new web application that will manage sensitive financial transactions. They want to adopt best practices for web application security to protect against common vulnerabilities. Which of the following resources would provide the most comprehensive guidance specifically for their needs?",
        "choices": [
            "A: The OWASP Guide Project",
            "B: Software Testing Techniques, 2nd Edition by Boris Beizer",
            "C: The Art of Software Security Testing by Chris Wysopal et al.",
            "D: Mastering the Requirements Process by Suzanne Robertson and James Robertson"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OWASP Guide Project"
    },
    {
        "id": "aeb8ff51-2c9f-47cd-8793-815b330a8e2c",
        "source": "cwe",
        "question": "Consider a class 'BankAccount' that manages sensitive information such as account numbers and the balance. Which of the following modifications would enhance the security of the class by adhering to best practices for access control?",
        "choices": [
            "A: Declare the account number and balance as public and provide public setter methods to modify their values.",
            "B: Declare the account number and balance as private and provide public getter methods to read their values without allowing unauthorized modification.",
            "C: Implement the class without any methods, but keep account number and balance as protected, to be accessible by child classes only.",
            "D: Use public variables for account number and balance, but implement a public method that checks user permissions before allowing access."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "AccessControl"
    },
    {
        "id": "5db4c81a-28dd-47d1-8647-ff4bbddd93be",
        "source": "owasp_mastg",
        "question": "A mobile application developer has implemented new features that require access to sensitive user data. Which of the following code practices presents a risk to user privacy?",
        "choices": [
            "A: The app checks for user authorization using biometrics before displaying sensitive data such as credit card details.",
            "B: The app accesses the user's inventory of installed apps and sends it over a secure network connection without user consent.",
            "C: The app uses the App Tracking Transparency Framework to request user permission before tracking their activity on iOS devices.",
            "D: The app provides a recovery code to users for account recovery purposes and instructs them to never share it with anyone else."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Sensitive Data Handling"
    },
    {
        "id": "7217810a-fab5-4f69-951c-a90d29726ddd",
        "source": "apple_platform_security",
        "question": "An AR application uses ARKit's world tracking feature to enhance the user experience by providing Optical Heading in Maps. What are the potential privacy implications, and how can users manage their privacy in this context?",
        "choices": [
            "A: World tracking requires continuous GPS tracking, which may raise privacy concerns for users.",
            "B: Users can opt-out of including location data in photos and videos captured during AR experiences.",
            "C: The AR application can use world tracking without informing the users about the camera being active.",
            "D: World tracking relies only on the device's internal sensors and algorithms, not on GPS data."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "WorldTracking"
    },
    {
        "id": "8ca93f78-2870-4693-95f1-207476a06a87",
        "source": "apple_platform_security",
        "question": "An enterprise is deploying Single sign-on (SSO) for its iOS and iPadOS devices through a mobile device management (MDM) solution. As part of the SSO configuration, the enterprise needs to ensure that users can effortlessly authenticate to the services they are authorized to access using their Active Directory user accounts. Which of the following settings should be included in the MDM configuration profile payload to properly configure SSO for these devices?",
        "choices": [
            "A: Setting the user principal name and Kerberos realm settings.",
            "B: Configuring which apps and Safari web URLs should be allowed to use SSO.",
            "C: Enabling MAC address randomisation for the Wi-Fi connections.",
            "D: Installing an AirDrop security certificate on each device."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "SSO"
    },
    {
        "id": "394d03ab-f333-4bc7-b9ab-af1ae9f0adba",
        "source": "apple_platform_security",
        "question": "As a member of a smart home security team, you are evaluating the security measures in place for HomeKit accessories communication. Which of the following statements are accurate regarding the security and authentication techniques used?",
        "choices": [
            "A: HomeKit accessories do not generate their own key pairs and rely solely on the keys provided by iOS devices.",
            "B: To establish a relationship with a HomeKit accessory, keys are exchanged using Secure Remote Password protocol and an eight-digit code from the manufacturer.",
            "C: During setup, the accessory's MFi certification is not verified, and the focus is on software authentication only.",
            "D: Communication sessions between the iOS device and HomeKit accessory are established using the Station-to-Station protocol and encrypted with derived keys."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "HomeKit"
    },
    {
        "id": "523ac824-876e-42f5-8bf3-adf73f77b077",
        "source": "owasp_wstg",
        "question": "In the context of developing Flash applications, which of the following practices should a developer follow to prevent the application from being used as an open redirector?",
        "choices": [
            "A: Accept full URLs as FlashVars without any validation.",
            "B: Use only relative URLs when navigating within the same website.",
            "C: Ensure that all URLs start with 'http://' before passing them to FlashVars.",
            "D: Accept any URL as long as it includes the string 'trusteddomain.com'."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Open Redirector"
    },
    {
        "id": "f9e471db-c1d7-4c74-ad90-020bab9d1eeb",
        "source": "windows_security",
        "question": "As a system administrator, you receive a security alert that a user account has been locked out on a Windows client system. What should be your immediate actions following this alert to ensure system security and resolve the issue?",
        "choices": [
            "A: Disable the account to prevent further lockout events",
            "B: Investigate the cause of the lockout and check for unauthorized access attempts",
            "C: Ignore the alert, as user accounts are often locked out due to system errors",
            "D: Immediately restore the account access without investigating the lockout cause"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Account Lockout"
    },
    {
        "id": "538de01c-5805-4c48-b4ca-1e66398d6ded",
        "source": "owasp_wstg",
        "question": "A pen tester is evaluating the security of a web application by examining its HTML source code. The tester finds several META tags within the HEAD section of the document. Which of the following purposes of these META tags should be of particular interest to the tester for identifying potential security vulnerabilities?",
        "choices": [
            "A: META tags that specify the website's color theme and tile color, as they directly impact the application's user interface and user experience.",
            "B: META tags that include social networking previews and search engine indexing information, as they can inadvertently reveal paths, technology details, or functionality not intended for public disclosure.",
            "C: META tags that provide information about the website's content management system, as they are required for the proper operation of web spiders, robots, or crawlers.",
            "D: META tags that describe the document's character encoding, as incorrect character encoding could lead to security vulnerabilities like cross-site scripting attacks."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "META Tags"
    },
    {
        "id": "1a171294-11e7-4ee7-885a-d388e0be5d85",
        "source": "windows_security",
        "question": "A security audit is being conducted to evaluate the hardening measures applied to the Windows registry on company workstations. Which of the following configurations would NOT be considered a recommended security practice?",
        "choices": [
            "A: Applying a restrictive ACL to the RunOnce key to prevent malware persistence.",
            "B: Leaving the Run key with default ACL settings to ensure compatibility with third-party applications.",
            "C: Customizing the ACL for Auto-Execution Start Points keys to limit execution to authorized processes.",
            "D: Restricting access to registry keys known for being used by intruders for persistence."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ACL"
    },
    {
        "id": "fcd255c8-b5eb-446a-9aa0-8b2108e4d781",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately reflect the consequences of enabling specific System Integrity Protection (SIP) settings on macOS devices?",
        "choices": [
            "A: Enabling sip1 may improve troubleshooting flexibility but could reduce security by allowing SSV volume root hash verification failures.",
            "B: Enabling sip2 increases security by preventing the kernel memory from being marked as non-writable, hence protecting against certain memory-based attacks.",
            "C: Enabling sip3 enhances security by allowing any boot-args from NVRAM to be passed to the kernel, increasing configuration options.",
            "D: Disabling sip2 may be necessary for certain diagnostic procedures, but it exposes the system to increased risk of memory integrity attacks."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SIPConsequences"
    },
    {
        "id": "5b6fb352-13b1-4ed8-84c7-2062e9bdd49a",
        "source": "cs161_textbook",
        "question": "Alice wants to send 'n' units of Bitcoin to Bob. She creates a digital signature for the message 'PK_A sends n units of currency to PK_B'. Which of the following statements are true regarding this Bitcoin transaction process?",
        "choices": [
            "A: Alice's public key, PK_A, serves as her identity, and Bob's public key, PK_B, serves as his, allowing anyone to confirm Alice's intent to transact.",
            "B: Bitcoin's system allows for the recipient to reject a transaction by creating a subsequent transaction to return the funds.",
            "C: If Alice's private key is compromised, an attacker can falsify transactions from Alice to any recipient without detection.",
            "D: A centralized party is required to verify the validity of the transaction signature before it is accepted into the Bitcoin network."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Bitcoin"
    },
    {
        "id": "3b8b0bf2-bc51-4591-be28-932b53c48de3",
        "source": "attck",
        "question": "A financial institution is reviewing its cybersecurity posture against potential threats where adversaries may abuse server software components to establish persistence. Which of the following mitigation strategies should be prioritized to effectively reduce the risk of this threat?",
        "choices": [
            "A: Implement network segmentation to isolate sensitive data.",
            "B: Regularly audit component software on critical services for unexpected changes.",
            "C: Enforce strong, complex passwords for all user accounts.",
            "D: Install antivirus software on all endpoint devices."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Server Software Component"
    },
    {
        "id": "be6acb34-0d67-4e23-a098-df563c31eb3f",
        "source": "cs161_textbook",
        "question": "Consider the idea of a single global name server that handles all DNS requests for every domain on the Internet. Select the counterarguments that best explain why this concept is impractical.",
        "choices": [
            "A: The single server would be prone to frequent outages due to the high volume of DNS requests, which would severely impact global internet accessibility.",
            "B: A single server would create a monopoly, leading to increased costs for domain registration and potential abuse of power.",
            "C: It would violate privacy laws in certain jurisdictions, as all DNS queries would be centralized and could be easily monitored or censored.",
            "D: No single server is large enough to store the IP address of every domain or fast enough to handle the global volume of DNS requests."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Scalability"
    },
    {
        "id": "3ab6baf5-2400-4d9f-b786-1294165dddbd",
        "source": "cwe",
        "question": "Consider a web application where an internal directory listing has been inadvertently exposed due to misconfiguration, providing a complete index of all resources in the directory. To prevent sensitive information from being accessed by unauthorized users, which of the following design and configuration strategies could be employed? Select all that apply.",
        "choices": [
            "A: Implement user authentication and define access control policies that only allow users with the requisite permissions to view certain directories.",
            "B: Disable the web server feature that provides automatic directory listings to unauthorized users.",
            "C: Rename sensitive files and directories to use less predictable names, making them harder to guess by attackers.",
            "D: Increase the logging level of the web server to include all accessed files, which could deter attackers."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DirectoryListingMitigation"
    },
    {
        "id": "6bfdf59e-af99-451b-886f-63c7fec3ddaf",
        "source": "attck",
        "question": "An adversary has gained access to a company's network and executed a series of commands to inhibit system recovery efforts. Which of the following outcomes is a direct consequence of the adversary's actions?",
        "choices": [
            "A: The network's performance is optimized by freeing up system resources previously used for recovery operations.",
            "B: Backups and recovery options become inaccessible, denying the ability to restore the system to its pre-corrupted state.",
            "C: The system's security posture is improved by disabling outdated and potentially vulnerable recovery features.",
            "D: User account privileges are elevated to provide administrators with better control over the corrupted system."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Inhibit System Recovery"
    },
    {
        "id": "bf567492-f42a-493a-ae80-3c2e604264c0",
        "source": "apple_platform_security",
        "question": "An Apple device is about to receive a software update. Which of the following actions are part of the update process as designed by Apple to ensure the security and integrity of the update?",
        "choices": [
            "A: The update process verifies that the signature on the software update comes from an Apple-authorised source and matches the device’s unique ID.",
            "B: During an over-the-air update, the entire operating system is downloaded to optimize network bandwidth usage.",
            "C: The user’s data volume is mounted to allow the update to access user settings and configurations.",
            "D: A nonce is used during the update process to prevent replay attacks and ensure the software update is not tampered with."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "UpdateProcess"
    },
    {
        "id": "9ce50f17-3e30-41fa-a4f5-6c9c3b621631",
        "source": "cwe",
        "question": "Your team is reviewing the security of an application that generates temporary files. An audit reveals that temporary files are stored in a commonly accessible directory. What is the primary security risk associated with this practice, and what should be the main consideration for an alternative design?",
        "choices": [
            "A: The risk of file content interception and the main consideration should be encrypting the content of temporary files.",
            "B: The risk of denial-of-service attacks and the main consideration should be to implement rate-limiting on file creation.",
            "C: The risk of unintended actors determining the existence or accessing the files and the main consideration should be restricting directory permissions.",
            "D: The risk of file corruption and the main consideration should be to implement checksum verification for all temporary files."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DirectoryPermissions"
    },
    {
        "id": "b6cd5c86-b1b8-436c-8341-c131f5a357c6",
        "source": "cs161_textbook",
        "question": "Analyze the case where a website allows users to submit custom CSS for their profiles. What are the potential pros and cons of this feature from a security standpoint?",
        "choices": [
            "A: Pro: It enhances user experience by allowing customization. Con: It could lead to Cross-Site Scripting (XSS) attacks if not properly sanitized.",
            "B: Pro: It can improve site performance by offloading styling to the client-side. Con: Users may inadvertently expose sensitive information through CSS.",
            "C: Pro: It reduces server-side processing load. Con: Malicious CSS can be used to alter the appearance of the site in a way that facilitates phishing.",
            "D: Pro: It can enforce a consistent look across user profiles. Con: CSS has full access to the DOM and can manipulate user data."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "User-generated CSS"
    },
    {
        "id": "631d4b16-eaf7-474c-b5c1-5ee190349e73",
        "source": "mozilla_security",
        "question": "A web application implements CSRF protection by setting a cookie with a token and requiring that the token be sent in a custom header with subsequent requests. Which of the following 'Set-Cookie' header configurations could potentially leave the application vulnerable to CSRF attacks?",
        "choices": [
            "A: Set-Cookie: CSRFTOKEN=token_value; Path=/; Secure; HttpOnly; SameSite=Strict",
            "B: Set-Cookie: CSRFTOKEN=token_value; Path=/; Secure; SameSite=None",
            "C: Set-Cookie: CSRFTOKEN=token_value; Secure; SameSite=Lax",
            "D: Set-Cookie: CSRFTOKEN=token_value; Path=/; HttpOnly; SameSite=Strict"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SameSite Cookie Attribute"
    },
    {
        "id": "bd8638f6-4726-43c2-b08b-23732df21849",
        "source": "owasp_mastg",
        "question": "An iOS application is found to have a vulnerability where sensitive user data stored in the Keychain is accessible even after the device restarts and before the user has unlocked it for the first time. Which Keychain data protection class should have been used to prevent this vulnerability?",
        "choices": [
            "A: kSecAttrAccessibleAlways",
            "B: kSecAttrAccessibleAfterFirstUnlock",
            "C: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly",
            "D: kSecAttrAccessibleWhenUnlocked"
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Keychain Data Protection Classes"
    },
    {
        "id": "4a22ba20-d474-46d2-b0b8-41a86135ccc4",
        "source": "attck",
        "question": "In the context of a drive-by compromise, what is the primary security implication if an adversary successfully exploits a user's web browser? (Select TWO.)",
        "choices": [
            "A: The adversary may gain unauthorized access to systems on the internal network.",
            "B: The adversary will immediately have full control over the organization's DMZ-hosted systems.",
            "C: The compromised system could be used as a pivot point for further internal reconnaissance and attacks.",
            "D: All data transiting the network will be immediately accessible to the adversary."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Internal Network Access"
    },
    {
        "id": "0a5af0f1-850e-4cbe-bba5-2f0cdee87c2d",
        "source": "apple_platform_security",
        "question": "In the context of iOS, iPadOS, and macOS, app extensions are used to provide added functionality to other apps. When considering the use of extensions, which of the following statements are accurate regarding their design, communication, and security?",
        "choices": [
            "A: Extensions are automatically launched by the system, which manages their lifecycle and restricts their availability based on entitlements.",
            "B: Extensions have direct access to the files and memory spaces of the apps from which they are activated, enhancing their interoperability.",
            "C: Extensions run in their own address space and communicate via system-mediated interprocess communications, maintaining isolation.",
            "D: Keyboard extensions are given unrestricted network access by default to enhance their functionality, unless the user opts for a restricted sandbox."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "App_Extensions_Security"
    },
    {
        "id": "d6f87d3d-c497-44a1-8932-ab7352e25416",
        "source": "cwe",
        "question": "In an online banking system, a function is responsible for processing user transactions and updating their account balances. Given the strategies below, which one would not prevent a race condition from occurring in the system's transaction processing function?",
        "choices": [
            "A: Using a database transaction with proper isolation levels to handle account balance updates.",
            "B: Applying non-blocking synchronization mechanisms such as spinlocks to control access to the balance update code.",
            "C: Disabling interrupts while the balance update code executes to ensure the operation completes without preemption.",
            "D: Running the code with the lowest privileges required to perform the balance updates."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "mitigation"
    },
    {
        "id": "e137e495-9dbb-4c1a-b273-10729dd81163",
        "source": "android_sec_doc",
        "question": "In a Keymaster 1 or 2 implementation, if an application attempts to initiate a cryptographic operation without providing a necessary input parameter, what error code would the Keymaster method most likely return?",
        "choices": [
            "A: ErrorCode::UNEXPECTED_NULL_POINTER",
            "B: ErrorCode::OUTPUT_PARAMETER_NULL",
            "C: ErrorCode::KEYMASTER_NOT_CONFIGURED",
            "D: ErrorCode::INVALID_INPUT_LENGTH"
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Keymaster Error Handling"
    },
    {
        "id": "890af326-da31-4451-9dd2-675cb829155f",
        "source": "cs161_textbook",
        "question": "In which of the following scenarios would UDP be chosen over TCP for the transport layer protocol, despite TCP's better correctness guarantees? Select all that apply.",
        "choices": [
            "A: A financial service requires guaranteed delivery of transaction data between servers.",
            "B: A multiplayer online game needs to maintain real-time state synchronization among players.",
            "C: A remote surgery system demands high reliability for transmitting control signals.",
            "D: A weather monitoring system requires fast delivery of data to update conditions in real-time."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TransportLayer"
    },
    {
        "id": "2b52de5c-3403-4963-81e5-8c1bb8b8e93c",
        "source": "attck",
        "question": "An incident response team has discovered that a piece of malware has executed several commands on a compromised system. While analyzing the logs, they noticed commands typically used by adversaries to collect network configuration information. Which of the following commands, if found in the logs, would be least likely to have been executed by the malware for the purpose of collecting network information?",
        "choices": [
            "A: `nslookup myip.opendns.com resolver1.opendns.com` to retrieve the system's external IP address.",
            "B: `netsh interface show` to discover network interface settings.",
            "C: A custom script to defragment the hard drive.",
            "D: `GetIpNetTable` to identify all mounted drives and hosts with ARP entries."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "malware reconnaissance"
    },
    {
        "id": "e9129e16-70a3-4d7e-92bb-421c6f03849d",
        "source": "owasp_mastg",
        "question": "Considering the security implications, which of the following can be considered as a benefit and a drawback of iOS's approach to application distribution?",
        "choices": [
            "A: Benefit: Sideloading via USB increases the diversity of available applications. Drawback: It increases the risk of installing potentially harmful apps.",
            "B: Benefit: The restriction to a single official app store limits the exposure to malicious applications. Drawback: It may delay the availability of critical security patches from third-party app developers.",
            "C: Benefit: Multiple app stores provide redundancy in case of a security breach in the official app store. Drawback: It complicates the ability to apply uniform security policies.",
            "D: Benefit: iOS's hardware/software integration eases the implementation of security features specific to certain devices. Drawback: It may introduce delays in security updates due to hardware dependencies."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "App Store Distribution"
    },
    {
        "id": "9fa2b7ab-123d-4eea-97fa-4436957e37df",
        "source": "cwe",
        "question": "You are designing an online payment system that handles personal user data. Which of the following practices should you employ to prevent unauthorized exposure of private personal information during the system's operation?",
        "choices": [
            "A: Implementing robust encryption for data storage and transmission, and ensuring regular security audits.",
            "B: Storing plaintext passwords in the file system for ease of administration and expected future requirements.",
            "C: Logging all user activities, including personal details, to monitor for anomalous behavior patterns.",
            "D: Sharing user personal data with partner organizations for analytics without explicit user consent."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PrivacyProtection"
    },
    {
        "id": "21ddfd4a-6da1-4361-b983-4e30e68cfae0",
        "source": "cwe",
        "question": "An organization is preparing to deploy a new software that comes with default credentials for administrative access. As the security consultant, you are tasked with advising on the best practices to mitigate the risk associated with the use of these default passwords. Which of the following strategies would be most effective in preventing unauthorized access?",
        "choices": [
            "A: Advise the system administrators to change the default passwords after the software has been fully integrated into the enterprise's workflow.",
            "B: Mandate a policy that prohibits the use of default credentials and ensure it is enforced by requiring changes to the credentials upon installation of the software.",
            "C: Implement an automated system that periodically prompts users to change their passwords, including the default administrative credentials.",
            "D: Keep the default credentials but restrict access to the administrative interface to a limited number of pre-approved IP addresses."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DefaultPasswords"
    },
    {
        "id": "52486023-96ce-4aea-b629-6063113d5a8c",
        "source": "owasp_mastg",
        "question": "Consider the following Objective-C code snippet used in a mobile application:\n\nobjective-c\nimport <dlfcn.h>\nvoid *handle = dlopen(\"/path/to/library\", RTLD_LAZY);\n\n\nThis code dynamically loads a shared library at runtime. Which of the following is NOT a security risk associated with this practice?",
        "choices": [
            "A: The application might inadvertently load a malicious library if the path is not properly secured.",
            "B: Using dynamic linking can optimize the application's performance by loading libraries as needed.",
            "C: Dynamic loading of libraries can lead to unauthorized access to application memory space.",
            "D: If the library's path is hard-coded, it might be exploited to execute arbitrary code."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Dynamic Linking"
    },
    {
        "id": "b3392a3b-77e9-4e98-af01-4bfb2f8e4a0e",
        "source": "owasp_mastg",
        "question": "You are tasked with overseeing the development of a new mobile application that needs to perform with high reliability and take full advantage of device capabilities like camera and sensors. The app should also adhere to platform-specific UI design principles. Considering these requirements, which of the following app development approaches would you recommend?",
        "choices": [
            "A: Develop a native app using platform-specific SDKs for Android and iOS to ensure best performance and access to device capabilities.",
            "B: Opt for a web app to minimize development and maintenance costs, despite it having limited device integration and lower performance.",
            "C: Choose a hybrid app that combines web technologies with native execution, but it may not fully adhere to platform-specific UI design principles.",
            "D: Implement a Progressive Web App (PWA) because it offers offline capabilities and can access all mobile device hardware features."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Mobile App Taxonomy"
    },
    {
        "id": "190200c4-ed5e-4d30-aa81-86a50ec7ee57",
        "source": "attck",
        "question": "Considering the mitigation strategies against container escape techniques, which of the following would be the LEAST effective in preventing an adversary from gaining access to the host environment?",
        "choices": [
            "A: Using seccomp-bpf to restrict certain system calls such as `mount`.",
            "B: Ensuring containers do not run with unnecessary privileges or components.",
            "C: Monitoring for unexpected usage of syscalls indicating an escape attempt.",
            "D: Installing antivirus software on the host system."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "mitigation strategies"
    },
    {
        "id": "3f883a90-cef8-4227-aed5-3c34a99b1bf9",
        "source": "apple_platform_security",
        "question": "When evaluating the use of Face ID with a mask on an iPhone device, which of the following statements correctly assess the functionality and security risk involved?",
        "choices": [
            "A: Face ID with a mask is designed to work for a limited time after a successful match or passcode validation to enhance convenience.",
            "B: Face ID with a mask increases the user's data privacy as no facial data is stored or sent to Apple.",
            "C: Face ID with a mask has a higher probability of a false match, especially for twins and siblings who resemble the user.",
            "D: The use of Face ID with a mask will extend the period a user can go without requiring a passcode for up to one week."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "FaceID"
    },
    {
        "id": "154ed34d-1b5f-45b5-8ba7-f8929543cf45",
        "source": "cs161_textbook",
        "question": "Alice and Bob are using the Diffie-Hellman key exchange analogy involving colors to establish a shared secret. Evaluate the steps in their exchange process and select the statements that correctly reflect the security benefits and potential limitations of this analogy.",
        "choices": [
            "A: The use of a publicly-known common color (green) as part of the exchange process adds a layer of security, as it prevents Eve from easily discerning the final shared secret color.",
            "B: If Eve manages to obtain the final shared secret color (green-amber-blue), she can reverse-engineer the secret colors chosen by Alice and Bob due to the properties of the paint mixing analogy.",
            "C: The analogy demonstrates that even if Eve can see the exchanged colors, without knowing the exact secret colors of Alice and Bob, she cannot derive the final shared secret color.",
            "D: Should Eve intercept the secret mixtures (green-amber and green-blue), she could potentially separate the mixtures into their original colors, compromising the security of the exchange."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Diffie-Hellman"
    },
    {
        "id": "cdb20286-3829-4dcb-b2c1-f331c079e952",
        "source": "owasp_wstg",
        "question": "In an OAuth authorization framework, four distinct entities interact to facilitate the delegation of access rights from the resource owner to the client application. Which of the following pairs correctly describe the role and its function within the OAuth framework?",
        "choices": [
            "A: Resource Owner: The application that serves the content accessed by the client.",
            "B: Client: The entity that grants access to a resource and is typically the user themselves.",
            "C: Authorization Server: The server that holds authorization information and grants the access.",
            "D: Resource Server: The application that is requesting access to a resource on behalf of the Resource Owner."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OAuth Authorization Framework"
    },
    {
        "id": "8984de7d-d0bd-47be-9b9b-f17c5b679ae1",
        "source": "apple_platform_security",
        "question": "In managing the boot security and policy settings for a Mac with Apple silicon, a technician must consider the impact of nonces on the LocalPolicy. What are the potential outcomes or conditions associated with the LocalPolicy Nonce Hash (lpnh) and the RemotePolicy Nonce Hash (rpnh)?",
        "choices": [
            "A: The lpnh is used to prevent replay attacks by ensuring the LocalPolicy in use matches the nonce stored in the Secure Storage Component.",
            "B: The rpnh is updated frequently to prevent unauthorized changes to the LocalPolicy and to reflect the most current user security settings.",
            "C: During software updates, two LocalPolicy Nonce (LPN) values may be simultaneously valid to provide fallback options in case of an update error.",
            "D: The rpnh is designed to be constantly synchronized with the lpnh to prevent any discrepancies in the LocalPolicy across different boot environments."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "NonceHash"
    },
    {
        "id": "ec75205f-2a95-4953-8905-767c0d453c48",
        "source": "cs161_textbook",
        "question": "Alice and Bob are communicating over a TCP connection. Three adversaries, Eve (Off-path), Mallory (On-path), and Trudy (In-path), are attempting to disrupt or hijack their communication. Which of the following statements accurately describe the attacks that each adversary is capable of executing?",
        "choices": [
            "A: Eve can inject a malicious TCP packet by knowing the client IP, client port, server IP, server port, and correctly guessing the sequence number.",
            "B: Mallory can observe the sequence numbers and inject messages without needing to guess any values, but must race Alice's packets.",
            "C: Trudy can modify and block messages, ensuring that her injected packets are received without needing to outpace any legitimate packets.",
            "D: Mallory can easily inject packets without racing if she knows the client IP and server IP, even without knowing the sequence numbers."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "TCP Packet Injection"
    },
    {
        "id": "13b4724d-a48f-435c-9c02-2591619e475a",
        "source": "apple_platform_security",
        "question": "When a user adds a credit or debit card to Apple Wallet, several steps are involved in the provisioning process. Select the correct steps that are part of this process:",
        "choices": [
            "A: The device retrieves the card number from an iTunes Store account if the card is already on file, and initiates the Check Card process.",
            "B: The device directly communicates with the card issuer's server using a shared pairing key to secure the transmission of card information.",
            "C: The device begins to bind the card to the Secure Element and downloads the Apple Wallet pass file representing the card.",
            "D: The device sends a transaction-specific dynamic security code to the merchant along with the Device Account Number during the payment process."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Provisioning"
    },
    {
        "id": "65bbf157-ef54-4e7a-b96f-b36b130cdd13",
        "source": "mit6.858",
        "question": "Reflect on the use of a constraint solver such as STP during the execution of the EXE symbolic execution tool. What potential issues could arise if EXE did not utilize STP to verify the existence of at least one solution for the current path's constraints, and instead opted for alternative methods such as trying all branches or randomly selecting a branch?",
        "choices": [
            "A: Without STP, EXE might waste computational resources on infeasible paths that do not contribute to finding bugs.",
            "B: Randomly selecting a branch without verification might lead EXE to overlook certain bugs due to incomplete coverage of the execution space.",
            "C: Trying all branches without STP could result in an exponential increase in the complexity, making the execution process impractical for larger programs.",
            "D: Utilizing a random branch selection strategy would significantly speed up the execution process by reducing the number of paths to be explored."
        ],
        "answer": "ABC",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "ConstraintSolver"
    },
    {
        "id": "cfc1ce0d-ac39-4f64-bf73-528d84b4e0dc",
        "source": "cs161_textbook",
        "question": "In an x86 assembly program, function 'bar' is called with several arguments, and it declares a large local array. What must the developer ensure to prevent stack corruption during the function call? Select all that apply.",
        "choices": [
            "A: The stack pointer (esp) must be decremented sufficiently to allocate space for the local array and prevent overwriting other data on the stack.",
            "B: The saved frame pointer (sfp/old ebp) must be pushed onto the stack after the local array is allocated to ensure proper stack frame structure.",
            "C: The order of argument pushing onto the stack should be maintained as specified by the calling convention to prevent stack misalignment.",
            "D: The instruction pointer (eip/rip) must be incremented instead of decremented to account for the large local array allocation."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "stackmanagement"
    },
    {
        "id": "ee7713cb-f0c3-4e77-a625-8f28a96ebc17",
        "source": "windows_security",
        "question": "As an IT professional, you are implementing a policy to rename the administrator account on Windows client computers. What should you consider to follow best practices and ensure that the policy is effective?",
        "choices": [
            "A: Educating authorized users about the new administrator account name to prevent confusion and maintain access.",
            "B: Setting the account name to 'Not defined' as this is the secure default value for client computers.",
            "C: Ensuring that the new account name follows a complex naming convention to increase security.",
            "D: Applying the default value of 'Administrator' for ease of remembering the account name across all systems."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Administrator Account Renaming"
    },
    {
        "id": "fbb0f56a-e48d-4c49-8f36-122dcb147d83",
        "source": "android_sec_doc",
        "question": "You are advising a mobile device manufacturer on the selection of a Trusted Execution Environment (TEE) system. The manufacturer is considering using Trusty TEE rather than a third-party TEE system. What are the benefits and challenges associated with this decision?",
        "choices": [
            "A: Trusty TEE offers a level of transparency, collaboration, and ease of debugging that closed source systems do not provide.",
            "B: Using Trusty TEE significantly increases the monetary cost compared to licensing a third-party TEE.",
            "C: Trusty TEE allows trusted application developers to easily create and deploy applications without accounting for the fragmentation of multiple TEE systems.",
            "D: Trusty TEE supports the development and distribution of third-party applications, enhancing the ecosystem's flexibility."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Trusted Execution Environment (TEE)"
    },
    {
        "id": "106fc130-66d9-4d15-b973-c70475389e91",
        "source": "owasp_mastg",
        "question": "You are tasked with conducting a security assessment for a newly developed iOS application that communicates sensitive data over the network. Which of the following methods would be most appropriate to ensure the application adheres to best practices for network security? Select two.",
        "choices": [
            "A: Performing static code analysis to identify hard-coded credentials and other sensitive information within the application's source code.",
            "B: Inspecting the application's network traffic using a packet analyzer to ensure data is being transmitted over unencrypted channels.",
            "C: Testing the application on a jailbroken device to bypass any client-side security measures and evaluate server-side controls.",
            "D: Checking for proper implementation of SSL/TLS certificates and pinning to prevent man-in-the-middle (MITM) attacks."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Static Code Analysis"
    },
    {
        "id": "9b05a8e4-5f7d-41e2-a115-9b0586f1f77f",
        "source": "owasp_wstg",
        "question": "You are analyzing the security of a web application that uses JSON Web Tokens (JWTs) for session management. The JWTs are signed using the HS256 algorithm with a strong, unique HMAC key. Which of the following statements are valid concerns regarding this JWT implementation?",
        "choices": [
            "A: Using HS256 with a strong, unique HMAC key is generally secure, but one must ensure that the key remains confidential to prevent forging of tokens.",
            "B: HS256 is inherently insecure regardless of the HMAC key strength due to its susceptibility to quantum computing attacks.",
            "C: The application should avoid using JWTs altogether as they are always a source of vulnerabilities, regardless of the signing algorithm used.",
            "D: The HS256 algorithm is secure if implemented correctly, yet there is a risk of sensitive information exposure if the payload is not handled properly."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "JSON Web Tokens (JWT)"
    },
    {
        "id": "93ca297e-bd1a-4fb0-81e1-e7c1422e7342",
        "source": "owasp_mastg",
        "question": "When formulating a security test strategy during the Secure Design phase of the Software Development Life Cycle (SDLC), which of the following elements should be included?",
        "choices": [
            "A: The number of stories related to security controls that have been successfully implemented.",
            "B: Trends in the security bug backlog, which may be sorted by urgency.",
            "C: A list of preferred coffee brands for the development team to enhance productivity.",
            "D: The frequency of team-building events to ensure a collaborative working environment."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Security Test Strategy"
    },
    {
        "id": "af09ea11-5bab-416a-beb9-f908323d1c05",
        "source": "d3fend",
        "question": "A security analyst suspects that an adversary is exploiting a Return-Oriented Programming (ROP) attack within the organization's network. Which analysis technique should the analyst employ to detect this type of attack?",
        "choices": [
            "A: Indirect Branch Call Analysis",
            "B: File Access Pattern Analysis",
            "C: User Behavior Analysis",
            "D: Process Spawn Analysis"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Return-Oriented Programming"
    },
    {
        "id": "5b009694-5b69-439b-bf74-6d572f1133e1",
        "source": "apple_platform_security",
        "question": "An attacker has gained physical possession of an iOS device and is attempting to access encrypted data. Which of the following statements are true regarding the role of Effaceable Storage in this scenario?",
        "choices": [
            "A: Effaceable Storage is used to securely wipe cryptographic keys and can prevent the attacker from accessing the data if the device is in their possession.",
            "B: Keys stored in Effaceable Storage can be part of a key hierarchy that facilitates forward security, but physical possession of the device may allow an attacker to bypass these protections.",
            "C: The Effaceable Storage on an iOS device is primarily designed to store multimedia files securely and its compromise could directly lead to data leakage.",
            "D: Effaceable Storage's main role is to facilitate fast wipe of the device, rather than to provide confidentiality against attackers with physical access."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Effaceable Storage"
    },
    {
        "id": "c8f43d72-77f4-4a41-a903-c9b16a0d7e73",
        "source": "owasp_mastg",
        "question": "As an application security professional tasked with setting up an environment for testing the security of iOS applications, which of the following setups would you advise against?",
        "choices": [
            "A: Using a macOS host computer with administrative rights and having Xcode and Xcode Command Line Tools installed.",
            "B: Establishing a Wi-Fi network that restricts client-to-client traffic and using a jailbroken iOS device of the desired version.",
            "C: Relying solely on the iOS SDK simulator for dynamic analysis and reverse engineering of iOS apps.",
            "D: Employing an interception proxy tool, such as Burp Suite, for monitoring and manipulating network traffic."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "iOS Testing Environment"
    },
    {
        "id": "247f6b8a-6969-476c-ad95-8dd98fce1c11",
        "source": "mozilla_security",
        "question": "Why should a web administrator not solely rely on the Mozilla backwards compatible TLS configuration for a website that seeks to accommodate extremely old browsers without first consulting the security team for a risk assessment?",
        "choices": [
            "A: Because older browsers are more secure and do not require risk assessment.",
            "B: Because the backwards compatible configuration offers the most advanced security features available.",
            "C: Because the backwards compatible configuration could introduce security vulnerabilities due to the support of outdated protocols.",
            "D: Because consulting the security team would result in unnecessary delays without providing any security benefits."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Risk Assessment"
    },
    {
        "id": "a0812bfc-d44e-424e-9d5b-f0adfbfd1530",
        "source": "attck",
        "question": "A cyber threat actor is planning an operation that involves compromising accounts to aid in targeting potential victims. Which of the following methods are plausible for the adversary to use to compromise accounts, and what might be an objective of compromising such accounts?",
        "choices": [
            "A: Purchasing credentials from third-party sites to compromise social media accounts for social engineering purposes.",
            "B: Using advanced persistent threats to infiltrate social media platforms' databases to harvest user credentials.",
            "C: Compromising cloud accounts by exploiting vulnerabilities in the cloud service provider's infrastructure.",
            "D: Brute forcing credentials, such as password reuse from breach credential dumps, to access email accounts."
        ],
        "answer": "AD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Phishing for Information"
    },
    {
        "id": "7f20814e-9e18-4e4a-b65e-9143bec22579",
        "source": "cwe",
        "question": "Consider a system design where a web form accepts user input for registration. Which of the following design approaches are susceptible to vulnerabilities based on improper handling of values?",
        "choices": [
            "A: The design specifies mandatory fields, but there is no server-side validation to enforce this rule.",
            "B: Client-side JavaScript validation is implemented, but server-side validation is also in place as a fallback.",
            "C: The design incorporates CAPTCHA to prevent automated submissions but does not validate the input's content.",
            "D: Server-side validation is configured to reject any unexpected or extra field submissions."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DesignVulnerability"
    },
    {
        "id": "3446d9ad-6108-4210-8aa0-80f62fd688be",
        "source": "apple_platform_security",
        "question": "When a user sets a passcode on an iOS device, several security mechanisms are engaged to ensure the confidentiality and integrity of the data. Which of the following statements correctly describe the role of the user's passcode in securing data on the device?",
        "choices": [
            "A: The passcode is directly used as the file system key to encrypt each file's metadata on the device.",
            "B: The passcode is entangled with the device's UID to create a Passcode-derived key (PDK), which is used in the encryption process.",
            "C: The passcode undergoes a tangling process to strengthen a cryptographic key that is then used to wrap the per-file key for each file.",
            "D: A user's passcode is stored in Effaceable Storage to enable rapid access and encryption of data each time the device is unlocked."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Passcode Security"
    },
    {
        "id": "6c64a083-d4ea-4a38-a522-1d906608d20d",
        "source": "owasp_mastg",
        "question": "A company is planning to develop a mobile application that needs to support both Android and iOS platforms. They want to optimize the development process by minimizing the cost and complexity of maintaining the app. What would be a key advantage of using a cross-platform development framework over maintaining separate native codebases for each platform?",
        "choices": [
            "A: Cross-platform frameworks allow developers to maintain separate codebases more efficiently than native development.",
            "B: Cross-platform frameworks provide better access to lower-level APIs and device capabilities exclusively.",
            "C: Using cross-platform frameworks enables a single codebase to be compiled for both Android and iOS, reducing maintenance efforts.",
            "D: Cross-platform development tools eliminate the need for any code, as they automatically generate all necessary app components."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "Cross-Platform Development"
    },
    {
        "id": "ff2dd138-2a32-46ed-949b-e22f1dda9228",
        "source": "owasp_mastg",
        "question": "A mobile application developer intends to create a service in an Android application that should allow other applications to bind to it and interact seamlessly. The developer also needs to ensure that the service can handle long-term processes and restart automatically when resources become available. Which of the following best describes the approach the developer should take to fulfill these requirements?",
        "choices": [
            "A: Implement an IntentService, as it creates a new thread that can handle IPC and can be bound by other services.",
            "B: Use a local broadcast manager to create a bound service that ensures private data does not leave the application's perimeter.",
            "C: Create a bound service using an IBinder interface and manage its lifecycle to handle long-term operations.",
            "D: Set up a BroadcastReceiver declared in the Android Manifest file to receive and handle IPC and bind with other applications."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Bound Service"
    },
    {
        "id": "2f29bfc1-ec35-4c65-a115-127765d2bec0",
        "source": "attck",
        "question": "In the context of a security incident response, a network traffic analyst suspects that an adversary is using data encoding to hide command and control traffic. Which of the following approaches would most likely assist in uncovering such activity?",
        "choices": [
            "A: Monitoring for large outbound data transfers that are inconsistent with the expected behavior of the client system.",
            "B: Focusing solely on the metadata of network packets, since encoded data cannot be detected within packet contents.",
            "C: Disregarding uncommon data flows, as modern encryption methods make detection of encoded contents impractical.",
            "D: Implementing strict firewall rules that block all inbound and outbound traffic, regardless of content."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "e402736a-9c82-4851-a6de-82db69f022bc",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing the network traffic logs and observes unusual patterns that suggest a multi-stage command and control (C2) communication. The analyst identifies that a remote access tool (RAT) on a compromised host has been calling back to an IP address associated with a known threat actor. Further investigation reveals that the RAT has updated itself and uploaded a second RAT, which started communicating with a different IP address. Considering typical adversary behaviors, which of the following actions should the analyst prioritize to effectively respond to this threat? (Select TWO.)",
        "choices": [
            "A: Monitor for any backup first-stage callbacks or fallback channels that may be used if the primary communication path is blocked.",
            "B: Immediately shut down all outbound network traffic to prevent any further communication with external servers.",
            "C: Review the host's network connections to detect any new, untrusted connections that have been established.",
            "D: Ignore the second RAT since it likely performs less critical functions than the first-stage RAT."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Multi-Stage Command and Control"
    },
    {
        "id": "a670b890-0d82-4f62-b372-79d3b353f852",
        "source": "owasp_mastg",
        "question": "Consider an Android application that requires high levels of data protection due to its sensitive nature. As an application security expert, you are evaluating the built-in security features of the Android platform to ensure that the app's data remains secure. Which of the following are components of the Android platform that contribute to its defense-in-depth security strategy?",
        "choices": [
            "A: Kernel enhancements including Low Memory Killer and Binder IPC",
            "B: Runtime Environment with Dalvik bytecode execution on ART",
            "C: Sandboxing to restrict direct hardware access and isolate applications",
            "D: Mandatory use of a proprietary virtual machine exclusive to Android for app execution"
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "defense-in-depth"
    },
    {
        "id": "3167c331-1570-4f0b-a08c-c52e10ea3249",
        "source": "cs161_textbook",
        "question": "A DNS server has just resolved a query for a domain and returned a set of records as part of its DNSSEC implementation. Given the following information, identify the roles that the associated DNSSEC records play in this scenario: A `DNSKEY` record is present along with an `RRSIG` record signing multiple `A` type records, and a `DS` record exists in conjunction with another `RRSIG` record for it.",
        "choices": [
            "A: The DNSKEY record contains the public key used to verify the RRSIG signature over the A type records.",
            "B: The RRSIG record attached to the A type records can be used to hash the set of records for ensuring integrity.",
            "C: The DS record serves as a secure reference to the public key of a child domain name server.",
            "D: The additional RRSIG record for the DS record provides a signature to authenticate the source of the DS record."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNSSEC"
    },
    {
        "id": "b4d2d15e-329d-4d68-ba68-21281c5fd700",
        "source": "cs161_textbook",
        "question": "In the context of intrusion detection systems, which of the following characteristics are associated with different attack detection strategies?",
        "choices": [
            "A: Signature-based detection relies on known patterns of malicious activity.",
            "B: Anomaly-based detection depends on deviations from established user behavior profiles.",
            "C: Stateful protocol analysis matches observed events against predetermined profiles of benign activity.",
            "D: Heuristic detection strategies are entirely based on comparing network traffic to a database of trusted IP addresses."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IntrusionDetection"
    },
    {
        "id": "21e82879-d8e2-4ac4-833f-31562659810d",
        "source": "owasp_wstg",
        "question": "Which of the following API function calls is NOT inherently risky and must be used with extreme caution to prevent command injection vulnerabilities in a web application?",
        "choices": [
            "A: Python: subprocess.popen",
            "B: C/C++: system",
            "C: PHP: shell_exec",
            "D: Java: StringBuilder.append"
        ],
        "answer": "D",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "API Function Calls"
    },
    {
        "id": "09deab35-daab-481e-bd63-c1feaf72b48c",
        "source": "owasp_mastg",
        "question": "When assessing the security of a mobile application against reverse engineering, various detection methods can be employed. Consider the following methods. Which are plausible strategies for detecting the presence of the Frida instrumentation framework on an iOS device, and which could be trivial to bypass?",
        "choices": [
            "A: Checking the list of loaded dynamic libraries in an app for libraries with names including 'frida' using the `_dyld_get_image_name` function.",
            "B: Detecting the presence of the `frida-server` running as a daemon on the device by querying the `CommandLine` interface for running processes.",
            "C: Inspecting the application's `<Application>.app` directory for an embedded Frida gadget such as `FridaGadget.dylib`.",
            "D: Using radare2/iaito or Ghidra to patch the binary and disable the anti-reverse engineering functionality of the application."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Frida Detection"
    },
    {
        "id": "5f1cfbcb-5203-4c91-be0b-e2d8939c6635",
        "source": "owasp_mastg",
        "question": "If an application security engineer mistakenly uses the command '$ dnsmasq -d -C' without specifying the configuration file, what is the most likely consequence when attempting to run the 'dnsmasq' service?",
        "choices": [
            "A: The 'dnsmasq' service will run with the default configuration settings.",
            "B: The 'dnsmasq' service will fail to start due to the missing configuration file argument.",
            "C: The 'dnsmasq' service will disregard all configuration settings and block all DNS queries.",
            "D: The 'dnsmasq' service will automatically create a new configuration file with secure defaults."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DNS server configuration"
    },
    {
        "id": "7a4152ed-c799-4c2d-8a21-c605af89feb3",
        "source": "apple_platform_security",
        "question": "Consider a scenario where Password Monitoring is enabled on a device. Which of the following actions are part of the Password Monitoring process to ensure that user passwords are matched securely and privately against a list of exposed passwords?",
        "choices": [
            "A: The device continuously performs round-robin checks on the user’s passwords against a curated list.",
            "B: A cryptographic private set intersection is used to compare passwords against a large set of leaked passwords.",
            "C: Passwords are directly sent to Apple in plaintext for comparison against the list of exposed passwords.",
            "D: The device generates a random constant and sends a cryptographic point to Apple's server for set intersection computation."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "PasswordMonitoring"
    },
    {
        "id": "80340d52-8ad9-4873-b309-b4a0aa8ec9e4",
        "source": "apple_platform_security",
        "question": "Which of the following keychain items are designed to sync across a user's devices with the iCloud Keychain service? (Select all that apply)",
        "choices": [
            "A: Safari user data, including usernames, passwords, and credit card numbers.",
            "B: iMessage keys that are specific to each device.",
            "C: Wi-Fi passwords that a user has saved on their devices.",
            "D: Private SSH keys generated for secure remote access."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "DataSync"
    },
    {
        "id": "8a3cab59-c1fe-40d4-94a3-16c4738505e6",
        "source": "cwe",
        "question": "In an attempt to improve the security of a web application, a developer is considering various strategies for handling runtime exceptions. Analyze the following strategies and select the one that could potentially lead to the exposure of sensitive information:",
        "choices": [
            "A: Catching all exceptions and logging them internally without returning any stack trace information to the user.",
            "B: Configuring a custom error page that provides a generic error message, regardless of the exception type.",
            "C: Implementing a detailed error page that is only shown to local users, while remote users receive a generic error message.",
            "D: Allowing the application container to handle exceptions by default, potentially displaying full stack traces to the user."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "SensitiveInformationExposure"
    },
    {
        "id": "76fd056a-b772-4944-b6ef-27d5e510b31a",
        "source": "attck",
        "question": "An organization has decided to bolster its defenses against adversaries looking to perform network share discovery as part of their lateral movement strategy. To mitigate this threat, they plan to implement a configuration change at the operating system level. Which of the following configurations would be the most effective in preventing anonymous enumeration of Security Accounts Manager (SAM) accounts and network shares?",
        "choices": [
            "A: Disabling NetBIOS over TCP/IP to prevent network share discovery.",
            "B: Enabling the Windows Group Policy 'Do Not Allow Anonymous Enumeration of SAM Accounts and Shares'.",
            "C: Blocking all inbound SMB traffic at the network firewall.",
            "D: Implementing mandatory access controls on all shared network drives."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Anonymous Enumeration of SAM Accounts and Shares"
    },
    {
        "id": "d3ea639a-6a58-4407-a003-9848df75492c",
        "source": "cwe",
        "question": "A new hardware design includes a feature for test and debug modes intended to be used during development. However, the design documentation does not specify any restrictions on the activation of these modes. As a security consultant, you are assessing the risk of this feature. Which of the following would be appropriate concerns to raise regarding the current design?",
        "choices": [
            "A: The unrestricted test or debug feature might allow adversaries to alter system behavior or exfiltrate sensitive data during normal runtime operations.",
            "B: Test or debug features can enhance system performance during regular operation and should be available at all times.",
            "C: Activating test or debug logic at runtime is a best practice to ensure continuous system integrity and should be encouraged.",
            "D: The hardware should be configured to enter test or debug mode at any time as it will help in real-time troubleshooting of issues."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "HardwareVulnerability"
    },
    {
        "id": "34c4b821-93ea-48bf-b7cc-772a10d9d3ef",
        "source": "owasp_mastg",
        "question": "When designing a mobile application's security architecture against reverse engineering, you need to select a detection method that remains effective even when the application is running on a system with Android version 7.0 (API level 24) or higher. Which of these methods would not be hampered by the inability to view daemons started by other apps due to system restrictions?",
        "choices": [
            "A: Scanning for specific strings in the memory of running processes that indicate the presence of reverse engineering tools.",
            "B: Inspecting the list of running services to find the 'frida-server' daemon.",
            "C: Checking for open TCP ports that are commonly used by reverse engineering tools.",
            "D: Monitoring the system for the usage of named pipes which are a communication method employed by some reverse engineering tools."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "process memory scanning"
    },
    {
        "id": "73452376-3611-4d7e-ba56-8a50896a7b54",
        "source": "owasp_wstg",
        "question": "In the context of web application security, why are 'negative requirements' considered more challenging to test as compared to 'positive requirements'?",
        "choices": [
            "A: Negative requirements are based on expected behavior that is easy to define and observe during testing.",
            "B: Negative requirements have no expected behavior to look for, making it difficult to create realistic test scenarios.",
            "C: Negative requirements are solely focused on the functionality of security controls rather than their ability to mitigate threats.",
            "D: Negative requirements can only be tested post-deployment in a real-world environment."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Negative Security Requirements"
    },
    {
        "id": "15633ad3-e10f-42e6-9735-a17500c6b51a",
        "source": "attck",
        "question": "A cybersecurity team in an organization has detected unusual network traffic indicating potential exploitation of remote services for lateral movement within their network. They have identified that certain internal systems are running outdated software versions with known vulnerabilities. As a security analyst, you are tasked to recommend immediate mitigations to prevent the adversary from further exploiting these vulnerabilities and achieving privilege escalation. Which TWO of the following mitigations should be prioritized?",
        "choices": [
            "A: Implementing network segmentation to reduce access to critical systems.",
            "B: Enforcing strong password policies to prevent brute-force attacks.",
            "C: Updating software and employing patch management for endpoints and servers.",
            "D: Increasing awareness training frequency for all employees."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Lateral Movement"
    },
    {
        "id": "f1af1f87-52c8-448e-8944-08ac8948e846",
        "source": "apple_platform_security",
        "question": "What are the potential consequences of not regularly updating system software?",
        "choices": [
            "A: Increased system performance due to reduced software overhead.",
            "B: Vulnerability to known security exploits that have been patched in newer updates.",
            "C: Reduced compatibility with newer hardware technologies.",
            "D: Exposure to malware and attacks exploiting outdated software components."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SoftwareUpdate"
    },
    {
        "id": "64813a0d-265d-4b20-a55b-ce3ccbb4043c",
        "source": "attck",
        "question": "A company has recently experienced an incident where an unknown adversary attempted to gain access to several accounts using brute force techniques. The security team observed a high volume of failed authentication attempts across various accounts, suggesting a password spraying attack. To enhance their defense against such brute force attacks, which of the following measures should the security team implement? (Select TWO.)",
        "choices": [
            "A: Decrease the account lockout threshold to lock accounts after a single failed login attempt to prevent any brute force attack.",
            "B: Monitor authentication logs for system and application login failures to identify potential brute force attempts.",
            "C: Implement multi-factor authentication on all user accounts, especially on externally facing services.",
            "D: Remove account lockout policies entirely to avoid denial of service conditions from repeated brute force attempts."
        ],
        "answer": "BC",
        "topics": [
            "PenTest"
        ],
        "keyword": "password spraying"
    },
    {
        "id": "250ef822-1b8a-4d0f-9a8d-e5907b91e564",
        "source": "cs161_textbook",
        "question": "Why might an attacker find it significantly more challenging to brute force guess the stack canary's value on a 64-bit architecture compared to a 32-bit architecture?",
        "choices": [
            "A: The stack canary in a 64-bit architecture has 56 bits of randomness, making it harder to guess compared to 24 bits of randomness in a 32-bit architecture.",
            "B: 64-bit architectures utilize advanced encryption algorithms that secure the stack canary value, unlike 32-bit architectures.",
            "C: Programs on a 64-bit architecture run faster, reducing the window of opportunity for an attacker to guess the canary value.",
            "D: The stack canary on a 64-bit architecture is protected by additional security layers such as Address Space Layout Randomization (ASLR), which is not present in 32-bit architectures."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Architecture"
    },
    {
        "id": "2078d636-e164-4beb-b60c-1cc943a71217",
        "source": "owasp_wstg",
        "question": "You are designing an e-commerce platform that includes payment processing capabilities. To enhance the security of the payment functionality and minimize risks, which of the following practices should you implement? (Select two)",
        "choices": [
            "A: Store sensitive card details temporarily in the client-side storage to reduce server load.",
            "B: Utilize a payment gateway that allows redirection or uses IFRAME to handle card details.",
            "C: Process all pricing related information, including discounts and taxes, on the client-side for transparency.",
            "D: Ensure the application payment flow is robust and prevents steps from being performed out of sequence."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "PCI DSS"
    },
    {
        "id": "8df80f6b-f042-45ed-ad2d-57dbe5e7893e",
        "source": "owasp_mastg",
        "question": "In iOS development, when generating cryptographically secure random numbers, which of the following statements is incorrect?",
        "choices": [
            "A: Apple's Randomization Services API should be utilized as it provides cryptographically secure random numbers.",
            "B: The `SecRandomCopyBytes` function is a reliable choice as it wraps the `/dev/random` device file.",
            "C: Using third-party random number generators is recommended over Apple's API for enhanced security.",
            "D: The `SecRandomCopyBytes` function generates pseudorandom values in the range of 0 to 255."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "SecRandomCopyBytes"
    },
    {
        "id": "1faba3ce-ee2d-4494-acc7-59d77512219c",
        "source": "owasp_wstg",
        "question": "A web application handles sensitive user information, including authentication details and credit card numbers. Which of the following scenarios would be the most secure method for transmitting this information?",
        "choices": [
            "A: Using Basic Authentication over HTTP with user credentials encoded in HTTP headers.",
            "B: Employing form-based authentication where the form action attribute uses HTTP.",
            "C: Sending a session ID cookie over HTTP without the 'Secure' flag set.",
            "D: Utilizing HTTPS for the entire site and redirecting all HTTP requests to HTTPS."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTPS"
    },
    {
        "id": "4c1d9259-f8ce-4b17-be64-55259253ed57",
        "source": "owasp_wstg",
        "question": "An organization is planning to enhance their web application's security by identifying and mitigating vulnerabilities. Given that they have limited resources, which of the following activities should they prioritize to effectively find vulnerabilities?",
        "choices": [
            "A: Invest heavily in sophisticated automation tools as they are guaranteed to find all possible security vulnerabilities without human intervention.",
            "B: Focus on black-box testing techniques exclusively, as they are known to be more effective in discovering vulnerabilities than white-box testing.",
            "C: Conduct secure design reviews to catch architectural flaws, as they are typically more critical and harder to fix than vulnerabilities found in code.",
            "D: Utilize a combination of security testing tools and experienced security testers to complement the strengths and weaknesses of each approach."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Vulnerability Mitigation"
    },
    {
        "id": "7166a3e6-d5e7-480b-b1f8-96f7907db8c6",
        "source": "apple_platform_security",
        "question": "Consider a scenario where Alice has just enabled iCloud Keychain on her iPhone for the first time. She wants to ensure that her passwords and other sensitive information are securely synced across her devices and protected against various threat vectors. Which of the following statements correctly describe the security measures that protect her data in this scenario?",
        "choices": [
            "A: The public key of the syncing identity is stored in the iCloud Keychain and signed with the user's iCloud account password.",
            "B: iCloud Keychain items are encrypted such that they can be decrypted only by devices within the user's circle of trust.",
            "C: Keychain items are synced across devices using a plain text transfer method to ensure compatibility with older devices.",
            "D: For two-factor authentication accounts, each device's syncing list is stored in CloudKit and is protected by a syncing circle signed with the private key of each respective device."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "iCloud Keychain"
    },
    {
        "id": "731ccd08-13e2-4030-a3b0-210858d3199f",
        "source": "cwe",
        "question": "A web application developer is attempting to mitigate the risk of Cross-Site Scripting (XSS) attacks on their site. They are considering the implementation of a denylist-based protection mechanism. Which of the following would be a poor practice in the context of defending against XSS attacks?",
        "choices": [
            "A: Implementing a Content Security Policy (CSP) to specify trusted sources of content.",
            "B: Employing a denylist that filters out '<script>' tags and common XSS payloads.",
            "C: Utilizing a robust input validation framework that whitelists safe characters.",
            "D: Encoding user-supplied output to ensure special characters are not executed as code."
        ],
        "answer": "B",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Denylist"
    },
    {
        "id": "eb502d16-dbf2-44ea-a7e9-ad9f33fe3d0e",
        "source": "attck",
        "question": "If an organization is monitoring for changes to directory state using AD replication cookies, which of the following claims about detecting a rogue Domain Controller using DCShadow requires further scrutiny?",
        "choices": [
            "A: Monitoring AD replication cookies will reveal all unauthorized changes made by a rogue Domain Controller.",
            "B: DC replication traffic analysis is sufficient to detect changes made by a rogue Domain Controller.",
            "C: Alerts on creation of nTDSDSA objects in the AD schema can indicate the presence of a rogue Domain Controller.",
            "D: Investigating Kerberos Service Principal Names (SPNs) usage by non-DC hosts can help detect a rogue Domain Controller."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Active Directory Object Creation"
    },
    {
        "id": "86f4d182-7868-4854-bbc0-c5c371e66efc",
        "source": "cs161_textbook",
        "question": "In a hypothetical scenario, suppose you receive a DNS response with an 'ANSWER: 0' in the header, and the authority section containing 'NS' records, while the additional section has 'A' records. Which of the following steps would you likely need to take next in the DNS lookup process?",
        "choices": [
            "A: No further action is needed as the IP address of the target domain has been obtained.",
            "B: Query one of the name servers listed in the authority section using the IP addresses provided in the additional section.",
            "C: Report an error because the response should have contained the IP address in the answer section.",
            "D: Wait for the TTL to expire before making another DNS request as the current response is likely outdated."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DNS Lookup Process"
    },
    {
        "id": "5f42fb9e-eef2-4662-a4d0-fefeea806aba",
        "source": "owasp_wstg",
        "question": "In a GraphQL API, a query named 'dogs' accepts a 'namePrefix' parameter that is concatenated in an SQL query to retrieve dog records. Given the information on how this parameter is handled, what type of security vulnerability is the API likely to be exposed to?",
        "choices": [
            "A: Cross-Site Scripting (XSS) because the 'namePrefix' is reflected in the output without proper encoding.",
            "B: SQL Injection as the 'namePrefix' user input is directly concatenated into the SQL query without sanitization.",
            "C: Denial of Service (DoS) as the 'namePrefix' could be used to create deeply nested queries that overload the server.",
            "D: Insecure Direct Object References (IDOR) because the 'namePrefix' could allow access to unauthorized dog records."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "f997a4cd-fda7-4b42-9aa1-5d0ca3d4b618",
        "source": "owasp_wstg",
        "question": "Consider the following code snippet used in a web application:\n\njavascript\nfunction sanitize(input) {\n    var temp = document.createElement(\"DIV\");\n    temp.innerHTML = input;\n    return temp.textContent || temp.innerText || \"\";\n}\n\n$('form').submit(function() {\n    $('input[type=text]').val(function() {\n        return sanitize($(this).val());\n    });\n});\n\n\nAnalyze the code and identify which statement is true regarding the security implications of using the 'sanitize' function in the context of DOM-based XSS:",
        "choices": [
            "A: The 'sanitize' function is secure because it creates a new DIV element to handle the input, effectively sandboxing any malicious content.",
            "B: Using 'innerHTML' property to handle user input without proper sanitization can lead to the execution of malicious scripts, posing a security risk.",
            "C: The code is secure as long as the web application employs a strict Content Security Policy (CSP).",
            "D: The 'sanitize' function is inherently secure as it relies on the 'textContent' property, which is known to prevent script execution."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DOM-based XSS"
    },
    {
        "id": "7c5e8123-8eca-42d1-bf7d-707c1cba21fe",
        "source": "cwe",
        "question": "Considering the vulnerabilities and mitigation strategies discussed, which of the following statements are true regarding the prevention of SQL injection attacks?",
        "choices": [
            "A: Detailed error messages should be avoided as they can give attackers insight into the SQL structure, aiding in the refinement of attacks.",
            "B: Inconsistent messaging could unintentionally reveal internal state information, such as the existence of user accounts.",
            "C: An application firewall is always effective in preventing SQL injection attacks because it inspects incoming traffic for malicious patterns.",
            "D: Allowlists for input validation are less effective than denylists as they may not cover all potentially malicious inputs."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "2a336490-e69e-4533-9e94-9c2d798699e3",
        "source": "cs161_textbook",
        "question": "During the DNSSEC query walkthrough for 'eecs.berkeley.edu', a chain of trust is established through various DNS records. Which of the following sequences correctly represents the establishment of trust from the root to the 'berkeley.edu' domain, according to the DNSSEC process described?",
        "choices": [
            "A: Root ZSK -> .edu DS -> .edu ZSK -> berkeley.edu DS -> berkeley.edu ZSK",
            "B: Root KSK -> Root ZSK -> .edu KSK -> .edu ZSK -> berkeley.edu KSK",
            "C: Root KSK -> .edu DS -> .edu KSK -> berkeley.edu DS -> berkeley.edu KSK",
            "D: Root ZSK -> .edu KSK -> .edu ZSK -> berkeley.edu KSK -> berkeley.edu ZSK"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Chain of Trust"
    },
    {
        "id": "2187c88b-9fdf-4edb-9df5-58808a16264f",
        "source": "cs161_textbook",
        "question": "Your company operates an Autonomous System (AS) and you are configuring the routing policies. Considering the typical behavior of ASs as described, which of the following actions should the AS perform when receiving an incoming packet?",
        "choices": [
            "A: If the packet's final destination is within the AS, route the packet directly to that destination.",
            "B: For every incoming packet, use ARP to translate the packet's IP address to a MAC address before forwarding.",
            "C: Forward all incoming packets to the AS's gateway, regardless of the packet's final destination.",
            "D: If the packet's final destination is not within the AS, forward the packet to another AS that is closer to the final destination."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "Autonomous Systems"
    },
    {
        "id": "2cdf366c-c316-4e9d-ba2e-be8499efa52a",
        "source": "owasp_wstg",
        "question": "A financial web application uses hidden fields to store state information between client and server interactions. An attacker discovers that by modifying the hidden fields related to transaction IDs, they can re-submit transactions and bypass server-side checks, leading to unauthorized fund transfers. Which of the following best represents a vulnerability that the attacker is exploiting?",
        "choices": [
            "A: Weak encryption of transaction data allowing easy decryption by the attacker.",
            "B: Insufficient server-side validation of transaction state leading to replay attacks.",
            "C: Overly permissive cross-origin resource sharing (CORS) policy.",
            "D: Insecure direct object references resulting in unauthorized data access."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Replay Attack"
    },
    {
        "id": "6240260f-34d9-4d90-b331-0d0a39139a86",
        "source": "cwe",
        "question": "Consider the following Java code snippet for handling file reading exceptions:\n\njava\npublic class InputFileRead {\n  private File readFile = null;\n  private FileReader reader = null;\n  private String inputFilePath = 'c:\\\\somedirectory\\\\';\n  public void readInputFile() {\n    try {\n      reader = new FileReader(readFile);\n      // Read file contents\n    } catch (RuntimeException rex) {\n      System.err.println('Error: Cannot open input file in the directory ' + inputFilePath);\n    } catch (FileNotFoundException ex) {\n      // Handle exception\n    }\n  }\n}\n\n\nWhich of the following modifications would be considered a secure practice to address the vulnerability identified in the CWE 537 Java Runtime Error Message Containing Sensitive Information?",
        "choices": [
            "A: Replace the 'RuntimeException' catch block with a generic error message that does not reveal the default file path.",
            "B: Modify the 'FileNotFoundException' catch block to include the absolute path of the file that could not be found.",
            "C: Log the error message with the default file path to a secure system log accessible only by authorized personnel.",
            "D: Remove the try-catch block entirely, allowing the application to crash and rely on the underlying system's error handling."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ErrorHandling"
    },
    {
        "id": "c46aa73a-1298-43ba-b4ab-fd69127df8dd",
        "source": "owasp_wstg",
        "question": "A security analyst is attempting to use a fuzzing tool to test for vulnerabilities in a web application. Which of the following commands is incorrectly using the tool's syntax for fuzzing purposes?",
        "choices": [
            "A: wfuzz -w userIDs.txt -u https://example.com/view_photo?userId=FUZZ",
            "B: ffuf -w userIDs.txt -u https://example.com/view_photo?userId=FUZZ",
            "C: gobuster dir -w endpoints.txt -u https://example.com",
            "D: wfuzz -w userIDs.txt https://example.com/view_photo?userId=REPLACE"
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "fuzzing"
    },
    {
        "id": "9bf52616-f6ec-4dc5-aa91-cd2fdb00bc70",
        "source": "owasp_wstg",
        "question": "A web server has implemented strict validation on the Host header to mitigate Host header injection attacks. A penetration tester is exploring alternative methods to bypass this security control. Which of the following headers, if processed by the server, could potentially be used to bypass the Host header validation and perform an attack?",
        "choices": [
            "A: User-Agent",
            "B: X-Forwarded-For",
            "C: X-Forwarded-Host",
            "D: Accept-Encoding"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "X-Forwarded-Host Header Bypass"
    },
    {
        "id": "229cbc26-ebff-44a0-9653-674f01fb110e",
        "source": "cs161_textbook",
        "question": "Your organization is considering the implementation of a host-based intrusion detection system (HIDS) to enhance its network security posture. While evaluating this option, you need to consider the strengths and weaknesses of HIDS as compared to network-based intrusion detection systems (NIDS). Which of the following statements accurately reflect the considerations you should take into account?",
        "choices": [
            "A: HIDS can view decrypted HTTPS traffic at the end host, while NIDS might not be able to inspect this encrypted traffic.",
            "B: A single HIDS can be deployed to defend against intrusions across the entire network, reducing the overall cost and complexity of the deployment.",
            "C: HIDS eliminates all evasion attacks, such as path traversal attacks, by understanding the contents of end requests and the file system's interpretation.",
            "D: HIDS must be installed on each machine requiring protection, potentially leading to higher costs and the need for differently-configured systems."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HIDS"
    },
    {
        "id": "455fbf16-aa8a-4b58-9152-a841cdb01432",
        "source": "cs161_textbook",
        "question": "Which of the following statements are true regarding the historical aspects of cryptography and the breaking of the Enigma code during World War II?",
        "choices": [
            "A: The British success in breaking the Enigma code is attributed in part to the acquisition of a working Enigma machine from Poland.",
            "B: The Caesar cipher is named after Julius Caesar, who invented this encryption method during World War II.",
            "C: The British effort to break the Enigma code included over 10,000 people and electromechanical systems to search for possible keys.",
            "D: Alan Turing, while working on the Enigma code, was primarily responsible for the development of the Caesar cipher."
        ],
        "answer": "AC",
        "topics": [],
        "keyword": "Enigma"
    },
    {
        "id": "2e76b61a-f4ba-4987-bbd6-cd7935cb93cf",
        "source": "cwe",
        "question": "In reviewing the architecture of a web service that processes XML data, an analyst identifies the use of DTDs for XML documents. The service currently has no restrictions on entity expansion leading to potential denial-of-service risks. Which counterargument is most valid against the proposal to only increase server capacity as a mitigation strategy?",
        "choices": [
            "A: Increasing server capacity does not address the root cause of the vulnerability and can still be overwhelmed by recursive entity expansion.",
            "B: The proposal will reduce the overall performance of the web service by increasing the load on the server.",
            "C: DTDs are outdated and should be replaced with JSON, which does not have the same vulnerability.",
            "D: Recursive entity expansion cannot be triggered intentionally and only occurs due to malformed XML documents."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Entity_Expansion_Mitigation"
    },
    {
        "id": "1b43d827-abab-42a5-bede-92fda19019b5",
        "source": "attck",
        "question": "A company has been the target of multiple impersonation attacks where adversaries have successfully persuaded employees to perform unauthorized transactions. Which of the following mitigation strategies would be most effective in preventing such impersonation attempts? (Select TWO.)",
        "choices": [
            "A: Implement a Threat Intelligence Program to keep users informed about active impersonation campaigns.",
            "B: Restrict internet access for all employees to prevent phishing emails from reaching them.",
            "C: Train users to confirm requests through independent platforms before acting on them.",
            "D: Increase the complexity of password policies to make it harder for adversaries to guess user credentials."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Threat Intelligence Program"
    },
    {
        "id": "5f5d04e2-b838-4f80-a96a-4f510b6b8bb0",
        "source": "cs161_textbook",
        "question": "Security experts recommend against certain password storage practices. Which of the following reasons best supports their recommendation?",
        "choices": [
            "A: Storing passwords in the clear allows for easy maintenance and recovery of user accounts.",
            "B: Hashing passwords prevents immediate plain-text exposure, but if the hashing process is not secure, passwords can still be at risk.",
            "C: Storing passwords using proprietary algorithms ensures that attackers are unlikely to decipher the storage method.",
            "D: Encrypting passwords provides a sense of security, yet it does not prevent password reuse on multiple sites."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PasswordGuideline"
    },
    {
        "id": "e8d68116-ffdd-4688-aa7d-09c8561a2da6",
        "source": "windows_security",
        "question": "An organization has decided to enhance the security of its Remote Desktop connections by leveraging Windows security features. They want to ensure that credentials are protected during the session and that single sign-on is available, but credentials should not be used or exposed after the disconnection. Which of the following configurations should be applied to meet these requirements?",
        "choices": [
            "A: Enable Restricted Admin mode on the remote hosts.",
            "B: Implement Remote Credential Guard on the client devices.",
            "C: Allow delegation of nonexportable credentials on the remote host.",
            "D: Use the Remote Desktop Universal Windows Platform (UWP) application."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Remote Credential Guard"
    },
    {
        "id": "34963636-680e-4eef-a4ce-fb3f175304f4",
        "source": "owasp_mastg",
        "question": "An application's binary has been protected using several obfuscation techniques to hinder reverse engineering attempts. A reverse engineer has encountered difficulties in understanding the program flow due to the absence of the natural conditional constructs that are expected in such a program. Which obfuscation technique is most likely responsible for this complication?",
        "choices": [
            "A: Dead Code Injection",
            "B: String Encryption",
            "C: Control Flow Flattening",
            "D: Packing"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Program Flow Obfuscation"
    },
    {
        "id": "abc442cd-8658-4288-bf61-e3dddbbb8373",
        "source": "cs161_textbook",
        "question": "Why does cookie policy use a different set of rules than the same origin policy?",
        "choices": [
            "A: Because cookie policy is designed around domain-matching rules to determine which server can read the cookie, whereas the same origin policy is based on exact domain matching for security reasons.",
            "B: Because the same origin policy applies to actions such as writing to the DOM of a webpage, while cookie policy only governs the inclusion of cookies in HTTP requests.",
            "C: Because cookie policy is less strict than the same origin policy, allowing for greater flexibility in sharing cookies across related domains.",
            "D: Because they are governed by different RFCs and have evolved independently to serve different aspects of web security."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PolicyDifference"
    },
    {
        "id": "f0c79e96-a158-4bc2-a274-5685b58a374e",
        "source": "windows_security",
        "question": "An organization is considering applying an Account Lockout Policy to enhance security by preventing brute force attacks. What could be a potential impact of setting a low account lockout threshold?",
        "choices": [
            "A: It may reduce the effectiveness of brute force attacks by quickly locking out accounts after a few failed attempts.",
            "B: It could increase the risk of denial-of-service (DoS) attacks as legitimate users might get locked out more frequently.",
            "C: It may significantly improve system performance by reducing the number of authentication requests processed.",
            "D: It could lead to faster detection of compromised accounts by alerting administrators after each failed login attempt."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Account Lockout Threshold"
    },
    {
        "id": "9cfb4774-f52c-41aa-80d1-a0de89fa8a9c",
        "source": "mit6.858",
        "question": "In the context of WebAssembly, how does the structured control flow contribute to the safety and isolation of code execution, and what is the role of bounds-checking in memory operations?",
        "choices": [
            "A: WebAssembly's structured control flow ensures that at any point within a function, the number of runtime stack values is known, allowing compile-time checks for stack access and preventing jumps to misaligned code.",
            "B: Bounds-checking in memory operations ensures that any access to global variables or heap memory is within the limits of the allocated memory space, preventing state corruption outside of the module.",
            "C: Structured control flow in WebAssembly allows for dynamic checking of stack depth during runtime, which ensures that all local and global variable accesses are within bounds.",
            "D: Bounds-checking is unnecessary in WebAssembly memory operations as the WebAssembly virtual machine inherently prevents any out-of-bounds memory access without additional validation."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "MemorySafety"
        ],
        "keyword": "Control Flow"
    },
    {
        "id": "b265d896-e546-4249-acc3-5b1f53ed653e",
        "source": "cs161_textbook",
        "question": "In the context of security system design, which of the following reasons could lead to users subverting a security system? (Choose two.)",
        "choices": [
            "A: The security system features a lengthy and complex multi-factor authentication process for every login attempt.",
            "B: The security system allows for a quick and easy reset of credentials in case of a forgotten password.",
            "C: Users are provided with clear instructions and training on how to use the security system effectively.",
            "D: The security system utilizes a familiar, user-friendly interface to facilitate common tasks."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Security Subversion"
    },
    {
        "id": "418d1731-1d6e-4713-81f4-d4361b2f2ea2",
        "source": "owasp_wstg",
        "question": "Consider the following bash script snippet used for web directory enumeration:\nbash\n#!/bin/bash\n\nserver=example.org\nport=80\n\nwhile read url\ndo\necho -ne \"$url\\t\"\necho -e \"GET /$url HTTP/1.0\\nHost: $server\\n\" | netcat $server $port | head -1\ndone | tee outputfile\n\nIf this script is utilized during a penetration test, which of the following unintended outcomes could occur?",
        "choices": [
            "A: The script could inadvertently block legitimate user traffic to the server due to excessive requests.",
            "B: The script could reveal sensitive files and directories if the server is misconfigured to allow directory listing.",
            "C: The script could encrypt the server's data, triggering a ransomware alert.",
            "D: The script could strengthen the server's security by identifying and patching vulnerabilities."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Directory Enumeration"
    },
    {
        "id": "3c34fe7e-5fa1-45a7-a84b-d89b2e9dc4e3",
        "source": "mit6.858",
        "question": "Considering the vulnerabilities inherent in the TCP/IP protocol, particularly in relation to forged IP source addresses, which of the following measures could potentially harden TCP against such attacks? Select all that apply.",
        "choices": [
            "A: Implement packet filtering at ISP level to block packets with obviously forged IP source addresses.",
            "B: Increase the randomness in the selection of TCP initial sequence numbers (ISNs) beyond just low-order bits.",
            "C: Adopt a uniform increment for the initial sequence number (ISN) after each new connection to improve predictability.",
            "D: Utilize a per-connection ISN scheme using a cryptographic hash function with a secret and connection-specific values."
        ],
        "answer": "ABD",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "TCP/IP"
    },
    {
        "id": "4ac9808e-62b0-44ec-a026-fc19312cbe6b",
        "source": "cs161_textbook",
        "question": "Which of the following sets of cryptographic algorithms and key sizes are considered to provide a comparable level of difficulty for an attacker to break, based on current cryptographic standards?",
        "choices": [
            "A: 128-bit AES encryption, 256-bit RSA encryption, 256-bit elliptic curve cryptography",
            "B: 128-bit AES encryption, 256-bit elliptic curve cryptography, 2048-bit Diffie-Hellman",
            "C: 256-bit AES encryption, 512-bit RSA encryption, 384-bit elliptic curve cryptography",
            "D: 128-bit AES encryption, 1024-bit RSA encryption, 160-bit elliptic curve cryptography"
        ],
        "answer": "B",
        "topics": [
            "Cryptography"
        ],
        "keyword": "Cryptographic_Equivalency"
    },
    {
        "id": "1a24e3e9-7abb-4a95-bb13-e9861d435203",
        "source": "apple_platform_security",
        "question": "Which of the following features is NOT supported by Screen Time on the specified operating system?",
        "choices": [
            "A: Set web usage limits on macOS.",
            "B: Configure Downtime on watchOS.",
            "C: Enforce additional restrictions on tvOS.",
            "D: View usage data on iOS."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "ScreenTimeFeatures"
    },
    {
        "id": "cc599866-043a-4a85-9c69-4cc524ec1e0f",
        "source": "android_sec_doc",
        "question": "Why might an Android device that launched with Android 10 or higher not support full-disk encryption?",
        "choices": [
            "A: Because full-disk encryption does not support the ext4 and f2fs filesystems which are mandatory for Android 10 or higher.",
            "B: Because full-disk encryption has been entirely removed as a feature starting with Android 13.",
            "C: Because devices that launched with Android 10 or higher are required to use file-based encryption instead.",
            "D: Because full-disk encryption is not compatible with the Trusted Execution Environment's (TEE) signing capability."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "file-based encryption"
    },
    {
        "id": "dd544823-505c-421a-8a3c-8ac7b2659859",
        "source": "windows_security",
        "question": "You are configuring security monitoring for a Windows environment to detect specific activities. Which of the following event queries should you use to monitor for both user-initiated logoffs for non-network sessions and service logon events excluding the well-known system accounts LocalSystem, NetworkService, and LocalService?",
        "choices": [
            "A: <Select Path=\"Security\">*[System[(EventID=4634)]] and (*[EventData[Data[@Name='LogonType'] != '3']])</Select>",
            "B: <Select Path=\"Security\">*[System[(EventID=4624)]] and (*[EventData[Data[@Name='LogonType']='5']]) and (*[EventData[Data[@Name='TargetUserSid'] != 'S-1-5-18']]) and (*[EventData[Data[@Name='TargetUserSid'] != 'S-1-5-19']]) and (*[EventData[Data[@Name='TargetUserSid'] != 'S-1-5-20']])</Select>",
            "C: <Select Path=\"Security\">*[System[(EventID=4647)]]</Select>",
            "D: <Select Path=\"Security\">*[System[(EventID=4625)]] and (*[EventData[Data[@Name='LogonType'] != '2']])</Select>"
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Windows Security event logs"
    },
    {
        "id": "9a5d732c-9415-4b64-b866-48016dc515c3",
        "source": "attck",
        "question": "A cybersecurity team has discovered evidence of an adversary attempting to establish persistence on a network of Linux and Windows servers. The adversary is known to use system-level processes to execute malicious payloads upon system boot-up. As a security analyst, you are tasked with recommending strategies to mitigate this threat. Which of the following actions should be implemented to reduce the risk of persistence through system-level processes?",
        "choices": [
            "A: Enable Driver Signature Enforcement and restrict write access to process files.",
            "B: Increase network bandwidth to handle the extra traffic generated by malicious services.",
            "C: Disable all system services to prevent any malicious service from executing at startup.",
            "D: Install antivirus software on all client machines."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Driver Signature Enforcement"
    },
    {
        "id": "1d3d4311-b63a-4106-98c7-d27e4f4ec5a6",
        "source": "cs161_textbook",
        "question": "Why would a developer use code-coverage tools as part of their software testing strategy for memory safety?",
        "choices": [
            "A: To ensure that the code conforms to style guidelines and formatting standards.",
            "B: To assess which parts of the code have been executed during testing and identify areas that may require additional testing.",
            "C: To increase the performance efficiency of the code by optimizing memory usage.",
            "D: To automatically correct any memory safety errors found during testing."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "MemorySafety"
        ],
        "keyword": "CodeCoverage"
    },
    {
        "id": "8c6a1349-2f0a-4b10-9f4e-eafb75ed2afe",
        "source": "attck",
        "question": "A security analyst is investigating an incident where an adversary has potentially compromised authentication certificates to facilitate lateral movement within the network. Which of the following strategies would be the MOST effective in mitigating the risks associated with stolen or forged certificates?",
        "choices": [
            "A: Enforce strict user mappings by disabling the usage of AD CS certificate subject alternative names (SANs) within authentication protocol settings.",
            "B: Allow unrestricted enrollment and renewal of certificates by all users to ensure uninterrupted business operations.",
            "C: Disable certificate revocation lists to prevent adversaries from checking the validity of stolen certificates.",
            "D: Require CA Certificate Manager approval for certificate templates that include SAN as an issuance requirement."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Active Directory Certificate Services"
    },
    {
        "id": "5e32a823-e30a-413f-8c9b-2872bcf2bb7f",
        "source": "owasp_wstg",
        "question": "A company's web application allows for the creation and management of user accounts. During a security assessment, you are evaluating the account provisioning process to ensure there are adequate controls in place. Which of the following actions should raise a security concern?",
        "choices": [
            "A: The application allows users to provision accounts with privileges equal to their own.",
            "B: Administrators are required to provide a reason for each de-provisioning request.",
            "C: Administrators can provision other administrator accounts without additional verification.",
            "D: The application manages resources owned by a de-provisioned user by transferring access to an active user."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Account Provisioning"
    },
    {
        "id": "3775b5e7-422b-45cd-8613-c3a5e85f5405",
        "source": "cs161_textbook",
        "question": "Which of the following conditions does NOT make a C program susceptible to buffer overflow vulnerabilities?",
        "choices": [
            "A: Using a legacy function known for not performing bounds checking on input data.",
            "B: Placing a security-critical variable such as an authentication flag immediately after a buffer in the static memory.",
            "C: Employing a modern garbage-collected language feature that automatically handles memory management.",
            "D: Storing security-critical function pointers in memory locations that could be overwritten due to a buffer overflow."
        ],
        "answer": "C",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "VulnerabilityConditions"
    },
    {
        "id": "1af6163a-e096-438c-aedc-62afcf1c22c7",
        "source": "apple_platform_security",
        "question": "You are setting up a secure pairing between a host computer and a mobile device running iOS 11. Which of the following steps are involved in the pairing process and subsequent secure communications?",
        "choices": [
            "A: Exchange of 2048-bit RSA public keys and establishment of an encrypted SSL session.",
            "B: User must unlock the device, accept the pairing request, and enter their passcode.",
            "C: The host computer is required to connect to the mobile device via Bluetooth to establish a secure connection.",
            "D: Pairing enables the Secure Enclave to use com.apple.file_relay service without an Apple-signed configuration profile."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Pairing"
    },
    {
        "id": "1802b230-fb27-4561-8bf9-e0df435c26f2",
        "source": "cs161_textbook",
        "question": "What are the implications of Bitcoin's approach to not explicitly recording the balance of each user but instead recording every completed transaction in a public ledger? Select the correct statements.",
        "choices": [
            "A: Recording transactions instead of balances increases transparency, as it allows any user to independently verify the validity of transactions.",
            "B: Not explicitly recording balances reduces the ledger's size, as only transactions are recorded, not the balance after each transaction.",
            "C: This approach eliminates the need for a trusted authority to manage and update user balances.",
            "D: Every transaction requires a verification process that is more computationally intensive than simply updating user balances."
        ],
        "answer": "ABCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "BlockchainLedger"
    },
    {
        "id": "b2a48227-c13b-4d63-bad4-8e8fdb238176",
        "source": "cs161_textbook",
        "question": "Which of the following is the best counterargument to the belief that finding multiple short paths in a web of trust inherently increases the reliability of the resulting public key?",
        "choices": [
            "A: Multiple paths may lead to information overload, making it more difficult for users to discern which paths are trustworthy.",
            "B: The existence of multiple paths doesn't necessarily mitigate the risk of intermediaries being sloppy or malicious in their certificate signings.",
            "C: Users might prefer a single, long and complex path as it could potentially involve more individuals who have verified each other's identity.",
            "D: A greater number of paths could increase the computational cost and time required for public key verification, which could be seen as a disadvantage."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TrustReliability"
    },
    {
        "id": "af4073eb-38c4-4689-9624-80d7fdafb711",
        "source": "cwe",
        "question": "You are reviewing a piece of code where a 'Book' object is being passed to a method that may modify its contents, potentially leading to unexpected results in subsequent operations. Which of the following code modifications ensures that the originally intended state of the 'Book' object remains unaltered after the method call?",
        "choices": [
            "A: Create a deep copy of the 'Book' object and pass the copy to the method.",
            "B: Mark the 'Book' object as final before passing it to the method.",
            "C: Pass a new instance of 'Book' with default values to the method.",
            "D: Implement the 'ReadOnlyBook' interface in 'Book' class and pass a 'ReadOnlyBook' type to the method."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ObjectMutation"
    },
    {
        "id": "250c5e53-dd97-46f1-957f-42e0af3cf7b1",
        "source": "attck",
        "question": "An organization has observed suspicious activity on their network indicating an adversary may be using valid accounts to log into remote services and perform lateral movement. As a security consultant, which of the following mitigation strategies would you recommend to reduce the risk of such activity? (Select TWO.)",
        "choices": [
            "A: Implement multi-factor authentication on remote service logons where possible.",
            "B: Increase the session timeout intervals for remote services to reduce the attack surface.",
            "C: Limit the accounts that may use remote services and manage user account permissions.",
            "D: Enable all remote services to log more activity and improve incident response capabilities."
        ],
        "answer": "",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "3a206e3a-0239-43cd-80c9-d7f2ca06a2fb",
        "source": "owasp_wstg",
        "question": "A security analyst is tasked with identifying hidden administrator interfaces and functionality in a web application. Upon discovering an unprotected admin interface, which of the following actions should the analyst take to further assess the security of the interface? Select two:",
        "choices": [
            "A: Initiate a brute force attack using THC-HYDRA to test form-based HTTP authentication.",
            "B: Use ZAP - Forced Browse to search for unlinked resources and hidden directories.",
            "C: Employ a custom script to perform a DDoS attack and test the server's resilience.",
            "D: Generate a report based on the findings without conducting any further tests."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Brute Force Attack"
    },
    {
        "id": "752ca435-b982-4040-b6e5-cbd1202ce03c",
        "source": "apple_platform_security",
        "question": "An organization is considering the implications of using iCloud for storing sensitive corporate data. If the organization enables Advanced Data Protection for iCloud and requires employees to use Managed Apple IDs, which of the following statements are true regarding data security and recovery?",
        "choices": [
            "A: Enabling Advanced Data Protection will prevent Apple from assisting with account recovery, as encryption keys are only available on trusted devices.",
            "B: If an employee loses all trusted devices and recovery options, the organization cannot recover the end-to-end encrypted data stored in iCloud.",
            "C: Managed Apple IDs are exempt from end-to-end encryption, allowing IT administrators to have unrestricted access to user data.",
            "D: Data transferred between devices and iCloud servers is encrypted in transit, ensuring data security even if Advanced Data Protection is not enabled."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DataRecovery"
    },
    {
        "id": "be244341-5c82-4fd5-9755-48e22620c722",
        "source": "attck",
        "question": "Your company is refining its containerized environment security posture. Which of the following practices should be avoided as it would not enhance security against adversaries attempting to discover resources within the container environment?",
        "choices": [
            "A: Restricting the IP ranges permitted to access the Kubernetes API server.",
            "B: Implementing just-in-time (JIT) access controls on the Kubernetes API.",
            "C: Enforcing user account management by limiting dashboard visibility and permissions.",
            "D: Granting network access to the container service API without any authentication."
        ],
        "answer": "D",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "API Security"
    },
    {
        "id": "6b5b2a96-e297-41da-ac6f-79f7170969f4",
        "source": "cwe",
        "question": "Consider a proposed design strategy to mitigate input validation issues where all inputs to an application are first canonicalized to a consistent internal representation and then filtered for any unwanted content. What is an advantage and what could be a potential drawback of this approach?",
        "choices": [
            "A: Advantage: It standardizes inputs to a uniform format, reducing the chance of bypassing filters. Drawback: It can introduce additional processing overhead, potentially impacting performance.",
            "B: Advantage: It makes the code more readable and maintainable. Drawback: It may lead to information loss if the canonicalization process is not reversible.",
            "C: Advantage: It can prevent buffer overflow attacks by limiting input size. Drawback: It may not be compatible with all types of encoding schemes used by clients.",
            "D: Advantage: It ensures that all inputs are encrypted before processing. Drawback: It may not be compatible with legacy systems that require specific data formats."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "a3cf6caa-82c1-4a45-bb6f-94b7920ca8fb",
        "source": "d3fend",
        "question": "An organization suspects that one of its endpoints may have been compromised. The security team needs to investigate the endpoint's health and detect any unauthorized modifications to system files. Which two Detect techniques should be prioritized to address these concerns?",
        "choices": [
            "A: File Integrity Monitoring and System Firmware Verification",
            "B: URL Analysis and File Carving",
            "C: RPC Traffic Analysis and Peripheral Firmware Verification",
            "D: Sender MTA Reputation Analysis and Emulated File Analysis"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "MemorySafety",
            "PenTest"
        ],
        "keyword": "File Integrity Monitoring"
    },
    {
        "id": "b4c81135-0ead-4579-a790-afb51b55bf96",
        "source": "apple_platform_security",
        "question": "In an organization using Apple devices, a security administrator is tasked with enhancing the security of email communications and user authentication. Which of the following measures could the administrator implement to ensure digital signing, encryption, and two-factor authentication?",
        "choices": [
            "A: Configure Mail app to use RFC 5322 case-sensitive email addresses for automatic discovery of digital signing and encryption certificates.",
            "B: Integrate Smart cards with PIN for two-factor authentication and enable them for Login Window authentication in macOS 10.12 or later.",
            "C: Create encrypted disk images using Disk Utility with 256-bit AES encryption for secure email attachments.",
            "D: Use per-message S/MIME to selectively sign and encrypt individual messages in iOS, iPadOS, and macOS."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "f9381e1e-608d-48a7-9525-72b90de03b72",
        "source": "cwe",
        "question": "In a new smart home device architecture, several components including sensors, a central processing unit (CPU), and a smart hub, all communicate over a shared bus. Each sensor operates as a responder device and interfaces with the rest of the system through a fabric end-point. To enhance system security and prevent any single sensor from controlling bus transactions, which of the following measures should be implemented?",
        "choices": [
            "A: Hardcode the bus-control-enable bit in the fabric end-point register of each sensor to 1 to allow transaction control.",
            "B: Ensure that during the secure-boot process, the bus-control-enable bit in the fabric end-point register is set to 0 for all responder devices.",
            "C: Implement a firmware routine to verify and correct the bus-control-enable bit setting in all responder devices during runtime.",
            "D: Allow unrestricted writes to the bus-control-enable register to maintain flexibility in the system configuration."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "bus-controlling"
    },
    {
        "id": "3a296304-56f7-4376-b146-b7ebcf5a1fac",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating an incident where a sophisticated malware strain was deployed within the organization's network. The malware exhibited a behavior where it would only execute under certain conditions, such as the presence of specific files and network configurations. This behavior prevented the malware from executing in unintended environments. Based on this scenario, what is the purpose of this conditional execution constraint employed by the malware authors?",
        "choices": [
            "A: To ensure that malware propagates to as many systems as possible within the target network.",
            "B: To prevent the malware from executing in virtualized or sandboxed environments for analysis.",
            "C: To limit the malware execution to intended targets and reduce collateral damage from the campaign.",
            "D: To evade signature-based detection by altering the malware's behavior based on the environment."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Execution Guardrails"
    },
    {
        "id": "0fca90cc-51a1-4111-a112-2a37b63e168c",
        "source": "owasp_wstg",
        "question": "A security consultant is reviewing a web application that uses IndexedDB extensively for storing data. The consultant notices that sensitive information, such as personal identification numbers, is also being stored in IndexedDB. What should be the primary argument against this practice?",
        "choices": [
            "A: IndexedDB is not supported by all browsers, making it an unreliable storage option.",
            "B: IndexedDB can lead to a slower application performance, negatively impacting user experience.",
            "C: IndexedDB, being a client-side storage, is more susceptible to client-side attacks and should not contain sensitive data.",
            "D: The storage limit for IndexedDB is too low to accommodate large amounts of sensitive data."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IndexedDB"
    },
    {
        "id": "2aeb068c-271c-400d-b400-5b7bfbc72c69",
        "source": "windows_security",
        "question": "An IT security professional is evaluating the deployment of Credential Guard in their organization's virtualized environment. Which of the following statements are accurate regarding the use of Credential Guard in this context? (Select TWO)",
        "choices": [
            "A: Credential Guard provides protection from privileged system attacks originating from the host in Hyper-V virtual machines.",
            "B: Credential Guard is available on Hyper-V or Azure generation 2 VMs only and not supported on generation 1 VMs.",
            "C: Credential Guard can be enabled on a Hyper-V virtual machine without the host having an IOMMU.",
            "D: Credential Guard protects secrets in Hyper-V virtual machines in the same way as on a physical machine."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Hyper-V Virtual Machines"
    },
    {
        "id": "9652105b-9a0f-4e32-81d2-fbad54a0a0d1",
        "source": "cs161_textbook",
        "question": "Consider the scenario where a bank's website is vulnerable to CSRF attacks due to session tokens being automatically attached to requests. Which of the following measures could effectively mitigate the risk of CSRF attacks in this context? Select all that apply.",
        "choices": [
            "A: Implementing anti-CSRF tokens that must be included in every form submission.",
            "B: Restricting the use of session tokens to only GET requests to prevent state changes.",
            "C: Using CAPTCHA verification on every request to confirm the user's intention.",
            "D: Enabling HTTP Strict Transport Security (HSTS) to ensure secure connections."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "75040e11-74b6-4665-8350-ba02a0ba5199",
        "source": "owasp_mastg",
        "question": "An Android application developer is optimizing the app's security and performance for a release build. They need to configure ProGuard or R8 to obfuscate the code. Which of the following statements correctly describe the actions the developer should take and the trade-offs involved?",
        "choices": [
            "A: The developer should use R8 because it can obfuscate the code without removing useful attributes for debugging such as line numbers, source file names, and variable names.",
            "B: To prevent runtime errors, the developer must keep certain classes using the `-keep` flag in the `proguard-rules.pro` file, especially for common Android classes such as Activities, Applications, and Services.",
            "C: Applying obfuscation to the entire codebase is recommended to achieve the highest level of security, even if it comes at the cost of significant runtime performance degradation.",
            "D: The developer should avoid using any code shrinking or obfuscation techniques since they always result in a considerable decrease in runtime performance, outweighing any security benefits."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "ProGuard/R8"
    },
    {
        "id": "cb7e8e3e-4eda-4c81-bb29-277d1e00f51f",
        "source": "apple_platform_security",
        "question": "An application previously notarized by Apple is later discovered to contain malware. What actions do macOS security services take to address this issue, based on the security protocols in place?",
        "choices": [
            "A: macOS uses Gatekeeper to automatically remove the application from the system without notifying the user.",
            "B: Apple issues a revocation ticket for the application, and macOS checks for new revocation tickets to block the launch of the malicious app.",
            "C: XProtect performs real-time scanning and issues a new notarization ticket to clear the app for future use.",
            "D: Notarization service rescans the app and, if malware is detected, it updates the app's signature to prevent execution."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Malware Response"
    },
    {
        "id": "fcaa7b8d-cf15-4b9e-82e7-558ce5359151",
        "source": "apple_platform_security",
        "question": "In macOS 10.15, when do apps require explicit user consent or action to access certain files or functionalities? Select all that apply.",
        "choices": [
            "A: Apps require user permission to access files in the Downloads folder.",
            "B: Users must manually grant apps permission to access items in the user’s Bin using Full Disk Access.",
            "C: User permission is required for apps to automate Apple events.",
            "D: Apps need explicit addition in System Preferences to access the full internal storage."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AppPermissions"
    },
    {
        "id": "2df8a1bb-0314-4dab-bb9e-44160ba57187",
        "source": "attck",
        "question": "An adversary has compromised a system and is now attempting to evade detection. Which of the following actions would they most likely take to exploit a system or application vulnerability as part of their defense evasion strategy?",
        "choices": [
            "A: Executing a denial-of-service attack to overwhelm security features.",
            "B: Exploiting a programming error to execute adversary-controlled code.",
            "C: Encrypting data on the system to demand a ransom.",
            "D: Creating multiple user accounts to achieve persistence."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Exploitation for Defense Evasion"
    },
    {
        "id": "5b99394b-26ed-4aac-afdc-cacacf9c8370",
        "source": "mozilla_security",
        "question": "A company is planning to launch a new website which will be used by the general public for various services. The website should ensure a secure connection and maintain a balance between modern security practices and broad compatibility. Which of the following TLS configurations should be recommended for the company's website to align with best security practices?",
        "choices": [
            "A: Mozilla modern TLS configuration.",
            "B: Mozilla intermediate TLS configuration.",
            "C: Mozilla backwards compatible TLS configuration.",
            "D: No TLS configuration is necessary for general public websites."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TLS Configuration"
    },
    {
        "id": "983f62b8-c5df-4e6d-bcf3-812b946b4916",
        "source": "cwe",
        "question": "A development team is working on a web application. During a security review, they discover that the application only relies on client-side checks to verify if a user is logged in before allowing access to restricted areas. The team is considering several strategies to enhance the security of the application's authentication process. Which of the following strategies would effectively mitigate the risk of improper authentication, according to best practices in secure application design?",
        "choices": [
            "A: Implement server-side validation of the user's session token to ensure it is valid and has not been tampered with.",
            "B: Use a CAPTCHA on the login page to prevent automated brute force attacks.",
            "C: Restrict the number of login attempts to prevent attackers from guessing passwords.",
            "D: Store user credentials in encrypted cookies to prevent attackers from reading them."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "923e0abd-57b3-4d13-b9b5-501ca56074bf",
        "source": "owasp_mastg",
        "question": "An application security engineer wants to start the 'dnsmasq' service with a custom configuration file to test for DNS-related security issues in a mobile application. Which command should they execute to run 'dnsmasq' with the specified configuration file 'dnsmasq.conf' and enable verbose logging?",
        "choices": [
            "A: $ dnsmasq --config dnsmasq.conf --verbose",
            "B: $ dnsmasq -C dnsmasq.conf -d",
            "C: $ dnsstart -c dnsmasq.conf -v",
            "D: $ run-dns --configuration=dnsmasq.conf --debug-mode"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "dnsmasq"
    },
    {
        "id": "9fa65342-1115-490b-bf63-58490c61fa1d",
        "source": "cs161_textbook",
        "question": "A developer is attempting to use parameterized SQL to prevent SQL injection in their application. However, they mistakenly wrote the following code snippet: `conn.execute(\"SELECT * FROM users WHERE username = ? AND password = ?\", username, password)`. Identify the issues with this approach.",
        "choices": [
            "A: Using parameterized SQL in this way does not prevent SQL injection, as the parameters are not being used within a prepared statement.",
            "B: The parameters should be enclosed in a tuple or list, otherwise, it can lead to a syntax error or incorrect query execution.",
            "C: The approach is correct; there are no issues with this implementation of parameterized SQL.",
            "D: The use of double quotes for the SQL query string can make the code prone to SQL injection if the programming language interprets it as allowing interpolation."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Parameterized SQL"
    },
    {
        "id": "2f618b38-5795-47e3-a061-14fcf887cf8b",
        "source": "attck",
        "question": "A financial institution is experiencing a severe Distributed Denial of Service (DDoS) attack, which has resulted in the saturation of its network's bandwidth. The organization's online services, including websites and email, have been disrupted. As a cybersecurity consultant, you've been asked to recommend an immediate mitigation strategy. Which of the following would be the most effective initial response to mitigate the impact of the attack?",
        "choices": [
            "A: Implement on-premises filtering by blocking the source IP addresses sourcing the attack.",
            "B: Engage a third-party Content Delivery Network (CDN) provider to intercept the traffic and filter out attack traffic.",
            "C: Increase the bandwidth of the network connection to accommodate the additional traffic until the attack subsides.",
            "D: Deploy additional on-premises web servers to distribute the load caused by the incoming attack traffic."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "DDoS Mitigation"
    },
    {
        "id": "ac76ee1c-2616-4d76-b2f3-8b89383df56b",
        "source": "mit6.858",
        "question": "An attacker is attempting to exploit a buffer overflow vulnerability in a heap-allocated buffer within a C application. The application uses a version of malloc() that maintains a doubly-linked list of free and used memory blocks. If the attacker successfully overflows a malloc()ed block, they can potentially modify the next and prev pointers in the next block, allowing arbitrary writes in memory. Which of the following countermeasures or considerations could potentially thwart this type of heap-based buffer overflow attack?",
        "choices": [
            "A: Use of a memory-safe language for writing new code, which can be a significant effort but provides inherent protection against these types of memory corruption vulnerabilities.",
            "B: Employ stack canaries between variables and return addresses on the stack, with the understanding that this defense is designed for stack-based overflows and not heap-based ones.",
            "C: Implementation of ASLR to randomize the process memory addresses, although this can be bypassed if an attacker can still predict the address of crucial pointers.",
            "D: Incorporation of bounds checking in the form of fat pointers, which may not be applicable to heap-based buffer overflows as fat pointers are mainly designed for stack or global buffer protection."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HeapOverflowMitigation"
    },
    {
        "id": "526413b2-e4da-4593-a617-4f684e4105fc",
        "source": "cs161_textbook",
        "question": "A company has experienced a security breach and multiple machines are compromised. You are tasked with determining the nature of the malware based on the behavior observed. The malware propagated without any user action and altered already-running code on the machines. Which type(s) of malware might be responsible for the infection, and what could be a potential application of this malware by the attacker?",
        "choices": [
            "A: A virus, because it requires user action to propagate and could be used to create a botnet.",
            "B: A worm, because it does not require user action to propagate and could be used to create a botnet.",
            "C: A virus, because it infects computers by altering already-running code and could be used to steal sensitive information.",
            "D: A worm, because it requires some user action to propagate and could be used to steal sensitive information."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Malware"
    },
    {
        "id": "96284696-b57f-4d66-b4c4-83d25acc566a",
        "source": "owasp_wstg",
        "question": "In an audit of a web application's security, you are reviewing LDAP search filter implementations. Which of the following filters would be MOST susceptible to LDAP injection attack and why?",
        "choices": [
            "A: A search filter that dynamically includes user-provided input without escaping special characters.",
            "B: A hardcoded search filter that uses specific attributes and values without user input.",
            "C: A search filter with user input that is strictly type-checked and sanitized for LDAP metacharacters.",
            "D: A search filter that employs proper syntax and escapes user input but is only used in internal applications."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "LDAP Injection"
    },
    {
        "id": "46e9a5bd-ceec-4425-83dd-f1c63293a716",
        "source": "attck",
        "question": "An adversary has gained administrator access to a network device and aims to compromise its encryption capabilities, thereby facilitating unauthorized disclosure and data manipulation. Which of the following actions is the adversary most likely to take to achieve this objective?",
        "choices": [
            "A: Increase the complexity of the encryption algorithm to burden the system resources excessively.",
            "B: Reduce the encryption key space to make the process of cryptanalysis less computationally intensive.",
            "C: Strengthen the encryption cipher to require a more advanced decryption key.",
            "D: Enable additional crypto hardware to increase the encryption workload on the device."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Reduce Key Space"
    },
    {
        "id": "963425a7-28ab-4f87-a741-1620ed531113",
        "source": "windows_security",
        "question": "A company is planning to deploy virtual smart cards for their employees. The IT department is deliberating between using managed and unmanaged virtual smart cards. Which of the following statements are correct regarding the differences between managed and unmanaged virtual smart cards in terms of IT administrative control and user self-service capabilities?",
        "choices": [
            "A: Managed virtual smart cards allow users to reset their PIN without IT administrator intervention, whereas unmanaged cards require the IT administrator to reset the PIN.",
            "B: Unmanaged virtual smart cards can be serviced by the IT administrator or another designated role, allowing for influence or complete control over specific aspects of the card.",
            "C: Managed virtual smart cards require the use of a virtual smart card deployment management tool for IT administrators to manage the cards.",
            "D: For unmanaged virtual smart cards, when a user forgets their PIN, the recommended solution is to delete and recreate the card."
        ],
        "answer": "CD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Virtual Smart Card"
    },
    {
        "id": "0a1dbcfe-611c-4701-ba0d-0fa431bfa182",
        "source": "attck",
        "question": "An adversary has been detected using a scheduled transfer technique, causing data to be exfiltrated at seemingly random intervals that coincide with normal network traffic. In addition to monitoring network connection creations, what other detection method could be employed to identify this exfiltration activity?",
        "choices": [
            "A: Monitor for network traffic originating from unknown/unexpected hardware devices.",
            "B: Install antivirus software on all endpoints to prevent the installation of malware.",
            "C: Disable all scheduled tasks on the network to prevent any form of scheduled transfer.",
            "D: Restrict internet access to pre-approved websites to reduce the risk of data exfiltration."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Monitoring"
    },
    {
        "id": "1cf27ef8-c3f8-4972-aab7-d9d3f8c06423",
        "source": "attck",
        "question": "As part of a penetration testing team, you are tasked with enhancing the security posture of a client's network. Given that a known malware strain, such as LiteDuke, has the ability to download files to a compromised host, which of the following defensive measures would LEAST likely prevent this specific behavior?",
        "choices": [
            "A: Blocking command-and-control (C2) server traffic.",
            "B: Implementing application whitelisting.",
            "C: Enforcing network-level authentication for remote services.",
            "D: Disabling unnecessary file download capabilities in web browsers."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Malware Defense"
    },
    {
        "id": "e6dbc33f-7838-4309-875b-06df3ad78bee",
        "source": "apple_platform_security",
        "question": "An administrator is configuring a Mac with an Apple T2 Security Chip. Which of the following statements are accurate regarding the security policy settings that Startup Security Utility handles and the authentication process required for critical policy changes?",
        "choices": [
            "A: The T2 chip requires the Mac to be booted into recoveryOS and authenticated with a Secure Enclave–backed credential before a policy change can be made.",
            "B: Security policy changes can be made without authentication if the Mac is booted from an external storage device.",
            "C: Startup Security Utility requires an administrator password from the primary macOS installation for critical policy changes.",
            "D: A Firmware Password is mandatory on all Intel-based Macs with a T2 chip to prevent unintended firmware modifications."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "MacSecurity"
    },
    {
        "id": "a76c7724-91bc-4b25-8813-af40e9ae1da4",
        "source": "owasp_wstg",
        "question": "You are tasked with assessing the security of a web application's network infrastructure. During your review, you identify that the backend database servers are running outdated software known to have vulnerabilities. Additionally, the administrative tools used to maintain the web server's infrastructure have default credentials that have not been changed. Based on best practices for web server infrastructure security, which of the following steps is critical to address these findings?",
        "choices": [
            "A: Implement a more complex routing protocol to enhance network encryption.",
            "B: Update the software on the backend database servers and change the default credentials on administrative tools.",
            "C: Increase the bandwidth of the network to prevent denial-of-service attacks.",
            "D: Deploy an additional firewall to monitor inbound traffic to the database servers."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Configuration Management"
    },
    {
        "id": "baa52bbd-4fb7-4424-81fb-c539d09abd7c",
        "source": "cwe",
        "question": "Review the following code snippets used for CBC mode encryption. Which snippet does NOT appropriately mitigate the risk of using a predictable IV?",
        "choices": [
            "A: byte[] iv = new byte[16]; SecureRandom.getInstanceStrong().nextBytes(iv); Cipher cipher = Cipher.getInstance('AES/CBC/PKCS5Padding'); cipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(iv));",
            "B: byte[] iv = new byte[16]; Arrays.fill(iv, (byte) 0); Cipher cipher = Cipher.getInstance('AES/CBC/PKCS5Padding'); cipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(iv));",
            "C: byte[] nonce = new byte[16]; SecureRandom.getInstanceStrong().nextBytes(nonce); Cipher cipher = Cipher.getInstance('AES/CBC/PKCS5Padding'); cipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(cipher.doFinal(nonce)));",
            "D: byte[] iv = SecureRandom.getSeed(16); Cipher cipher = Cipher.getInstance('AES/CBC/PKCS5Padding'); cipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(iv));"
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Predictable IV"
    },
    {
        "id": "05914d87-9141-4505-8bdc-273bf001948d",
        "source": "android_sec_doc",
        "question": "In which of the following scenarios would the property of rollback-resistant keys NOT provide additional security?",
        "choices": [
            "A: Deleting sensitive keys before selling a device to prevent data recovery.",
            "B: Restoring an Android device from an untrusted backup source that might contain malicious keys.",
            "C: Preventing the use of keys after a device has been reported lost or stolen.",
            "D: Integrating a third-party service that requires periodic key rotation and does not rely on key deletion for security."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Rollback-Resistant"
    },
    {
        "id": "2042f3d8-ad98-4d29-91d7-f431848e4459",
        "source": "windows_security",
        "question": "In the context of Windows Defender System Guard, how does the Trusted Platform Module 2.0 (TPM 2.0) contribute to maintaining the integrity of a Windows operating system after the boot process?",
        "choices": [
            "A: TPM 2.0 generates a series of integrity measurements as Windows boots, which are then used to verify the security state of the device remotely.",
            "B: TPM 2.0 replaces the need for Secure Launch by providing a direct root of trust for the operating system.",
            "C: TPM 2.0 functions as an alternative to the Secure Boot feature, allowing for a dynamic transition into a trusted state.",
            "D: TPM 2.0 serves as a storage device for sensitive information, such as single sign-on tokens and biometric data."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "TPM 2.0"
    },
    {
        "id": "69bca45c-b053-452f-a847-d1e3026ce489",
        "source": "apple_platform_security",
        "question": "Consider a scenario where an individual is attempting to access password-protected data on a device with a Secure Storage Component. As a cybersecurity specialist, identify the sequence of events and the security measures that are triggered when incorrect passcode attempts are made.",
        "choices": [
            "A: The counter is incremented with each incorrect attempt and if the maximum is reached, the Secure Storage Component erases the counter lockbox.",
            "B: The counter is decremented with each incorrect attempt and if zero is reached, the Secure Storage Component locks the device permanently.",
            "C: The Secure Storage Component attempts to derive the passcode verifier value and lockbox entropy value using the algorithm that created the counter lockbox.",
            "D: Once the maximum attempt count is reached, the Secure Storage Component disables Face ID and Touch ID as part of the anti-replay services."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecureStorage"
    },
    {
        "id": "cfd5b92e-3b75-4b3f-bb89-574fa8644611",
        "source": "owasp_mastg",
        "question": "You are developing an iOS application that requires storing cryptographic keys securely. Which of the following methods would you consider the most secure for storing these keys?",
        "choices": [
            "A: Storing keys in the Keychain with a protection class of 'kSecAttrAccessibleAlways'.",
            "B: Using a key derivation function like PBKDF-2 and not storing the key on the device at all.",
            "C: Hardcoding the encryption keys in the source code for ease of use.",
            "D: Using NSUserDefaults to store the keys, as it is a common practice in iOS development."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Keychain"
    },
    {
        "id": "ed8e7084-ae06-4bb4-8e10-cb07158eba2d",
        "source": "android_sec_doc",
        "question": "An engineer is tasked with enabling Android Verified Boot (AVB) on the system_other partition of an A/B device launched with Android 10. To ensure successful verification after an over-the-air update, which action should the engineer take regarding the fstab file and the AVB public key?",
        "choices": [
            "A: Set the fstab file in the system partition and use the property ro.postinstall.fstab.prefix to point to /system.",
            "B: Place the fstab file in the product partition and set the property ro.postinstall.fstab.prefix to /product.",
            "C: Include system_other.img in the over-the-air package to prevent verification errors.",
            "D: Enable AVB on devices launched before Android 10 and upgraded to Android 10 with PRODUCT_RETROFIT_DYNAMIC_PARTITIONS set to true."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "AVB (Android Verified Boot)"
    },
    {
        "id": "69fdd3ef-bab9-4ef1-a649-a8fe927ccb63",
        "source": "cwe",
        "question": "Consider a scenario where you are tasked with securing a banking application that currently allows users to perform transactions without any form of user authentication, exposing it to unauthorized access and fraud. Based on the principles of secure architecture and design, select the most appropriate measures to mitigate this risk.",
        "choices": [
            "A: Implement role-based access control by categorizing users as anonymous, normal, privileged, and administrative, and then require authentication for roles with access to sensitive operations.",
            "B: Use a custom authentication protocol for the primary communication channel and assume secondary channels are secure if the primary authentication is successful.",
            "C: Replicate any client-side security checks on the server side to prevent attackers from bypassing security controls by modifying client behavior.",
            "D: Avoid using established authentication frameworks or libraries, and instead create a custom authentication solution for each separate page or operation."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "5e81dae8-cb98-4f57-bf83-9fc75a28098c",
        "source": "cwe",
        "question": "In designing a cloud storage synchronization service, which of the following strategies for setting resource permissions would best minimize the risk of a permission race condition during the copying of resources?",
        "choices": [
            "A: Applying the final permissions after resources have been copied to their destination.",
            "B: Setting up a temporary quarantine area where files are stored with restrictive permissions until copying is complete.",
            "C: Creating a log of all copied resources to review permissions after the synchronization process.",
            "D: Using inherited permissions from the parent directory during copying, then applying custom permissions later."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ResourcePermissions"
    },
    {
        "id": "c0eb46ce-8669-4298-89c8-b071e95ffddb",
        "source": "cs161_textbook",
        "question": "Which of the following statements is incorrect regarding the Diffie-Hellman key exchange protocol?",
        "choices": [
            "A: The public parameters p and g do not need to be chosen for each key exchange as they are often hardcoded or defined in a standard.",
            "B: Alice and Bob use their private values to compute a shared secret key that cannot be efficiently deduced by an eavesdropper.",
            "C: The shared secret key generated through the Diffie-Hellman key exchange is directly used for a symmetric-key cryptosystem without any further processing.",
            "D: The fastest known algorithms for an eavesdropper to solve the Diffie-Hellman problem take exponential time in the number of bits of the prime p."
        ],
        "answer": "C",
        "topics": [],
        "keyword": "Diffie-Hellman"
    },
    {
        "id": "7537b63d-9d5a-453d-9cf1-af4ab4f0d0fa",
        "source": "owasp_wstg",
        "question": "A ticketing application faces an issue where attackers reserve seats without completing the purchase, potentially blocking other customers. Which of the following session management strategies would best mitigate this issue while maintaining user convenience and system security?",
        "choices": [
            "A: Allow users to reserve seats without any time limit, reducing the pressure to complete transactions quickly.",
            "B: Implement a short timeout period after which the reserved seats are released if the transaction is not completed.",
            "C: Require users to complete a CAPTCHA before every transaction to ensure that the reservation is made by a human.",
            "D: Send periodic reminders to users with reserved seats to complete their purchase or extend the reservation."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Session Management"
    },
    {
        "id": "e1bf8156-ef6f-4711-82d4-5ef5cc7dff46",
        "source": "attck",
        "question": "An organization's cybersecurity policy mandates the monitoring of certain system activities to detect adversarial behaviors that involve hiding artifacts. Which of the following monitoring practices align with this policy?",
        "choices": [
            "A: Monitoring API calls that may attempt to hide artifacts",
            "B: Reviewing user account creation for excessive privileges",
            "C: Checking the system for enabled scripts running out of cycle from patching",
            "D: Inspecting service creation for compliance with naming conventions"
        ],
        "answer": "AC",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Detection"
    },
    {
        "id": "c994a7d8-5652-45e3-bfcc-6a6a678aa80e",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately describe the security protocols and data handling processes employed by Apple for its Messages for Business, FaceTime, and Find My services?",
        "choices": [
            "A: Messages for Business are decrypted in RAM on Apple messaging servers before being relayed to the business over a TLS 1.2 encrypted link.",
            "B: The audio/video contents of FaceTime calls are protected by end-to-end encryption and Apple cannot access the decrypted data.",
            "C: Group FaceTime calls utilize a key-establishment mechanism that provides backward secrecy, compromising a user's device would potentially leak past call contents.",
            "D: The Find My app uses a private/public key pair and a counter-based key derivation method for locating devices which is designed to prevent device tracking."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Encryption"
    },
    {
        "id": "dfaf6380-c49f-4e7b-8339-15ecfaf51c01",
        "source": "attck",
        "question": "When designing a network monitoring system to detect possible data exfiltration over unconventional mediums like Bluetooth, which of the following measures should be implemented to enhance detection capabilities? (Select two)",
        "choices": [
            "A: Monitor for file access patterns that could indicate exfiltration, such as file reads by a process with an active network connection.",
            "B: Deploy network intrusion detection systems on all endpoints regardless of their network usage patterns.",
            "C: Analyze network traffic for anomalies in expected protocol standards and traffic flows.",
            "D: Limit the monitoring to the primary wired Internet connections to focus on the most likely exfiltration channels."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "Vulnerability",
            "PenTest"
        ],
        "keyword": "Network Anomaly Detection"
    },
    {
        "id": "102235a4-4d6a-484a-ae78-18a4fbe351d8",
        "source": "cwe",
        "question": "What are potential consequences of failing to invoke an object's destructor method when the object is no longer needed? Choose all that apply.",
        "choices": [
            "A: Improved performance due to reduced overhead from destructor invocation.",
            "B: Memory leaks due to resources not being released.",
            "C: Increased security as fewer operations are performed on the object.",
            "D: Resource exhaustion if objects accumulate over time without proper cleanup."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ResourceManagement"
    },
    {
        "id": "c9066904-640a-4d5e-946d-8031ee572d84",
        "source": "cs161_textbook",
        "question": "In the context of DNS security, which of the following statements accurately reflect the advantages and disadvantages posed by DNS caching in the face of network attacks? Choose all that apply.",
        "choices": [
            "A: DNS caching provides an advantage by preventing off-path attackers from continuously sending fake responses, as the cache will serve requests after the first valid response.",
            "B: A disadvantage of DNS caching is that if a malicious response is cached, it can redirect users to incorrect addresses until the TTL expires, potentially for a long duration.",
            "C: DNS caching is disadvantageous as it increases the window of opportunity for off-path attackers to guess the ID field and inject a malicious response.",
            "D: A major advantage of DNS caching is that it completely mitigates the risk of on-path attackers by ensuring only legitimate responses are cached."
        ],
        "answer": "AB",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DNS Caching"
    },
    {
        "id": "427aa16a-6d34-4e17-974a-ea97ef4a149b",
        "source": "cs161_textbook",
        "question": "Imagine you are a lead software architect in a tech company and you are tasked with starting a new project that requires high memory safety. You are considering using a memory-safe language for this project. Which of the following reasons would support your decision to use a memory-safe language, and which reasons might explain why a different team might choose not to use a memory-safe language?",
        "choices": [
            "A: A memory-safe language can eliminate all memory safety vulnerabilities, ensuring robust security for the application.",
            "B: A memory-safe language might be avoided due to the need to maintain and integrate with existing legacy code written in a memory-unsafe language.",
            "C: A memory-safe language may incur performance overhead due to runtime checks which can be a concern for performance-critical applications.",
            "D: A memory-safe language lacks the necessary features and libraries available in some memory-unsafe languages, which can be critical for certain applications."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity",
            "MemorySafety"
        ],
        "keyword": "memory-safe"
    },
    {
        "id": "1012128e-ee1f-4a1c-b551-9fd9ec194d05",
        "source": "apple_platform_security",
        "question": "A company is looking to implement a biometric system for secure access to their devices. They are considering both Apple's Face ID and Touch ID technologies. Analyze the provided features and policies of both technologies to determine the advantages and disadvantages. Which of the following statements are correct regarding these technologies?",
        "choices": [
            "A: Face ID uses a randomized sequence of 2D images and depth map captures to counter digital and physical spoofs.",
            "B: Touch ID requires a device passcode or user password for every unlock operation, without exceptions.",
            "C: Magic Keyboard with Touch ID can store biometric templates and perform biometric matching.",
            "D: During Touch ID enrolment, the subdermal ridge flow angle mapping is a lossy process that discards data required to reconstruct the user's fingerprint."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Biometrics"
    },
    {
        "id": "49dd189c-3990-429d-9896-5344d150a4da",
        "source": "cwe",
        "question": "Your team is tasked with developing a new authentication service. To ensure the security of the authentication process, you must choose an appropriate cryptographic algorithm. What would be an appropriate justification for deliberately choosing a slightly less secure algorithm over the most secure option available?",
        "choices": [
            "A: The less secure algorithm has a well-documented history of vulnerabilities, making it easier for the development team to anticipate potential attacks.",
            "B: The most secure algorithm requires computational resources that would significantly degrade the performance for the majority of users.",
            "C: The less secure algorithm is newer and less tested, potentially providing security through obscurity as attackers are less familiar with it.",
            "D: The most secure algorithm is not compliant with the company's outdated hardware, which cannot be updated due to budget constraints."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityJustification"
    },
    {
        "id": "a7100690-05be-4c64-bfa7-47701033cbdd",
        "source": "cs161_textbook",
        "question": "Your organization is developing a new authentication system. To ensure both security and user convenience, you are tasked with choosing features that align with the principle of considering human factors. Which of the following features should you consider implementing? (Choose two.)",
        "choices": [
            "A: Implementing a complex password policy requiring a mixture of uppercase, lowercase, special characters, and numbers, and changing passwords every 30 days.",
            "B: Designing a graphical password system where users can authenticate by recognizing and tapping on images in a sequence they have chosen.",
            "C: Forcing an immediate system restart when critical security updates are available, regardless of the user's current activity.",
            "D: Using biometric authentication methods such as fingerprint or facial recognition to simplify the login process."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "User-Friendly Security"
    },
    {
        "id": "1894a9e1-0e1b-48ae-bd86-9aaa358d144b",
        "source": "android_sec_doc",
        "question": "A mobile application development company is working on an app that requires extensive logging of system interactions for debugging purposes. Considering the security model of Android, which SELinux mode should the developers initially configure to maximize logging capabilities while developing the app, and why might they choose to switch modes before releasing the app?",
        "choices": [
            "A: Initially configure SELinux in permissive mode to log permission denials without enforcing them, then switch to enforcing mode before app release to prevent disallowed actions.",
            "B: Initially configure SELinux in enforcing mode to prevent and log disallowed actions, then switch to permissive mode before app release to log permission denials.",
            "C: Keep SELinux in per-domain permissive mode throughout development and release to incrementally apply SELinux to the app.",
            "D: Disable SELinux during development for unrestricted logging, and enable it in enforcing mode before app release."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SELinux modes"
    },
    {
        "id": "a7da98cd-41c9-4808-b345-e7231f58a678",
        "source": "apple_platform_security",
        "question": "In managing FileVault on macOS, an organization is considering the use of SecureToken and Bootstrap Token. What are the advantages of using SecureToken for this purpose?",
        "choices": [
            "A: SecureToken allows for immediate FileVault enablement without the need for user login.",
            "B: SecureToken provides a wrapped version of the key-encryption key, enhancing the protection of the encryption keys.",
            "C: Bootstrap Token can be used to automatically grant a secure token to non-administrator users.",
            "D: SecureToken enables the storage of personal recovery keys with a mobile device management solution for escrow."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecureToken"
    },
    {
        "id": "f02000dc-9e64-4054-92f7-2ab46f47ad02",
        "source": "owasp_wstg",
        "question": "As a security analyst, you are tasked with testing the access control of a web application. You decide to use a tool that can help automate the process of identifying and documenting roles used by the application, as well as testing for role-switching vulnerabilities. Which of the following tools would not be suitable for this purpose?",
        "choices": [
            "A: A network packet analyzer designed for monitoring network traffic and identifying protocol use.",
            "B: Burp's Autorize extension that automates the detection of authorization vulnerabilities.",
            "C: ZAP's Access Control Testing add-on that assists in testing user roles and access levels.",
            "D: A static code analysis tool that scans source code for potential security vulnerabilities."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest",
            "ApplicationSecurity"
        ],
        "keyword": "Access Control Testing Tool"
    },
    {
        "id": "6e1bbc2c-aff6-4734-9453-1c02e0c968de",
        "source": "cwe",
        "question": "In the context of defending against path traversal attacks, a developer must choose a method to sanitize input paths. Which of the following methods would be the least effective in preventing an attack using the '.../...//' sequence and why?",
        "choices": [
            "A: Sequentially removing '../' occurrences from the input path",
            "B: Implementing a whitelist of allowed file paths",
            "C: Using a regular expression that blocks all sequences containing slashes",
            "D: Applying canonicalization to resolve the path before access control checks"
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Sanitization"
    },
    {
        "id": "2478b34b-d109-4022-802f-637166763080",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately describe the conditions under which Apple devices employ MAC address randomization? Select all that apply.",
        "choices": [
            "A: Apple devices use a randomised MAC address during Wi-Fi scans when the device is not associated with any Wi-Fi network.",
            "B: MAC address randomisation occurs every time a device connects to a mobile network to prevent persistent tracking by network operators.",
            "C: When an Apple device conducts ePNO scans while not associated with a Wi-Fi network, it uses a randomised MAC address.",
            "D: Devices use a unique (random) MAC address per Wi-Fi network only when connected to hidden networks."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "PrivacyEnhancements"
    },
    {
        "id": "3ebadf2f-21dc-4c3c-819f-f5792beade74",
        "source": "mozilla_security",
        "question": "A web application security engineer is reviewing the framing policies to enhance the site’s defense against clickjacking attacks. Which Content Security Policy (CSP) directive should the engineer use to prevent the site from being iframed by any other site, and what would be an appropriate alternative to the deprecated directive that allowed iframing from a specific URI?",
        "choices": [
            "A: Use 'DENY' to prevent any site from iframing, and replace the deprecated 'ALLOW-FROM' directive with 'frame-ancestors'.",
            "B: Use 'SAMEORIGIN' to prevent any site from iframing, and keep using 'ALLOW-FROM' as there is no replacement.",
            "C: Use 'ALLOW-FROM' to prevent any site from iframing, and replace it with 'default-src' for specific URIs.",
            "D: Use 'SAMEORIGIN' to allow any site to iframe, and replace 'ALLOW-FROM' with 'frame-options'."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Content Security Policy (CSP)"
    },
    {
        "id": "82179ac5-e4cf-4e2e-acb8-266243f3472f",
        "source": "android_sec_doc",
        "question": "What are the possible advantages and disadvantages of implementing rollback resistance in secure hardware for key management?",
        "choices": [
            "A: Advantage: Keys cannot be restored once deleted. Disadvantage: Limited storage for key metadata.",
            "B: Advantage: Unlimited storage for key metadata. Disadvantage: Keys can be restored once deleted.",
            "C: Advantage: Easy restoration of keys. Disadvantage: Metadata is stored in non-trusted locations.",
            "D: Advantage: Rollback resistance is optional. Disadvantage: Secure hardware guarantees deleted keys can be used again."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Rollback Resistance"
    },
    {
        "id": "634bc607-ad2b-435f-8a8a-04b0c9ddbfaa",
        "source": "windows_security",
        "question": "As an IT professional, you are configuring the security policies for a company's Windows-based workstations. To enhance the security of the interactive logon process, you decide to adjust a security policy setting. Which of the following settings should you configure to prevent the display of the last signed-in user name on the sign-in screen?",
        "choices": [
            "A: Enable 'Interactive logon: Display user information when the session is locked'",
            "B: Disable 'Interactive logon: Do not display last user name'",
            "C: Enable 'Interactive logon: Do not require CTRL+ALT+DEL'",
            "D: Enable 'Interactive logon: Machine account lockout threshold'"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Interactive logon"
    },
    {
        "id": "b0637e01-a122-4109-b1a2-0f438b2d387a",
        "source": "owasp_wstg",
        "question": "As a security tester, you are trying to determine if a web application is revealing information about user existence. You send these two separate requests to the server:\n\n1. A valid username with the wrong password.\n2. An invalid username with the wrong password.\n\nFor the first request, the server responds with 'The password is not correct,' while for the second request, it responds with 'User not recognized.' How does this server behavior aid in user enumeration?",
        "choices": [
            "A: It indicates that the server is properly configured to prevent user enumeration by providing generic error messages.",
            "B: It demonstrates that the server is vulnerable to user enumeration as it confirms the existence of a user when a valid username is provided.",
            "C: It suggests that the server is vulnerable because it gives a more detailed error message for invalid usernames.",
            "D: It reveals that the server only has a single error message for any type of authentication failure, thus preventing user enumeration."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "User Enumeration"
    },
    {
        "id": "27e97a82-da69-4636-a0cc-319ba5bbd065",
        "source": "owasp_wstg",
        "question": "While conducting a penetration test, you attempt to exploit a potential SQL injection vulnerability by adding a parameter called 'user_id' with a value of ' OR '1'='1. However, the application processes the request without any errors or blockage. Given this outcome, which security component is most likely not properly configured or absent?",
        "choices": [
            "A: Content Delivery Network (CDN)",
            "B: Network Firewall",
            "C: Web Application Firewall (WAF)",
            "D: Load Balancer"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Web Application Firewall (WAF)"
    },
    {
        "id": "ec0cee0a-a7c5-45e4-9243-fb685d39650f",
        "source": "d3fend",
        "question": "An organization is looking to enhance the security of its network by applying hardening measures to its user authentication system. They aim to minimize the risk of credential theft and unauthorized access. Which TWO of the following hardening techniques would be most appropriate for this objective?",
        "choices": [
            "A: Application Configuration Hardening",
            "B: Domain Trust Policy",
            "C: Disk Encryption",
            "D: Multi-factor Authentication"
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Credential Hardening"
    },
    {
        "id": "cf91cf25-e09a-4199-ae2a-94ee881d808c",
        "source": "cs161_textbook",
        "question": "Imagine you are tasked with assessing the threat model for a new online retail company. Considering the common assumptions about attackers that apply to the company's threat model, which of the following scenarios should the company be prepared to defend against? (Select all that apply)",
        "choices": [
            "A: The company's customer database may be targeted by attackers seeking sensitive information for identity theft.",
            "B: The attackers may only attempt to exploit known software vulnerabilities during business hours to avoid detection.",
            "C: Attackers could possibly use social engineering to gain access to internal systems by impersonating staff members.",
            "D: The company's physical security measures, such as CCTV cameras, may be ignored by attackers since they are not part of the network."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "ThreatModeling"
    },
    {
        "id": "dec16e1c-37da-4969-a95e-ddfbc8adfd5f",
        "source": "owasp_mastg",
        "question": "A mobile security auditor is evaluating an iOS application's compliance with best practices for user privacy. They claim that unlike earlier versions of Android, iOS has always utilized runtime permissions, asking users to grant permissions as the app attempts to use a sensitive API for the first time. Is this statement accurate, and why might an auditor need to understand this system when assessing an application?",
        "choices": [
            "A: True, understanding this permissions system allows the auditor to verify that the application properly requests permissions at runtime, which is crucial for user privacy and security.",
            "B: False, iOS applications have pre-assigned permissions and do not request permissions at runtime, thus making the auditor's understanding irrelevant.",
            "C: True, but only because iOS applications request all permissions upfront at installation, making runtime permissions irrelevant.",
            "D: False, although iOS uses runtime permissions, the auditor's understanding is only relevant for assessing permissions on Android devices."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "iOS Permissions Model"
    },
    {
        "id": "9edb507b-f605-4fec-9fae-3c14d179e6e3",
        "source": "owasp_wstg",
        "question": "During a web application security assessment, you notice that the application owner has made efforts to obscure framework identifiers, such as changing cookie names and removing known headers. What would be a more effective security practice to recommend to the application owner instead of relying on 'security through obscurity'?",
        "choices": [
            "A: Advise the application owner to continue modifying cookie names and headers regularly to keep attackers guessing.",
            "B: Recommend the application owner to focus on increasing stakeholder awareness and maintaining solutions as a proactive security measure.",
            "C: Suggest the application owner to encrypt all HTML source code to prevent the detection of framework-specific keywords.",
            "D: Propose that the application owner should disable cookies altogether to eliminate any chance of framework identification."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Security Through Obscurity"
    },
    {
        "id": "18ddcf5b-5395-4e1f-9fc1-53462f2cf059",
        "source": "cs161_textbook",
        "question": "Why is it not recommended for Bob to send his private key to Alice to facilitate encrypted communication?",
        "choices": [
            "A: Because if Bob sends his private key, anyone intercepting it could decrypt all messages intended for Bob, compromising the security of their communication.",
            "B: Since Alice does not need Bob's private key to encrypt messages, sending it only increases the risk of exposure without any benefit to the encryption process.",
            "C: Bob's private key is designed to encrypt messages, not decrypt them, so sending it to Alice would not help in secure communication.",
            "D: Sending the private key is unnecessary because Alice can use her own private key to encrypt the messages, ensuring that only she can decrypt them with her public key."
        ],
        "answer": "AB",
        "topics": [
            "Cryptography"
        ],
        "keyword": "Private-Key"
    },
    {
        "id": "2db7859f-0d8f-4af9-b876-58b4a0c6b66c",
        "source": "mit6.858",
        "question": "You are tasked with improving the security of a financial web application to guard against CSRF attacks. Which measures should you implement to mitigate this risk?",
        "choices": [
            "A: Generate a unique anti-CSRF token for each session and require it in every state-changing request.",
            "B: Implement strict transport security to ensure all communication is done over HTTPS.",
            "C: Utilize same-site cookies to ensure that cookies are only sent with requests initiated from the same domain.",
            "D: Require basic authentication for every request, even if the user has a valid session cookie."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "d6500e3f-f7e6-4c35-a7c5-0344f012a982",
        "source": "apple_platform_security",
        "question": "Imagine you are setting up your state ID on your iPhone for use with Apple Wallet. Which of the following steps and security features are involved in the process?",
        "choices": [
            "A: The state issuing authority receives a single-digit value based on the user’s device use patterns to help prevent fraud.",
            "B: The ID in Apple Wallet is bound to the device by storing the private key for ID authentication in the device’s Secure Element.",
            "C: To use the ID in Apple Wallet on Apple Watch, users must authenticate with Face ID or Touch ID each time before presenting it to the reader.",
            "D: Device retrieval is a process in which server calls are made during presentation, allowing Apple and the issuer to track users."
        ],
        "answer": "AB",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Apple Wallet"
    },
    {
        "id": "9e26512c-1a5c-4974-9a7c-8fa2aa5d2e27",
        "source": "cwe",
        "question": "A system is being designed to allow a large number of users to perform searches that maintain user anonymity. Which of the following design choices would help prevent the exposure of sensitive information through data queries? Select all that apply.",
        "choices": [
            "A: Implementing query restrictions to prevent the use of search terms known to be unique to specific users.",
            "B: Logging all user queries to monitor for potential privacy breaches.",
            "C: Allowing unlimited data queries without scrubbing any identifying information to maintain full data transparency.",
            "D: Using differential privacy techniques to add random noise to query results, reducing the chance of identifying individual users."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "DataExposure"
    },
    {
        "id": "d2d7845a-52c4-4281-b62f-3701d422fe37",
        "source": "cwe",
        "question": "In the context of password system security, which of the following options would likely increase the risk of password compromise?",
        "choices": [
            "A: Storing encrypted passwords in a non-reversible state.",
            "B: Implementing password aging to require periodic password changes.",
            "C: Using passwords as the sole method of authentication without additional factors.",
            "D: Encouraging users to create passwords with a mix of upper and lower case letters, numbers, and symbols."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "PasswordCompromise"
    },
    {
        "id": "f19c34e2-39b7-4745-839c-f4a075c2fff9",
        "source": "apple_platform_security",
        "question": "Imagine you are designing a Secure Enclave similar to Apple's, and you are concerned about the potential security risks if the device's electronics are operated outside their safe voltage and frequency envelope. Which of the following features would you incorporate to mitigate these risks, based on Apple's Secure Enclave design?",
        "choices": [
            "A: A monitoring circuit with a larger operating envelope than the rest of the Secure Enclave to detect illegal operating points and halt Secure Enclave clocks.",
            "B: An external voltage regulator that adjusts the power supply to the Secure Enclave according to the device's overall power consumption.",
            "C: A software-based watchdog timer that restarts the Secure Enclave if the operating envelope is exceeded.",
            "D: A built-in battery backup to maintain the Secure Enclave's operation even when the device's power fluctuates beyond acceptable levels."
        ],
        "answer": "A",
        "topics": [],
        "keyword": "Monitoring Circuits"
    },
    {
        "id": "c21415ad-2e42-4c12-af70-34b59caec2f1",
        "source": "cwe",
        "question": "A developer suggests that checking for '../' at the beginning of a user-supplied file path is sufficient for preventing path traversal attacks. Analyze the scenario and select the reason(s) why this practice is insufficient:",
        "choices": [
            "A: Attackers can bypass the check by placing '../' sequences after the first few characters of the input.",
            "B: The check only removes the '../' sequence once, an attacker could include it multiple times to traverse to restricted directories.",
            "C: This method does not account for alternative path traversal sequences such as './' and '//', which can also be used in attacks.",
            "D: Removing '../' sequences may inadvertently alter legitimate user inputs that contain these characters as part of valid file or directory names."
        ],
        "answer": "AB",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "InsufficientValidation"
    },
    {
        "id": "e3229078-fe30-4387-bcd7-a69950a75b89",
        "source": "owasp_mastg",
        "question": "In Android application development, intents are used for various purposes including starting activities, services, and delivering broadcasts. When should a developer use an explicit intent over an implicit intent?",
        "choices": [
            "A: When the action to be performed is not specific to any component and the system should decide the most appropriate component to handle it.",
            "B: When the developer wants to initiate an action without specifying the data upon which to perform the action.",
            "C: When the developer wants to start a specific component by providing the fully qualified class name.",
            "D: When broadcasting a message to any app that can receive it, without targeting any specific app or component."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Explicit Intent"
    },
    {
        "id": "71cc1590-800e-4781-af56-4688fdbfac4b",
        "source": "apple_platform_security",
        "question": "Which of the following statements are NOT true regarding the secure boot process and system security for Apple devices?",
        "choices": [
            "A: Apple's secure boot process is initiated by the Boot ROM, which is immutable code executed by the Application Processor.",
            "B: The kernel CPRNG is exclusively seeded from the Secure Enclave hardware TRNG and does not utilize other entropy sources.",
            "C: The Secure Enclave performs its own secure boot to ensure it only boots Apple-signed sepOS software.",
            "D: Apple's update system is designed to prevent downgrade attacks and does not allow devices to revert to older operating system versions."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SecureBoot"
    },
    {
        "id": "f4c068d6-2a7f-4cb0-9f1b-2fc78f9b06a3",
        "source": "apple_platform_security",
        "question": "You are explaining to a colleague how the Express Cards with power reserve feature works on an iPhone when the battery is low. Which of the following statements would be accurate to include in your explanation?",
        "choices": [
            "A: When iOS is not in use due to low battery, Express Card transactions cannot be performed until the phone is charged.",
            "B: Transactions made with Express Cards during low battery will be confirmed with a haptic notification instead of a visible one.",
            "C: The NFC controller is disabled when the iPhone's battery is low, hence Express Card transactions are not possible.",
            "D: A visual notification is shown for Express Card transactions even when the iPhone is operating in power reserve mode."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Power Reserve"
    },
    {
        "id": "49961fc8-670e-4a0d-8ad8-ced35f5959a4",
        "source": "apple_platform_security",
        "question": "A company is issuing Apple devices to its employees and wishes to maximize data security, especially in the event of device theft or loss. As a security consultant, you are to recommend features based on their capabilities. Which of the following statements accurately describe the security benefits of the features implemented in Apple devices?",
        "choices": [
            "A: The Data Protection feature in iOS and iPadOS devices ensures that user data remains secure even in scenarios where the system security infrastructure is compromised.",
            "B: The Secure Enclave enforces escalating time delays after incorrect passcode entries, preventing immediate retry attempts and thereby discouraging brute-force attacks.",
            "C: FileVault volume encryption on Intel-based Macs utilizes the Secure Enclave to protect encryption keys from being exposed to the kernel operating system or CPU.",
            "D: An alphanumeric passcode in iOS and iPadOS not only serves as a security measure for device unlocking but also provides additional entropy for the encryption keys."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "AppleDeviceSecurity"
    },
    {
        "id": "0f47b809-fce4-441c-8779-7325656ce921",
        "source": "owasp_wstg",
        "question": "A web application is reviewing its password policy to ensure security against brute force attacks. Which of the following measures should the application implement to strengthen its password policy?",
        "choices": [
            "A: Enforce a password history where the user cannot reuse their last 8 passwords.",
            "B: Allow users to change their password to any of their last 5 passwords for convenience.",
            "C: Implement a mandatory regular password expiry every 30 days.",
            "D: Prevent the use of common passwords such as 'Password1' or '123456'."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Password Policy"
    },
    {
        "id": "5115f625-ebf5-41ac-ac17-a2eba96a2fba",
        "source": "cwe",
        "question": "A web application uses user input to construct file paths for accessing documents within a secure directory named 'securedocs'. The application has mechanisms in place to prevent direct access to this directory. However, a user discovered that inputting 'tempdocs/../securedocs/confidential.pdf' into the document retrieval feature results in unauthorized access to the file. Which of the following statements best describes the vulnerability that has been exploited?",
        "choices": [
            "A: The application fails to sanitize user input, allowing directory traversal via path manipulation.",
            "B: The application's encryption of 'securedocs' is compromised, allowing decryption of confidential.pdf without authorization.",
            "C: The application incorrectly implements file permissions, allowing any user to access files in 'securedocs'.",
            "D: The application has an open port that is being exploited to bypass the access restrictions to 'securedocs'."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "PathEquivalence"
    },
    {
        "id": "9f3f4603-1a46-40f7-b6fd-4e287ccb7e94",
        "source": "apple_platform_security",
        "question": "An Intel-based Mac with an Apple T2 Security Chip has several security features that are crucial during the boot process. Which of the following statements are correct regarding the boot process and security features of such Mac computers?",
        "choices": [
            "A: The Apple T2 Security Chip performs a secure boot from its Boot ROM, which verifies the iBoot bootloader as the first step in the chain of trust.",
            "B: The T2 chip checks the Intel UEFI firmware, which is made available to the Intel CPU through the Direct Memory Access (DMA).",
            "C: Boot.efi verifies the signature of the immutablekernel file, which includes the complete set of Apple kernel extensions required to boot macOS.",
            "D: If secure boot encounters any errors or failures, the Mac will automatically correct the issue and continue the boot process normally."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecureBoot"
    },
    {
        "id": "0a495d10-f1a7-4b89-bc46-0141fbbcc001",
        "source": "owasp_wstg",
        "question": "You are tasked with performing a security audit on a web application. You need to intercept and modify HTTP/HTTPS traffic to test how the application responds to modified input values. Which of the following tools would be most appropriate for this task?",
        "choices": [
            "A: Ffuf",
            "B: ZAP",
            "C: John the Ripper",
            "D: Gobuster"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Intercepting Proxy"
    },
    {
        "id": "e490e3b0-9276-41df-b24e-a952759bd490",
        "source": "owasp_mastg",
        "question": "An application security specialist argues that traditional checks for the presence of x86 / x64 architecture in mobile applications are no longer sufficient due to the widespread availability of Apple Silicon (ARM) hardware. What would be a strong counterargument supporting the need for enhanced emulator detection strategies?",
        "choices": [
            "A: Apple Silicon hardware is incapable of running emulators, thus making traditional checks obsolete.",
            "B: Emulators running on Apple Silicon could mimic ARM architecture, thus bypassing traditional architecture checks.",
            "C: Traditional checks are sufficient because all emulators are detectable through their lack of support for GPU hardware emulation.",
            "D: The presence of x86 / x64 architecture is a foolproof method of emulator detection and requires no further analysis."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Emulator Detection"
    },
    {
        "id": "92432759-dd16-4472-aee5-04d2a5b8f055",
        "source": "windows_security",
        "question": "Which of the following is NOT a correct description of the authentication steps involved in the Microsoft Entra hybrid join using a key?",
        "choices": [
            "A: The Kerberos provider queries the domain joined workstation to get domain hints and locate a domain controller.",
            "B: Cloud AP decrypts the session key using the user's private transport key and then re-encrypts it with the device's TPM.",
            "C: The KDC returns a TGT to the client after validating the signed preauthentication data using the public key retrieved from a self-signed certificate.",
            "D: Lsass informs Winlogon of the successful authentication, which subsequently initiates a remote desktop session and loads the user's credentials."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Kerberos authentication"
    },
    {
        "id": "08c56d00-6a94-4f03-8cca-c1bbe2e2f7c2",
        "source": "owasp_wstg",
        "question": "A web application for a rewards program allows users to accumulate points with each purchase. The program is designed to credit points after a purchase is finalized. During a security assessment, you notice that users can add items to their cart, earn points, and then remove the items, but the points remain in their account. What type of vulnerability does this scenario represent?",
        "choices": [
            "A: Session management vulnerability",
            "B: Workflow circumvention vulnerability",
            "C: Input validation vulnerability",
            "D: Cross-site scripting vulnerability"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Workflow Circumvention Vulnerability"
    },
    {
        "id": "c1d44646-e98f-4a61-98a7-e22f41f62979",
        "source": "cs161_textbook",
        "question": "Consider a scenario where a company is designing a new network infrastructure. They are evaluating the default behaviors of various components in the case of system failure. Which of the following components' default behaviors align with the principle of 'fail-safe defaults'?",
        "choices": [
            "A: A router that halts all packet forwarding if its routing table becomes corrupted.",
            "B: An authentication server that grants access to all users if it cannot retrieve user credentials from the database.",
            "C: An intrusion detection system that disables all alarms if it experiences an internal error.",
            "D: A file server that restricts access to all files if it encounters a file system error."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "fail-safe"
    },
    {
        "id": "b52b9838-7905-4f29-9328-8756fbc1fea0",
        "source": "owasp_wstg",
        "question": "You are performing a security audit on a web application and have been tasked with identifying the underlying web application framework. Which tool and technique would you employ to accurately fingerprint the components used by the web applications, and why would this choice be effective?",
        "choices": [
            "A: Use Wappalyzer with its regular expression matching capability because it operates at the browser level and provides immediate results upon loading a page.",
            "B: Utilize WhatWeb for its use of Google Hack Database queries, as it is known for quickly identifying frameworks with a limited set of keywords.",
            "C: Implement a custom script that utilizes MD5 hashes for fingerprinting because MD5 is a widely recognized and easy-to-use hashing algorithm.",
            "D: Employ manual enumeration of directory structures, as this method is less likely to produce false positives compared to automated tools."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Web Application Framework Fingerprinting"
    },
    {
        "id": "2a0735c8-ed26-45d1-bff4-32a60f23f3b3",
        "source": "cwe",
        "question": "As a developer in charge of improving the security of an application, you are reviewing methods to store passwords securely. Which of the following methods would you consider as secure practices for password storage? (Choose all that apply)",
        "choices": [
            "A: Encrypting the passwords using a modern algorithm like AES with keys that are at least 128 bits in length.",
            "B: Encoding the passwords using base 64 encoding and storing them in a configuration file.",
            "C: Hashing the passwords with a secure hash function like SHA-256 and storing the hashes.",
            "D: Storing the passwords in plaintext in a database table with restricted access."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PasswordStorage"
    },
    {
        "id": "c958caab-3590-452c-b3cd-f66eb95d4070",
        "source": "attck",
        "question": "In the aftermath of a security breach, a pen tester finds that the Windows Registry has been manipulated to establish persistence by modifying the 'BootExecute' Registry key and adding a ransom note in the 'System' policies. Additionally, there are signs of encrypted configuration files in the Registry. Which combination of malware is most likely associated with these specific actions?",
        "choices": [
            "A: LoJax, Pysa, and PolyglotDuke",
            "B: GreyEnergy, Mosquito, and Regin",
            "C: HermeticWiper, Metamorfo, and PHOREAL",
            "D: Patchwork, Pillowmint, and QuasarRAT"
        ],
        "answer": "AA",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Malware Persistence"
    },
    {
        "id": "c8f3172c-d0b9-4ba4-a4d4-a9ed26e8a8cb",
        "source": "android_sec_doc",
        "question": "You are developing an Android application that needs to comply with accessibility standards for both hardware and software buttons. You have set up a magnified view accessibility feature. For the confirmation string using hardware buttons, you are using a font size of 18sp, while for the software buttons, you are using a font size of 20sp. In both cases, the Roboto-Medium font face is used. In light of Android accessibility requirements, which of the following statements is true?",
        "choices": [
            "A: The confirmation string font size should be the same for both hardware and software buttons.",
            "B: Using a different font size for hardware and software buttons is acceptable as long as they meet the minimum required font size.",
            "C: The font size for hardware buttons should be smaller than for software buttons due to screen size constraints.",
            "D: The font size for the software buttons' confirmation string should be adjusted to 18sp to match that of the hardware buttons."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Accessibility Standards"
    },
    {
        "id": "b32cbb6f-2f5a-4ed4-8a77-bde2d9cbacc8",
        "source": "windows_security",
        "question": "A company uses Windows Hello for Business for their authentication needs. An employee has forgotten their PIN and needs to recover it to regain access to their device. Which of the following services and features should the IT department utilize to assist the employee in resetting their PIN?",
        "choices": [
            "A: Microsoft PIN reset service",
            "B: Azure Active Directory password reset",
            "C: Microsoft Account Recovery Tool",
            "D: Windows Credential Manager"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Microsoft PIN reset service"
    },
    {
        "id": "7563aca4-3bb7-4482-8d90-4c40aa419a05",
        "source": "cwe",
        "question": "Analyze the following code snippets and select the ones that are vulnerable due to improper input validation, potentially allowing for unauthorized actions or data access:",
        "choices": [
            "A: A function that sanitizes user inputs by escaping special characters before including them in database queries.",
            "B: An API endpoint that strictly validates JSON structure but does not check the size of the input, potentially leading to buffer overflow.",
            "C: A login form that validates the email format using a regular expression but does not check for the presence of SQL injection patterns.",
            "D: A user profile update function that relies on client-side validation to ensure that the uploaded images are of acceptable file types."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CodeVulnerability"
    },
    {
        "id": "b3384cb2-d3a9-49f8-bf6f-97b4b37d117d",
        "source": "apple_platform_security",
        "question": "As the security manager of a hotel chain looking to implement digital room keys using Apple Wallet, you are evaluating how this technology could improve guest experience and security. Which of the following capabilities can you leverage for your hotel's digital key implementation?",
        "choices": [
            "A: Enabling guests to unlock their hotel room door even if their iPhone runs out of battery.",
            "B: Providing auto-archiving of expired keys to prevent clutter and security risks.",
            "C: Allowing guests to check in and receive their digital key through an SMS link without the need for a dedicated app.",
            "D: Implementing a system that requires guests to manually enter a confidential single-use pairing password for each stay."
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "DigitalKeys"
    },
    {
        "id": "00ff497a-2819-4a2d-bfb7-70d2672f5676",
        "source": "cwe",
        "question": "An administrator is setting up a new service that comes with default configuration options. Which of the following choices reflects the best practice for default configurations to enhance security?",
        "choices": [
            "A: Set all configuration options to the most permissive settings to ensure ease of use and modify them later based on security needs.",
            "B: Choose secure default settings even if it makes initial setup less convenient, requiring deliberate changes by the administrator for functionality.",
            "C: Leave default settings as undefined, forcing the administrator to set them before the service can be used.",
            "D: Configure the service with a complex default password and assume that it provides sufficient security without further changes."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SecureDefaults"
    },
    {
        "id": "1febcf33-fff7-4ca0-80a7-5fd9e4520cf2",
        "source": "attck",
        "question": "In response to a series of security incidents involving lateral tool transfers within their network, an organization is evaluating different mitigation strategies. Which of the following would be the most effective approach to reduce the risk of such transfers?",
        "choices": [
            "A: Implement strict host firewall rules to restrict file sharing communications such as SMB.",
            "B: Increase the complexity of network passwords to prevent unauthorized access.",
            "C: Switch to a different operating system platform across the organization.",
            "D: Regularly change network topology to confuse potential adversaries."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Mitigation Strategy"
    },
    {
        "id": "fa1c8885-eca2-4ca6-89d3-2069d469ce64",
        "source": "cs161_textbook",
        "question": "Why would simply blacklisting IP addresses not be an effective strategy to mitigate a DoS attack where the attacker is using IP spoofing? (Select two.)",
        "choices": [
            "A: IP spoofing allows the attacker to generate a unique source IP address for every packet, making blacklisting impractical.",
            "B: Blacklisting legitimate IP addresses may result in denying service to genuine users and exacerbate the DoS situation.",
            "C: The attacker is likely to run out of spoofed IP addresses, making blacklisting eventually effective.",
            "D: Most DoS attacks do not use IP addresses at all, so blacklisting would not impact the attack."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IP Spoofing"
    },
    {
        "id": "8262f609-a420-4ef7-a1c5-4c7a2af50dfe",
        "source": "owasp_mastg",
        "question": "When designing a secure communication strategy for a mobile application, why would a security engineer prefer using TLS v1.2 or v1.3 over TLS v1.0 and v1.1?",
        "choices": [
            "A: TLS v1.2 and v1.3 provide faster communication speeds, making them suitable for high-traffic applications.",
            "B: TLS v1.0 and v1.1 have known vulnerabilities and their usage is deprecated, making TLS v1.2 and v1.3 more secure options.",
            "C: TLS v1.2 and v1.3 are the only versions that support all block ciphers and integrity check algorithms.",
            "D: TLS v1.0 and v1.1 are not supported by any mobile operating systems, rendering them obsolete."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "TLS vulnerabilities"
    },
    {
        "id": "7cd15737-e796-4b88-a135-0df077dcc768",
        "source": "attck",
        "question": "As a security analyst, you are reviewing logs from a compromised system and observe indicators suggesting that additional payloads were downloaded and executed without direct user interaction. Based on your knowledge of known malware signatures, which of the following malware is most likely responsible for this behavior?",
        "choices": [
            "A: Bundlore",
            "B: CARROTBALL",
            "C: ChChes",
            "D: SombRAT"
        ],
        "answer": "ABC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Malware Payload Execution"
    },
    {
        "id": "721806ff-f950-4ef4-887e-f951d775218b",
        "source": "cwe",
        "question": "Which of the following design choices would mitigate the risk of 'Improper Authorization' in a web application?",
        "choices": [
            "A: Implementing a default deny policy in access control lists during system configuration and installation.",
            "B: Using a single database user account to control access to medical records, irrespective of individual patient or doctor associations.",
            "C: Ensuring that all web pages with sensitive information restrict access to requests with an authenticated session token.",
            "D: Caching all web pages to improve performance, including those that contain sensitive information."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "93dc670a-9816-4c4a-a8b9-1d2e77b88550",
        "source": "cwe",
        "question": "Consider the following code snippet designed to process uploaded files:\n\njava\nif (uploadedFile.getExtension().equals(\".jpg\") && ImageUtil.isImage(uploadedFile)) {\n  processImage(uploadedFile);\n} else {\n  rejectFile(uploadedFile);\n}\n\n\nWhich vulnerability does this code snippet aim to prevent?",
        "choices": [
            "A: SQL Injection",
            "B: Cross-Site Scripting (XSS)",
            "C: Deployment of Wrong Handler",
            "D: Buffer Overflow"
        ],
        "answer": "C",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "WrongHandlerPrevention"
    },
    {
        "id": "b21a1325-1267-453a-9f48-fc13415d9e8a",
        "source": "cwe",
        "question": "In the context of a hardware design vulnerability involving fuse memory, where keys and configuration data are stored, analyze the scenario where the JTAG_OFFSET is incorrectly defined. Determine the potential consequences of this misconfiguration.",
        "choices": [
            "A: Programs will access the correct keys, ensuring the peripherals' functionality and security.",
            "B: Programs cannot access the correct keys, potentially breaking peripheral functionality and exposing sensitive information.",
            "C: Incorrect offset will have no impact since keys are stored securely in the fuse memory.",
            "D: Incorrect offset will enhance system security by obfuscating the keys' actual location."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Misconfiguration"
    },
    {
        "id": "c4c1fc5c-66b7-4b4e-a6bf-fa8f8fed02db",
        "source": "cwe",
        "question": "In reviewing the source code of a new IoT device's firmware, you come across the following authentication function. Select the implementation(s) that would NOT contribute to the use of weak credentials.",
        "choices": [
            "A: The function uses a hard-coded administrator password that is the same for all devices.",
            "B: The function retrieves a password from secure, encrypted storage that is unique to each device.",
            "C: The function generates a default password based on the device's serial number, which can be changed by the user.",
            "D: The function allows the use of a default username 'admin' with a password that must be reset on first use."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SourceCodeAnalysis"
    },
    {
        "id": "11a36b47-d158-46dd-81c0-f72c92ca9f95",
        "source": "cwe",
        "question": "As a security analyst, you are reviewing methods to mitigate the risk of SSI injection in a web application. Which of the following strategies would effectively reduce the vulnerability to SSI injection?",
        "choices": [
            "A: Implement strict input validation to ensure that user input conforms to expected formats.",
            "B: Disable server-side includes functionality if it is not needed for the application.",
            "C: Store user input in a database without encoding or sanitization, and retrieve it for display using parameterized queries.",
            "D: Use regular expressions to remove any '#' characters from user input before processing."
        ],
        "answer": "AB",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Mitigation_Strategies"
    },
    {
        "id": "2e57a94e-1d80-4f6e-aecf-ea20a5fa816a",
        "source": "cs161_textbook",
        "question": "Consider a scenario where a software developer is implementing security measures to protect a program written in a memory-unsafe language against buffer overflow attacks. They are contemplating the use of stack canaries. Which of the following statements accurately reflect the properties and benefits of employing stack canaries in their program?",
        "choices": [
            "A: Stack canaries are useful for detecting overflows that occur due to writing to non-consecutive memory addresses.",
            "B: Stack canaries are placed on the stack to act as a sacrificial value, with their alteration signaling a possible attack before the function returns.",
            "C: Stack canaries add significant performance overhead during program execution, which may affect the decision to implement them.",
            "D: Modern compilers can automatically insert stack canary checks into C code, providing a defense against a range of common exploits with negligible performance impact."
        ],
        "answer": "BD",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "MemorySafety"
        ],
        "keyword": "StackCanaries"
    },
    {
        "id": "dd6611c1-e41b-4cfd-8862-6403d2bb7326",
        "source": "cs161_textbook",
        "question": "A company has recently implemented an anomaly-based detection system to enhance its security posture. Considering the characteristics of anomaly-based detection, which of the following situations could highlight the strengths and weaknesses of their newly implemented system?",
        "choices": [
            "A: The system successfully identifies a previously unknown attack pattern by comparing it against established models of normal behavior.",
            "B: The system frequently flags legitimate user behavior as suspicious due to slight variations in data entry, causing disruptions in normal operations.",
            "C: The system fails to detect malicious activity because the attack was included in the dataset used to define normal behavior.",
            "D: The system relies on a static database of known attack signatures to identify threats, leading to numerous false negatives."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Anomaly-based Detection"
    },
    {
        "id": "2d1281d4-a392-44b2-b188-447132460c8f",
        "source": "d3fend",
        "question": "Following a ransomware attack, a database containing sensitive client information was encrypted, and a decision was made to restore the database from the most recent backup. However, the restored database still shows signs of corruption. What is the most likely reason the 'Restore Database' technique did not lead to the desired outcome?",
        "choices": [
            "A: The database backup was taken after the ransomware infection occurred.",
            "B: The network access was not restored before attempting to restore the database.",
            "C: The user accounts were still locked, preventing access to the restored database.",
            "D: The email system was not prioritized for restoration, causing communication delays."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Restore Database"
    },
    {
        "id": "6420e23a-8d76-4119-b45f-6240074a8d6a",
        "source": "windows_security",
        "question": "A company's IT department is reviewing the security settings for a new batch of workstations that will be added to the domain. Based on the default values for the Windows security policy setting 'Perform volume maintenance tasks', which accounts would you expect to have this right assigned on these new client computers before any custom GPOs are applied?",
        "choices": [
            "A: Domain Users",
            "B: Administrators",
            "C: Authenticated Users",
            "D: Backup Operators"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Default Policy Values"
    },
    {
        "id": "e3b069a1-e754-450b-9432-5b91fd6b2a96",
        "source": "cwe",
        "question": "Consider the following scenarios where a software product interacts with external entities. Select the scenarios that demonstrate a potential 'Resource Leak' where private resources are made available to untrusted parties.",
        "choices": [
            "A: A web application includes debug information in HTTP response headers, which are accessible by any client.",
            "B: A cloud service restricts access to stored data using role-based access control, where only authorized users can retrieve data.",
            "C: An online platform's API inadvertently includes user's private note contents in the JSON response when querying public profile information.",
            "D: A video streaming service uses DRM to prevent unauthorized copying and distribution of content."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Resource Leak"
    },
    {
        "id": "c79ab447-186f-453e-bcc4-37486a93fe92",
        "source": "android_sec_doc",
        "question": "In the context of an Android device security subsystem, if an attacker attempts to brute-force a user's device password, how does the system's Gatekeeper component respond to mitigate this risk?",
        "choices": [
            "A: It temporarily locks the user out after a set number of failed attempts, requiring a device reboot.",
            "B: It increments a failure counter before verifying the user password and clears it upon successful verification.",
            "C: It encrypts the password with a new key generated for each attempt to prevent pattern recognition.",
            "D: It resets the User SID to a new value after each failed attempt, thus invalidating all keys bound to it."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Request Throttling"
    },
    {
        "id": "abb9972a-1da0-4825-88d2-c6953620a1d4",
        "source": "owasp_wstg",
        "question": "In an assessment of a web application's security, a tester is exploring different inputs to identify potential SSRF vulnerabilities. Which of the following inputs is least likely to be useful in an SSRF attack and thus could be considered a counterargument to the typical SSRF payloads?",
        "choices": [
            "A: GET https://example.com/page?page=http://192.168.0.1/config",
            "B: GET https://example.com/page?page=http://[::1]/config",
            "C: GET https://example.com/page?page=https://example.com/external",
            "D: GET https://example.com/page?page=http://203.0.113.0/config"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "SSRF Payload"
    },
    {
        "id": "9ef0f350-338a-4b20-989c-fdfec762153c",
        "source": "apple_platform_security",
        "question": "Consider a scenario where an Apple Watch is used to unlock a Mac. The user steps away, and the devices are no longer in Bluetooth range. The Apple Watch needs to continue fetching Mail from iCloud and Gmail. Which of the following statements correctly describe the security features and behavior of the Apple Watch and Mac in this situation?",
        "choices": [
            "A: Apple Watch will join Wi-Fi networks previously joined on the paired iPhone, and whose credentials have synced while within range.",
            "B: For Gmail accounts, the OAuth token is sent directly to the Apple Watch and is used for connectivity with the Gmail server from the paired iPhone.",
            "C: The Apple Watch can fetch Mail directly from iCloud and Gmail servers without relying on the paired iPhone when out of Bluetooth range.",
            "D: To access Safari saved passwords on the Mac, the user must manually enter the password on the Apple Watch when it is out of Bluetooth range."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "28fcb01a-ac32-42e1-bd73-719c89bb27ea",
        "source": "apple_platform_security",
        "question": "An iCloud user is contemplating whether to enable Advanced Data Protection and iCloud Backup for their account. Assess the implications of these decisions. Which of the following statements present valid considerations that the user should take into account?",
        "choices": [
            "A: Enabling Advanced Data Protection and turning on iCloud Backup will result in all iCloud data, including Messages in iCloud, being end-to-end encrypted.",
            "B: If the user enables iCloud Backup without Advanced Data Protection, Apple will not be able to help recover the Messages in iCloud because they are end-to-end encrypted.",
            "C: Turning off iCloud Backup will generate a new key on the user's device to protect future Messages in iCloud, which will be stored only in iCloud Keychain.",
            "D: Disabling iCloud Backup will mean that the user’s iCloud data and keychain will become inaccessible, as no backup will be available for recovery."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DataProtection"
    },
    {
        "id": "286d665f-8ab4-43cf-b3af-112ebe53f674",
        "source": "owasp_mastg",
        "question": "In the context of secure coding practices, what is a potential consequence of including the same header file multiple times in a C/C++ program, as seen in the code below?\n\n#include <sys/wait.h>\n#include <sys/wait.h>\n\nChoose the most appropriate consequence.",
        "choices": [
            "A: It increases the risk of namespace collisions and makes the program more vulnerable to certain types of attacks.",
            "B: It may cause a compilation error due to the redefinition of functions or macros.",
            "C: It could potentially lead to increased compilation time and unnecessary resource consumption.",
            "D: It significantly enhances the program's security by providing multiple layers of declaration checks."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Header File Inclusion"
    },
    {
        "id": "e212ce84-de17-44aa-9d4f-39d65d923bdb",
        "source": "windows_security",
        "question": "A company has recently experienced an insider threat that led to data exfiltration. The security team decides to implement additional auditing measures. Which of the following actions would be most effective in addressing this threat?",
        "choices": [
            "A: Enable 'Audit Process Termination' to track unexpected process shutdowns that could indicate malicious activity.",
            "B: Disable 'Audit Process Termination' to reduce the risk of attackers detecting monitoring mechanisms.",
            "C: Implement 'Audit Process Termination' only for processes that do not handle sensitive data to minimize performance impact.",
            "D: Use 'Audit Process Termination' to encrypt process memory contents upon termination to prevent data leakage."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Insider Threat"
    },
    {
        "id": "5d05de44-b97d-4a05-aae9-a91cc24fb264",
        "source": "cs161_textbook",
        "question": "Select the statements that accurately reflect the advantages and potential drawbacks of using a memory-safe language for software development:",
        "choices": [
            "A: Memory-safe languages perform automatic bounds checking to prevent buffer overflow exploits.",
            "B: Using a memory-safe language guarantees that the software will be free from all types of security vulnerabilities.",
            "C: Programmers can write code in memory-safe languages without considering memory management, reducing the risk of human error.",
            "D: The runtime checks in memory-safe languages could introduce performance penalties which may be unacceptable in certain real-time systems."
        ],
        "answer": "ACD",
        "topics": [
            "SoftwareSecurity",
            "MemorySafety"
        ],
        "keyword": "trade-offs"
    },
    {
        "id": "27d6fe77-dcd8-4f73-ac81-0e659d5e5abd",
        "source": "mit6.858",
        "question": "When using RLbox to sandbox a third-party library in an application, what are the necessary steps and considerations to ensure the security and proper integration of the sandboxed library?",
        "choices": [
            "A: Introduce tainting and validate pointers incrementally to ensure data flow across the sandbox boundary is secure.",
            "B: Allow the sandboxed library to import additional functions at runtime for flexibility.",
            "C: Utilize the null sandbox for initial testing, followed by a switch to the real sandbox for deployment.",
            "D: Enforce restrictions on callback function types at the time of registration to prevent misuse by the sandbox."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Sandboxing"
    },
    {
        "id": "684b20be-e78c-48df-ba88-1e091e94115d",
        "source": "cs161_textbook",
        "question": "In the paint analogy of Diffie-Hellman key exchange, identify the component that is NOT necessary for Alice and Bob to successfully establish a shared secret.",
        "choices": [
            "A: Alice’s and Bob’s agreement on a publicly-known common color to mix with their secret colors before exchange.",
            "B: The ability for Alice and Bob to send their mixed colors securely without Eve being able to intercept and see them.",
            "C: Alice and Bob each having their own secret color which they do not reveal to each other or to Eve.",
            "D: A method for Alice and Bob to remove the publicly-known common color from the mixed colors they receive from each other."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "Key Exchange"
    },
    {
        "id": "204e27e5-e18a-4b3f-9027-581320d7f878",
        "source": "apple_platform_security",
        "question": "An organization is preparing to deploy a fleet of iOS devices to its staff. As the cybersecurity specialist, you are tasked with ensuring the security and proper configuration of these devices using Apple's management tools. Select the actions that are applicable to securing the devices and managing their configuration profiles.",
        "choices": [
            "A: Encrypt configuration profiles using the Cryptographic Message Syntax (CMS) as specified in RFC 5652, supporting 3DES and AES128.",
            "B: Enable Managed Lost Mode to locate lost or stolen devices and remotely lock or wipe them.",
            "C: Install configuration profiles on devices by transferring them using any non-Apple approved third-party software.",
            "D: Supervise the devices to gain additional control over their configuration and restrictions."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Configuration"
    },
    {
        "id": "c7ca6385-c701-4938-9fbd-22a68f84fbc0",
        "source": "windows_security",
        "question": "Your organization requires strict adherence to security protocols for software applications. What are the advantages of using Group Policy to manage Process Mitigation Options over allowing individual users to configure their application security settings?",
        "choices": [
            "A: It ensures uniform security settings across all users, which enhances overall system security.",
            "B: It allows each user to have unique security settings, fostering innovation and customization.",
            "C: It reduces the workload on the IT department by distributing the responsibility to the users.",
            "D: It provides real-time monitoring of user activities, ensuring immediate detection of security breaches."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Protocols"
    },
    {
        "id": "9a497cd2-3e15-4e32-8ca1-196e330208ab",
        "source": "cwe",
        "question": "Imagine you are evaluating the security design of a new proprietary communication protocol for a company. The design team suggests using a unique encryption algorithm that has never been published or subjected to peer review. They argue that keeping the algorithm secret will prevent attackers from understanding and defeating the protection mechanism. Based on your knowledge of security best practices and vulnerabilities, which of the following are valid criticisms of this approach?",
        "choices": [
            "A: Relying on the secrecy of the algorithm creates a risk that, if the algorithm is reverse-engineered, the entire protection mechanism could be compromised.",
            "B: Publicly-vetted algorithms are more susceptible to being defeated by attackers because they are well-known and widely understood.",
            "C: The use of a secret algorithm ensures a high level of security because attackers cannot exploit what they do not know.",
            "D: If the protection mechanism's strength significantly depends on the secrecy of its key data or algorithms, it is vulnerable to reverse engineering and other black-box analysis techniques."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Obscurity"
    },
    {
        "id": "195a636c-37b6-43ea-a574-f0d9fc090771",
        "source": "owasp_mastg",
        "question": "A mobile application developer is implementing deep linking functionality into their iOS app to redirect users to specific content within the app. Considering security best practices, which of the following reasons justify the developer's decision to use universal links over custom URL schemes for this purpose?",
        "choices": [
            "A: Universal links can be claimed by other apps, ensuring a wider reach for deep linking.",
            "B: Universal links prevent URL scheme hijacking attacks by utilizing standard HTTP/HTTPS links.",
            "C: Custom URL schemes are more secure because they are unique to the app and cannot be replicated.",
            "D: Universal links do not require the app to be installed, redirecting to the website content in Safari."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Deep Linking"
    },
    {
        "id": "e39f13f5-a2c8-4a10-aa31-b81fc0cd0f38",
        "source": "cs161_textbook",
        "question": "In which of the following scenarios would the use of cryptographic hash functions NOT be suitable for ensuring the integrity of a downloaded file? Select all that apply.",
        "choices": [
            "A: The adversary is capable of tampering with the hash value provided by the file's creators along with the file itself.",
            "B: The file's creators have only published the hash value on their secure official website, which is known to be free from adversarial control.",
            "C: The hash function used by the file's creators is known to be fast and efficient, making it easy to compute hashes for large files.",
            "D: The adversary has a realistic amount of computing power, which is insufficient to break the properties of the cryptographic hash function in use."
        ],
        "answer": "A",
        "topics": [],
        "keyword": "HashFunctionLimitations"
    },
    {
        "id": "d82d1112-6d3b-4c30-8234-1bfb7d775e8c",
        "source": "mit6.858",
        "question": "Consider a scenario where an organization is evaluating the implementation of DNSSEC to enhance the security of its DNS infrastructure. Which of the following are potential challenges they might face, and what are the possible consequences or mitigations related to DNSSEC deployment?",
        "choices": [
            "A: DNSSEC can mitigate problems with key distribution by allowing any entity to sign for any domain, thereby simplifying the process.",
            "B: Adoption of DNSSEC may be slow due to the lack of incentives to upgrade and the non-trivial costs associated with performance and administrative overhead.",
            "C: Name enumeration is a challenge with DNSSEC, but it can be partially mitigated by using NSEC3 which adds hashing to non-existent domain names.",
            "D: DNSSEC resolves all issues related to Denial of Service (DoS) attacks by ensuring that only authenticated responses are accepted."
        ],
        "answer": "BC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DNSSEC"
    },
    {
        "id": "738b843d-fce9-45da-b397-00cc106700e9",
        "source": "attck",
        "question": "As an IT manager, you are evaluating different strategies to mitigate the risk of adversaries creating unauthorized accounts on your network. Which of the following strategies would most effectively limit an adversary's ability to create accounts without significantly disrupting legitimate administrative operations? Select two.",
        "choices": [
            "A: Enforce multi-factor authentication for all user and privileged accounts.",
            "B: Restrict all user account creation privileges to a single administrator account.",
            "C: Isolate all domain controllers in a separate network segment with strict access controls.",
            "D: Automate the creation of user accounts to reduce the need for administrative intervention."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "bd3a7afc-6848-4038-8a22-d048614ddd7b",
        "source": "attck",
        "question": "A security analyst is reviewing the mitigations for protecting against data manipulation within a corporate environment. Which of the following mitigations would be least effective in preventing adversaries from altering data to hide their activities?",
        "choices": [
            "A: Restricting file and directory permissions",
            "B: Segmenting the network",
            "C: Employing intrusion detection systems",
            "D: Storing backups off system and protecting them from unauthorized access"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Least Effective Mitigation"
    },
    {
        "id": "683b321c-12e3-454e-aa56-bb0938fa2298",
        "source": "android_sec_doc",
        "question": "In configuring an Android device that uses metadata encryption, you need to adjust the init sequence to ensure that the `/data` partition mounts correctly at startup. Which of the following modifications to the init sequence are required to prevent potential deadlocks and ensure Keymaster is ready before `/data` is mounted?",
        "choices": [
            "A: Start vold after mounting `/data` to ensure filesystems are ready for encryption.",
            "B: Place `exec_start wait_for_keymaster` before the `mount_all` invocation related to `/data` in the init sequence.",
            "C: Run the vdc tool after `vold` starts to set up the metadata-encrypted device.",
            "D: Delay the startup of Keymaster until after `/data` has been successfully mounted."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "init sequence"
    },
    {
        "id": "c1086936-423d-4085-ab11-0b5660c83ba3",
        "source": "mozilla_security",
        "question": "Which of the following statements are true regarding the use of cookies in web security?",
        "choices": [
            "A: HTTP Cookie Prefixes allow servers to assert restrictions on cookie names to mitigate certain classes of security vulnerabilities.",
            "B: Same-site Cookies are designed to improve performance by allowing cookies to be sent with cross-site requests.",
            "C: RFC 6265 strictly prohibits the use of Secure attribute in cookies to prevent secure information from being accidentally transmitted over unencrypted channels.",
            "D: Cookies with the HttpOnly flag can be accessed via JavaScript's Document.cookie API to enhance client-side scripting."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTTP Cookie Prefixes"
    },
    {
        "id": "0fa4a54e-ba7b-48a8-85bf-ec121e71cf95",
        "source": "attck",
        "question": "A security analyst is tasked with improving the detection of unauthorized access to removable media within the organization's network. Which of the following data sources and detection methods would NOT be appropriate for detecting the transfer of commands or files to air-gapped systems via removable media?",
        "choices": [
            "A: Monitoring for unexpected file access on removable media.",
            "B: Monitoring for newly executed processes when removable media is mounted.",
            "C: Monitoring network traffic for unusual outbound connections.",
            "D: Monitoring for the creation of new drives when removable media is mounted."
        ],
        "answer": "C",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Detection Techniques"
    },
    {
        "id": "ae39321a-a6f4-41c3-aa0e-941ac98bcbb2",
        "source": "apple_platform_security",
        "question": "As a security analyst, you are reviewing the secure transaction protocols for NFC and UWB digital car keys. Which statements correctly describe the security features or processes implemented in NFC and UWB standard transactions?",
        "choices": [
            "A: NFC transactions use ephemeral key pairs and Diffie-Hellman key agreement method to establish a secure channel.",
            "B: UWB transactions utilize a Bluetooth LE session and a UWB Ranging Secret Key (URSK) for device localisation.",
            "C: NFC transactions do not authenticate the reader device to ensure the privacy of the iPhone user.",
            "D: UWB transactions do not require any secure session for data transmission between the vehicle and the iPhone."
        ],
        "answer": "AB",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "SecureTransactions"
    },
    {
        "id": "c1b2f20e-f4dd-493b-9146-3a612364d2d9",
        "source": "android_sec_doc",
        "question": "In the context of biometric authentication systems, how does testing across diverse subject demographics impact the system's performance, and why is it crucial to calibrate presentation attacks accordingly?",
        "choices": [
            "A: It reveals potential performance disparities across different genders, age groups, and races/ethnicities, which is critical for ensuring the system's reliability and inclusivity.",
            "B: It allows the system to focus on a narrower set of biometric data, making it more efficient but less accurate for a global population.",
            "C: It reduces the necessity for machine learning algorithms in authentication, leading to a more deterministic and predictable system behavior.",
            "D: It guarantees that the system will perform uniformly across all demographics, eliminating the need for calibration of presentation attacks."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Machine Learning Based Authentication"
    },
    {
        "id": "543cbc91-4cd7-4c8c-b9b3-000022a600fe",
        "source": "attck",
        "question": "A penetration tester is evaluating a company's network security by simulating an adversary's actions based on the ATT&CK framework. During the simulation, the tester identifies several accounts with varying levels of privileges. Which of the following actions would NOT align with an adversary's typical behavior during account manipulation for maintaining or elevating access to victim systems?",
        "choices": [
            "A: Creating backup accounts with administrative privileges for later use.",
            "B: Granting existing user accounts excessive file permissions across the network.",
            "C: Removing administrative rights from key service accounts to reduce detection risk.",
            "D: Assigning new user accounts to privileged groups for elevated access."
        ],
        "answer": "C",
        "topics": [
            "PenTest",
            "ApplicationSecurity"
        ],
        "keyword": "Account Manipulation"
    },
    {
        "id": "d3db9a2f-5264-4a36-99e3-48e7a38a4ea6",
        "source": "owasp_wstg",
        "question": "A web application allows users to upload images for profile customization. The application's upload feature is currently configured to accept any file type, relying on the client-side extension check. As a security consultant, you are tasked with recommending a remediation strategy to prevent the upload of potentially malicious files. Which of the following strategies should be implemented to enhance the security of the file upload feature?",
        "choices": [
            "A: Implement server-side validation to ensure only image file types (.jpg, .png, .gif) are processed, and use a file type recognizer to verify the content.",
            "B: Rely solely on client-side JavaScript validation to check the file extension, as this is sufficient to prevent malicious file uploads.",
            "C: Accept all file types but sandbox the uploaded files in a secure environment where they can be executed safely without affecting the server.",
            "D: Allow the upload of .html and .php files but rename them on the server to prevent execution."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Server-side validation"
    },
    {
        "id": "52c14d5e-702e-4f04-90dc-911a30207434",
        "source": "apple_platform_security",
        "question": "Which of the following hardware-based security features implemented by Apple are designed to protect against specific types of system attacks or exploitation? Select all that apply.",
        "choices": [
            "A: Fast Permission Restrictions are designed to mitigate attacks originating from just-in-time compiled code on the web by controlling memory execute permissions.",
            "B: Kernel Integrity Protection prevents installation of unauthorized iOS updates to protect against tampering.",
            "C: Pointer Authentication Codes are used to protect against physical tampering with the device's hardware components.",
            "D: System Coprocessor Integrity Protection is implemented to prevent modification of critical system task firmware like the Secure Enclave."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Hardware-based Security Features"
    },
    {
        "id": "ff76812f-68c9-4249-a8a1-dbbaf5987dab",
        "source": "cwe",
        "question": "Which of the following code examples does NOT introduce a vulnerability regarding the exposure of private personal information?",
        "choices": [
            "A: Logging user actions including their geolocation data into an unencrypted log file.",
            "B: Using a user’s plaintext password in a URL query string for authentication purposes.",
            "C: Applying the principle of least privilege by requesting only coarse location data when high precision is unnecessary.",
            "D: Storing user's personal health records in a database without implementing proper access control."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "CodePrivacy"
    },
    {
        "id": "fbd239eb-9272-4bf7-9bd0-46ad12df3274",
        "source": "owasp_mastg",
        "question": "You are tasked with enhancing the resilience of a financial mobile application designed for the iOS platform. Which of the following measures should you prioritize to align with best security practices for this platform?",
        "choices": [
            "A: Implementing jailbreak detection mechanisms to prevent the app from running on compromised devices.",
            "B: Ensuring the app can only be installed on devices with a specific hardware configuration to limit device diversity.",
            "C: Applying obfuscation techniques to the source code to make reverse engineering more difficult.",
            "D: Requiring the app to exclusively communicate with the server using proprietary encryption algorithms."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "jailbreak detection"
    },
    {
        "id": "afb8eb7a-8fb0-44b8-86c4-46d0cbcff383",
        "source": "cs161_textbook",
        "question": "A website has implemented CAPTCHA to prevent automated scripts from performing malicious activities. Which of the following scenarios could effectively benefit from the CAPTCHA implementation, and which could present challenges to the website's security?",
        "choices": [
            "A: CAPTCHA can prevent an automated script from creating multiple accounts quickly, but it might not stop a determined attacker using machine learning to solve CAPTCHAs.",
            "B: CAPTCHA can deter casual attackers from spamming a comment section, but may not prevent a DoS attack if the attacker is willing to manually solve each CAPTCHA.",
            "C: CAPTCHA can stop all brute-force attacks on user accounts by requiring a CAPTCHA with each login attempt, ensuring account security.",
            "D: CAPTCHA can challenge users to identify images with boats, but it might not be effective against a botnet that distributes the CAPTCHA solving task across many nodes."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CAPTCHA"
    },
    {
        "id": "563a2ce9-6701-48d5-94c8-488cad492c17",
        "source": "cwe",
        "question": "A software application recently experienced a security breach where unauthorized users were able to access and manipulate data through the application's API. A post-incident analysis revealed a flaw in how users interacted with the system. Which of the following could be the reason for this security breach, based on the principle of complete I/O documentation?",
        "choices": [
            "A: The API documentation did not specify the range and type of acceptable input values for each endpoint.",
            "B: The software's graphical user interface did not provide adequate error messages when users entered invalid data.",
            "C: The end-user license agreement did not clearly state the legal consequences of unauthorized data access.",
            "D: Online help resources contained broken links, leading to some users not being able to access help articles."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "API_Security"
    },
    {
        "id": "611f58e0-799e-4655-8b57-503c6396cd94",
        "source": "owasp_mastg",
        "question": "A financial services company is developing a mobile banking app. Security testing for the app should include gathering environmental information. Which of the following should be considered to ensure a comprehensive understanding of the app's security needs?",
        "choices": [
            "A: The company's marketing strategies for promoting the app.",
            "B: The banking industry's compliance requirements and risk profile.",
            "C: The graphic design principles used in the app's user interface.",
            "D: Internal processes and workflows that could introduce business logic vulnerabilities."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Business Logic Vulnerabilities"
    },
    {
        "id": "c9c46d7f-0afb-47e2-9935-5f2becefa778",
        "source": "apple_platform_security",
        "question": "In the security design of FaceTime calls, why are certain encryption methods and protocols used? (Select all that apply.)",
        "choices": [
            "A: AES256 in Counter Mode is used for encrypting SRTP packets to provide a high level of encryption strength.",
            "B: HMAC-SHA256 is used for packet authentication to ensure the integrity of the data.",
            "C: APNs notifications and STUN messages enable identity certificate verification and shared secret establishment for session keys derivation.",
            "D: FaceTime avoids using APNs and STUN in favor of direct peer-to-peer connections to mitigate the risk of server-side data interception."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "FaceTime Encryption"
    },
    {
        "id": "afaf3a52-ddc3-4338-90af-49d525c6e306",
        "source": "windows_security",
        "question": "As a system administrator, you are tasked with configuring Group Policy settings to enforce advanced protections against memory-based attacks on your organization's computers running Windows 10. Which of the following options would you configure to force Address Space Layout Randomization (ASLR) for 64-bit applications, ensuring DLLs load into random memory addresses at boot time?",
        "choices": [
            "A: PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE",
            "B: PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE",
            "C: PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON",
            "D: PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "MemorySafety"
        ],
        "keyword": "Group Policy"
    },
    {
        "id": "bcb4b4fc-9cc8-45a8-ad3d-ac467bde16b8",
        "source": "attck",
        "question": "As a cybersecurity specialist, you are reviewing the network's defense mechanisms against internal spearphishing attacks. Which of the following detection methods would most likely yield actionable insights for identifying an ongoing internal spearphishing campaign?",
        "choices": [
            "A: Implementing a solution that sends copies of internal emails to a security service for offline analysis to detect spearphishing attempts.",
            "B: Monitoring network traffic for large outbound data transfers to external IP addresses as an indication of spearphishing attempts.",
            "C: Frequently changing network firewall rules to prevent spearphishing emails from reaching user inboxes.",
            "D: Relying solely on endpoint antivirus solutions to identify and block spearphishing emails based on known malware signatures."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "21a6be3c-a1cc-483c-9a93-5f9a5b692c4f",
        "source": "apple_platform_security",
        "question": "Which of the following measures are implemented by Apple to prevent a Security Research Device from being used as a normal user device, and ensure that specialized security mechanisms such as the cryptex subsystem do not operate on customer devices?",
        "choices": [
            "A: The cryptexd daemon aborts if it detects a normal customer device.",
            "B: The signing server personalizes a cryptex disk image without any device allow list restrictions.",
            "C: AppleImage4 vends a special nonce used for verifying research cryptex on any device.",
            "D: The device only starts up while charging and displays 'Security Research Device' during iBoot startup."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityResearchDevice"
    },
    {
        "id": "97b6b195-1575-42ed-b774-487e3d4cf290",
        "source": "owasp_wstg",
        "question": "A security team is debating the merits of allowing users to generate their own security questions for password recovery. What is the most compelling counterargument against allowing users to create their own security questions?",
        "choices": [
            "A: Users may create highly complex questions that they themselves cannot remember.",
            "B: It gives users the flexibility to create questions that are personally significant and memorable.",
            "C: It may lead to the creation of very insecure questions that can easily be guessed or bypass security.",
            "D: Users appreciate the convenience of having pre-generated questions to select from."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Security Questions"
    },
    {
        "id": "e1b8cd29-7735-4f26-bb34-6bc6750af694",
        "source": "owasp_mastg",
        "question": "Consider the following code snippet that attempts to include a standard system header file in a C/C++ application, but contains a mistake:\n\nc\n    include <unistd.h>\n#include <unistd.h>\n\n\nWhich of the following corrections will properly import the 'unistd.h' header file and adhere to secure coding practices?",
        "choices": [
            "A: Replace 'include' with '#include' to correctly import the header file.",
            "B: Remove the '<' and '>' characters and use quotes ('') for a local file import.",
            "C: Comment out the second import to avoid a double inclusion error.",
            "D: Rewrite the code in a different programming language that doesn't require header files."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "#include directive"
    },
    {
        "id": "23d24d2a-dd27-4411-9ca6-76cbf0599812",
        "source": "attck",
        "question": "As a security analyst evaluating mitigation techniques against the use of legitimate web services for command and control operations by adversaries, which of the following would likely be the least effective and why?",
        "choices": [
            "A: Employing network intrusion prevention systems, because they may not be able to decrypt SSL/TLS traffic to identify malicious content.",
            "B: Restricting web-based content through web proxies, because they can prevent the use of unauthorized external services.",
            "C: Monitoring for unexpected network connection creations, as it is an effective way to detect network anomalies.",
            "D: Analyzing network traffic flow for uncommon data flows, because this can pinpoint suspicious processes utilizing the network."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "SSL/TLS Encryption"
    },
    {
        "id": "db74ab6e-34bf-41cd-8bb6-7ceb8ac8f602",
        "source": "cwe",
        "question": "Consider the following scenarios where a function is designed to access files within a restricted directory based on user input. Which of the following code examples correctly neutralizes path traversal attempts using '/../' sequences?",
        "choices": [
            "A: The function checks for '/../' anywhere in the input and rejects the request if found.",
            "B: The function allows paths that start with '/./' but filters any occurrence of '/../'.",
            "C: The function only removes '../' sequences at the beginning of the input.",
            "D: The function canonicalizes the path and then checks if the resolved path starts with the expected directory prefix."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PathTraversal"
    },
    {
        "id": "a50aa8a5-a0ab-4416-b633-070de04f6db9",
        "source": "attck",
        "question": "An organization has recently migrated several applications to a serverless architecture using cloud-based functions and workflows. As a security analyst, you are tasked with monitoring these serverless components for signs of adversary activity. Which of the following activities would be the most indicative of a potential security threat in this environment?",
        "choices": [
            "A: The creation of a serverless function that forwards emails using a Power Automate workflow.",
            "B: Routine creation of serverless resources for new projects by authorized personnel.",
            "C: A serverless function that adds additional cloud credentials to a user when a new user is created.",
            "D: Regular modification of existing serverless functions to optimize performance based on user feedback."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Serverless Execution"
    },
    {
        "id": "082db64c-70c7-4b48-a95c-d535ae6a8529",
        "source": "apple_platform_security",
        "question": "An organization is considering the use of Managed Apple IDs for their employees. Which of the following features would apply to Managed Apple IDs based on the security overview provided?",
        "choices": [
            "A: Employees will be able to use Apple Pay for transactions on their devices.",
            "B: The organization can set up role-based permissions for different employees.",
            "C: Employees will have unrestricted access to iCloud Keychain for synchronizing passwords across their devices.",
            "D: Organizational administrators can inspect accounts of employees, provided there is a hierarchical relationship."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "ManagedAppleIDFeatures"
    },
    {
        "id": "a3fb2c6d-9b5a-4316-92b2-e714b4059285",
        "source": "owasp_wstg",
        "question": "When documenting the results of a web application security test, what considerations should be taken into account to ensure that the report's findings are useful to developers, business owners, and security testers?",
        "choices": [
            "A: The report should include a mix of technical jargon and business language to ensure it is comprehensive.",
            "B: The report should clearly identify material risks, pinpoint affected functions, and provide recommendations in language clear to developers.",
            "C: The report should focus mainly on highlighting the most severe vulnerabilities to avoid overloading the reader with information.",
            "D: The report should be written in a complex format to reflect the depth of the security tester's expertise."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Testing Documentation"
    },
    {
        "id": "d15655d9-f291-419a-89c1-c73ddb5bc029",
        "source": "windows_security",
        "question": "In which of the following scenarios would a Kerberos service ticket typically be requested in a Windows environment?",
        "choices": [
            "A: A user logs on to their workstation with a username and password.",
            "B: A user attempts to access a network resource for which they have already been authenticated.",
            "C: A service starts on a machine under a specified service account.",
            "D: A user needs to authenticate to a network service they're accessing for the first time during their session."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Kerberos service ticket"
    },
    {
        "id": "6f3a4603-8a15-4743-9522-908c43f95ba2",
        "source": "windows_security",
        "question": "A company is planning to enhance its security posture on Windows systems against credential theft attacks. They are considering implementing Credential Guard. Which of the following benefits are expected to be provided by enabling Credential Guard? (Select TWO)",
        "choices": [
            "A: Credential Guard encrypts the Active Directory database to prevent unauthorized access.",
            "B: Credential Guard uses hardware security features like Secure Boot to protect credentials.",
            "C: Credential Guard prevents malware with administrative privileges from extracting protected secrets.",
            "D: Credential Guard enables Kerberos DES encryption support for legacy applications."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Credential Theft Protection"
    },
    {
        "id": "fba4a913-7516-4479-b842-bd69b1bdb77c",
        "source": "owasp_wstg",
        "question": "A software development team has omitted security testing from their standard development process. Based on best practices, which of the following statements best describes the potential consequences of this action?",
        "choices": [
            "A: The application is likely to be more secure because the developers can focus on functionality without the distraction of security concerns.",
            "B: The lack of security testing can lead to the application having undiscovered vulnerabilities, which could be exploited by attackers.",
            "C: Security testing is only necessary for applications that handle sensitive data, so omitting it will not have any significant consequences.",
            "D: Omitting security testing will improve the speed of development, thereby enhancing the application's market competitiveness without any security drawbacks."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Testing"
    },
    {
        "id": "20d28819-1732-4ec1-9427-e4671b7019c1",
        "source": "owasp_mastg",
        "question": "As an application security professional, you've been granted access to the source code of a mobile application for security testing. Considering this access, which analysis method would enable you to perform a more granular and detailed examination of the app's security controls and why?",
        "choices": [
            "A: Dynamic Analysis, as it allows testing of the app's real-time execution and is more insightful than static analysis.",
            "B: Static Analysis, because it involves examining the app's components and source code for security controls without executing them.",
            "C: Automated Scanning, as it eliminates the need for manual review and provides comprehensive vulnerability analysis.",
            "D: Manual Code Review alone, disregarding other methods, as it is the only way to identify vulnerabilities in business logic."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity"
        ],
        "keyword": "Static Analysis"
    },
    {
        "id": "31db3377-01b1-4e79-bcb5-6249354fdbe4",
        "source": "cs161_textbook",
        "question": "When developing a new software application, what are the potential disadvantages of deferring the implementation of security measures until after the application's architecture has been established, as opposed to integrating security principles from the beginning of the design process?",
        "choices": [
            "A: Retrofitting security may result in a less effective implementation of the principle of least privilege.",
            "B: Early integration of security can lead to unnecessary complexity and delay in the development process.",
            "C: Retrofitting security might lead to compatibility issues with previous versions of the software.",
            "D: Integrating security from the start often limits the ability to achieve defense in depth."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityDesign"
    },
    {
        "id": "51dcdedf-353a-431a-b65a-71383c7fc1f8",
        "source": "windows_security",
        "question": "Which of the following statements is the best counterargument for excluding certain types of behaviors from being monitored by advanced security audit policy settings in Windows?",
        "choices": [
            "A: Excluding behaviors that are of little concern reduces the log volume, thereby improving system performance and log management.",
            "B: Excluding behaviors will create a security gap as all actions including the most trivial, such as read-only file access, must be logged for comprehensive auditing.",
            "C: Excluding behaviors can lead to a lack of information when investigating incidents, as less critical events can sometimes provide context for more significant events.",
            "D: Excluding behaviors that generate excessive log entries will save on storage costs and reduce the need for frequent log archiving."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Audit Policy"
    },
    {
        "id": "c2dd663e-998e-44eb-b024-81ecdecf0dc4",
        "source": "attck",
        "question": "A security analyst is analyzing network traffic and observes suspicious activity indicative of malware communication with a command and control (C2) server. Which of the following actions might the malware be performing based on this observation?",
        "choices": [
            "A: Downloading additional files from the C2 server.",
            "B: Disabling the network interface to prevent further communication.",
            "C: Encrypting files on the victim's machine to demand a ransom.",
            "D: Modifying the system clock to disrupt time-based security measures."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command and Control (C2) Server"
    },
    {
        "id": "ffd930de-d3ac-4671-92a2-738ce82d0764",
        "source": "owasp_wstg",
        "question": "A developer is tasked to secure a web application that handles sensitive user information such as addresses and credit card details. Which of the following HTTP header settings should the developer configure to ensure that this sensitive information is not stored in the browser's cache or retrieved through the browser's history mechanisms?",
        "choices": [
            "A: Set the 'Cache-Control' header to 'no-store, no-cache, must-revalidate, private'.",
            "B: Set the 'Cache-Control' header to 'public, max-age=31536000'.",
            "C: Set the 'Expires' header to a past date.",
            "D: Remove the 'ETag' header to prevent caching."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTTP Cache-Control header"
    },
    {
        "id": "0311118a-5bec-488a-a338-73959cee72b7",
        "source": "cs161_textbook",
        "question": "In a scenario where an application requires fast transmission of data without the necessity of guaranteed delivery or strict ordering, which transport layer protocol would be more suitable and for what reason?",
        "choices": [
            "A: TCP, because it guarantees reliable, in-order packet delivery which is critical for fast data transmission.",
            "B: UDP, because it does not guarantee in-order packet delivery, making it faster for applications that do not require strict ordering.",
            "C: TCP, because it uses complex mechanisms to ensure speed is prioritized over reliability and order.",
            "D: UDP, because it operates without the overhead of ensuring reliability and order, therefore providing faster data transmission for such applications."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "TransportProtocols"
    },
    {
        "id": "96830aca-590c-42f7-af86-3bcd587e0964",
        "source": "apple_platform_security",
        "question": "Which of the following statements would NOT be true when dealing with HealthKit data and third-party apps on iOS?",
        "choices": [
            "A: Third-party apps must have entitlements to access HealthKit data and are bound by strict usage restrictions.",
            "B: Third-party apps with read access to HealthKit data can infer which other apps have access to the same health data types.",
            "C: Third-party apps need explicit user permission to access each type of health data for both reading and writing operations.",
            "D: Apps can read the health data they write to HealthKit, but they cannot read data written by other sources unless permission is granted."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "HealthKit"
    },
    {
        "id": "b5b19c69-b0d3-4588-ae10-2edf674fb81e",
        "source": "owasp_mastg",
        "question": "You are developing an Android application and wish to implement security measures that will increase the complexity of reverse engineering attempts. Consider the following methods and their detailed descriptions of effectiveness:\n\n1. Checking the app's signature upon startup against a pinned signature to detect repackaging.\n2. Inspecting running services and processes to identify any instance of 'frida-server'.\n3. Scanning open TCP ports for default bindings of reverse engineering tools.\n4. Scanning process memory for known artifacts and strings associated with reverse engineering tools.\n\nWhich of these methods would be considered too trivial to bypass and what are the limitations of another that relies on detecting processes that may not be visible due to system restrictions?",
        "choices": [
            "A: Method 1 is too trivial to bypass by patching the APK, and method 2 is limited by Android 7.0 (API level 24) and higher, which do not show daemons started by other apps.",
            "B: Method 3 is too trivial to bypass as the listening port can be easily changed, and method 4 is limited because the artifacts it searches for can be patched in the Frida binaries.",
            "C: Method 1 is too trivial to bypass by simply renaming the Frida artifacts, and method 2 is limited because detecting open TCP ports is not a reliable indicator of reverse engineering activities.",
            "D: Method 3 is too trivial to bypass by using named pipes instead of TCP ports, and method 4 is limited because scanning for strings like 'LIBFRIDA' can be circumvented by using alternative modes of operation."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "reverse engineering detection"
    },
    {
        "id": "969d09a2-a265-4bf9-887a-b8c35a64fe6f",
        "source": "attck",
        "question": "An adversary has gained access to a company's network and seeks to maintain persistence by creating new user accounts. As a security analyst, which combination of actions should you monitor to detect and mitigate the creation of unauthorized accounts? Select two.",
        "choices": [
            "A: Monitor executed commands and arguments for actions that could create accounts, such as 'net user' or 'useradd', and enforce multi-factor authentication for all accounts.",
            "B: Implement a strict bring-your-own-device (BYOD) policy to prevent adversaries from using personal devices to create unauthorized accounts.",
            "C: Limit network access to domain controllers and critical servers, and monitor for the use of 'sp_addlinkedsrvlogin' on SQL Servers.",
            "D: Frequently change the network topology to confuse adversaries and prevent them from creating accounts."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Persistence"
    },
    {
        "id": "a2f1533e-bb07-477c-840f-40c4888ca2c5",
        "source": "cwe",
        "question": "In an object-oriented software design, what are potential consequences of having a public method that returns a reference to a private data structure, and how could these be mitigated? Choose the most applicable consequence and its corresponding mitigation.",
        "choices": [
            "A: Consequence: Data Encapsulation Violation; Mitigation: Implement deep copy mechanisms for returned data.",
            "B: Consequence: Increased Object Instantiation; Mitigation: Return static instances of data structures.",
            "C: Consequence: Reduced Garbage Collection; Mitigation: Use weak references for private data.",
            "D: Consequence: Improved Performance; Mitigation: No action needed as this is a positive outcome."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Consequence"
    },
    {
        "id": "c2ada736-6e69-47d2-9106-816b1404a246",
        "source": "windows_security",
        "question": "Which of the following is NOT a security benefit of utilizing Remote Credential Guard for Remote Desktop sessions?",
        "choices": [
            "A: Credentials are not sent to the remote host.",
            "B: Single sign-on to other systems during the remote session is available.",
            "C: An attacker cannot act on behalf of the user after the session has ended.",
            "D: Credentials can be delegated using NTLM if Kerberos is unavailable."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "NTLM Fallback"
    },
    {
        "id": "5abe1c4c-8791-42ca-9c4a-713978cd9cd0",
        "source": "apple_platform_security",
        "question": "A developer is integrating SiriKit into their third-party app on iOS. Which of the following scenarios would SiriKit NOT provide app-specific data to the third-party app, assuming default permission settings?",
        "choices": [
            "A: SiriKit would not provide contact information if the app does not have permissions to access the user's contacts.",
            "B: SiriKit would always resolve relationships mentioned in the body of the message, such as 'my brother', to provide context for the app.",
            "C: SiriKit would not resolve a relationship in a user request like 'Pay my mother 10 pounds' if the app lacks contact information access.",
            "D: SiriKit would pass the entire original user utterance to the app extension without checking the app's user-controlled access permissions."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "SiriKit"
    },
    {
        "id": "db8b0c18-feb6-46e5-8c40-165192476d6b",
        "source": "owasp_wstg",
        "question": "A security analyst is reviewing the configuration of a web server. The analyst observes that the server uses TLS 1.2 with a digital certificate that has a 2048-bit key strength and a SHA-256 signature algorithm. The certificate is signed by a trusted CA, has a valid SAN matching the hostname, and is within the validity period. However, the analyst notes that the server supports SSLv3. Which of the following actions should the analyst recommend to improve the server's security?",
        "choices": [
            "A: Upgrade the digital certificate to a 4096-bit key strength.",
            "B: Disable support for SSLv3 to prevent protocol downgrade attacks.",
            "C: Replace the SHA-256 signature algorithm with MD5 for better compatibility.",
            "D: Increase the validity period of the certificate to reduce renewal frequency."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SSLv3"
    },
    {
        "id": "eb78b766-ca19-4926-acae-3fc7763141d5",
        "source": "owasp_wstg",
        "question": "You are reviewing the application routing configuration in a Django application and notice the following code snippet in the urls.py file:\n\npython\nfrom django.urls import re_path\nfrom . import views\n\nurlpatterns = [\n\n    re_path(r'.*^dashboard', views.path_confusion ,name = 'index'),\n\n]\n\n\nSelect the potential vulnerability that this code may introduce and the most suitable remediation action:",
        "choices": [
            "A: The application is vulnerable to a Local File Inclusion (LFI) attack due to improper input sanitization and should use parameterized queries to mitigate the issue.",
            "B: The application is susceptible to SQL Injection attacks as a result of this routing and should employ prepared statements to prevent it.",
            "C: This configuration introduces a risk of Web Cache Deception attacks because of the improper regular expression in routing, which should be corrected to match precise path patterns.",
            "D: The code snippet has a potential Cross-Site Scripting (XSS) vulnerability due to unescaped output and should implement output encoding mechanisms."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Web Cache Deception"
    },
    {
        "id": "f208bd49-0da8-476d-ab3b-0c9c4732623c",
        "source": "windows_security",
        "question": "You are reviewing the security event logs of a Windows server and notice an entry indicating that the Windows Firewall Service has started successfully at a time that is not during the operating system startup process. Based on best practices for security monitoring, what would be the most appropriate steps to take? (Select two)",
        "choices": [
            "A: Investigate the event as it could indicate an unauthorized attempt to modify system settings.",
            "B: Ignore the event since the Windows Firewall Service routinely restarts at various times for updates.",
            "C: Verify if any scheduled tasks or updates might have triggered the service to start at this time.",
            "D: Disregard the event as informational since all events of this nature are only logged during system startup."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Security Event Log"
    },
    {
        "id": "8907298f-92a2-4d46-9774-73f291ba7e16",
        "source": "cwe",
        "question": "A development team has implemented a new authentication system for their web application. Upon security review, it was discovered that while the authentication algorithm was secure, a flaw in the system allowed an attacker to bypass the authentication process entirely. Which of the following could be the primary weakness that allowed for the authentication bypass?",
        "choices": [
            "A: The server uses unencrypted HTTP requests, allowing an attacker to capture and replay login information.",
            "B: Input validation is not enforced on the username field, permitting SQL injection attacks.",
            "C: Session tokens are not invalidated after logout, enabling session fixation attacks.",
            "D: The cryptographic hash function used for passwords is outdated, making it vulnerable to rainbow table attacks."
        ],
        "answer": "B",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "AuthenticationBypass"
    },
    {
        "id": "f1f35ca0-bf77-4f46-bce4-8030aac17a49",
        "source": "android_sec_doc",
        "question": "A security consultant is advising a smartphone manufacturer on encryption methods for a new device with an ARMv8 CPU without Cryptography Extensions, launching with Android 9. What advice should the consultant give regarding the use of Adiantum?",
        "choices": [
            "A: Recommend using Adiantum, as it is designed for devices without AES instructions, and ensure the kernel configuration includes CONFIG_DM_CRYPT.",
            "B: Advise against using Adiantum since AES is faster on platforms with ARMv8 Cryptography Extensions.",
            "C: Suggest using AES encryption instead of Adiantum, regardless of the device's CPU capabilities.",
            "D: Propose enabling NEON instructions for performance improvement, regardless of the device's kernel version or CPU instructions."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Adiantum"
    },
    {
        "id": "4afa2c75-50c0-4ce1-a326-feacf4a7511c",
        "source": "windows_security",
        "question": "A system administrator has set the 'Interactive logon: Do not require CTRL+ALT+DEL' policy to 'Not defined' on a fleet of Windows 11 devices after previously having it enabled. What additional action is necessary to fully revert the changes made by this policy?",
        "choices": [
            "A: The DisableCAD registry value located in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System needs to be removed.",
            "B: The administrator must manually reset all user passwords to prevent potential password leaks.",
            "C: The system's group policy must be updated to reflect the changes in the next policy refresh cycle.",
            "D: Enabling a firewall rule to block unauthorized login attempts is required to secure the login process."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DisableCAD"
    },
    {
        "id": "1483041e-fb04-4c52-be14-e1324e81d11e",
        "source": "owasp_mastg",
        "question": "When designing session management for a mobile application, which of the following measures contribute to a secure session management system?",
        "choices": [
            "A: Permanently storing session IDs on the mobile device to improve user experience by avoiding frequent re-authentication.",
            "B: Enforcing that session IDs are always transmitted over insecure connections to ensure compatibility across various network configurations.",
            "C: Implementing server-side session ID verification for each user request to ensure the user has the required privileges for the requested resource.",
            "D: Using easily predictable session IDs for faster server-side validation and improved performance."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Session Management"
    },
    {
        "id": "83c99b71-e65e-4d7d-8637-c1e9350114f2",
        "source": "windows_security",
        "question": "A security administrator is assessing potential vulnerabilities in a corporate environment where employees frequently connect external devices to company laptops. Which security feature should be prioritized to mitigate the risk of unauthorized data access through such external devices?",
        "choices": [
            "A: Implementing biometric authentication for device access.",
            "B: Enforcing a security policy that prevents drive-by DMA attacks via external devices.",
            "C: Deploying antivirus software to scan for malware on external devices.",
            "D: Configuring session timeouts to reduce the window of opportunity for unauthorized access."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Drive-by DMA Attacks"
    },
    {
        "id": "f1ecae49-8067-4f8f-acbc-299bae3a36f4",
        "source": "owasp_wstg",
        "question": "You are conducting a security assessment on a web application and have identified that the server information is obscured in the headers, making typical fingerprinting methods less effective. Based on your knowledge of web server fingerprinting techniques, which of the following methods would you employ to surmise the type of the web server being used?",
        "choices": [
            "A: Perform a banner grab for an SSL certificate to determine the encryption algorithms being used by the server.",
            "B: Send malformed requests to the server in order to elicit error responses that may contain server-specific error pages or headers.",
            "C: Use a network packet analyzer to intercept and inspect incoming traffic to the server for any clues about the server type.",
            "D: Check for specific web server files or directories that might exist by default on certain types of servers."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Web Server Fingerprinting"
    },
    {
        "id": "55a9dce6-fd22-4fd0-be79-3cb24d826c4f",
        "source": "cwe",
        "question": "You are designing a system that handles various types of files uploaded by users. To mitigate the risk of deploying the wrong handler for processing these files, which of the following actions should be included in your design?",
        "choices": [
            "A: Implement a function that checks the file extension and compares it with the file content to ensure consistency before processing.",
            "B: Allow all file types to be processed by a generic handler that does not perform any type-specific operations.",
            "C: Deploy separate handlers for each file type and use a random selection algorithm to choose which handler to use for each file.",
            "D: Require that all files have a corresponding digital signature that the handler verifies before processing."
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "TypeChecking"
    },
    {
        "id": "00ffd4f7-03a2-4340-87ad-bf883666d751",
        "source": "attck",
        "question": "In an enterprise environment, what is a security advantage of Windows Management Instrumentation (WMI)?",
        "choices": [
            "A: It can execute commands remotely, which can be leveraged for administrative tasks.",
            "B: It operates over common ports such as 135 for DCOM, which are typically allowed through firewalls.",
            "C: It allows the execution of encoded PowerShell scripts via the DownloadString method.",
            "D: It can be used to delete volume shadow copies, hindering system recovery efforts."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "WMI Remote Execution"
    },
    {
        "id": "54f4ae87-3581-4549-bbd4-ebf8ed5513f6",
        "source": "attck",
        "question": "In an advanced persistent threat (APT) scenario, the adversary aims to tamper with API monitoring tools to avoid detection. Which of the following API functions could be used to unhook monitored functions and help the adversary in disabling or modifying these tools?",
        "choices": [
            "A: CreateRemoteThread()",
            "B: CheckRemoteDebuggerPresent",
            "C: DeviceIoControl",
            "D: LoadLibraryA"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "API Hooking"
    },
    {
        "id": "ccbba18d-5a26-47b5-a125-adf40cee786e",
        "source": "owasp_mastg",
        "question": "In the context of OAuth 2.0, when developing a mobile banking application that requires secure interaction with the bank's own services, which user agent implementation method is deemed more appropriate, and why?",
        "choices": [
            "A: Using an external user agent, as it allows the app to control the browser behavior including certificate pinning.",
            "B: Using an embedded user agent, as it keeps the authentication process within the app, reducing the risk of credential phishing.",
            "C: Using an external user agent, because it requires complex authentication logic, which provides better security.",
            "D: Using an embedded user agent, because it exposes the user's credentials to the app during login, enhancing the security."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "User Agent"
    },
    {
        "id": "ae5220fb-c8c2-4488-b754-2e3a97cde4e2",
        "source": "attck",
        "question": "A security analyst is reviewing the network traffic logs and notices multiple instances of SMB traffic attempting to leave the network to an unrecognized external system. Considering the principles of forced authentication tactics, which of the following actions should the analyst prioritize to investigate and potentially prevent credential theft?",
        "choices": [
            "A: Monitor for unusual workstation-to-workstation SMB traffic within the network to identify any deviations from the baseline.",
            "B: Immediately disable SMB protocol across the organization to prevent any further automated authentication attempts.",
            "C: Implement a security policy that requires all users to change their passwords on a daily basis.",
            "D: Check for file modifications indicating changes to .LNK or .SCF files that contain external network resource references."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Forced Authentication"
    },
    {
        "id": "5c5c4522-203b-4669-99f7-fa1a19da7331",
        "source": "windows_security",
        "question": "A Windows 10 system administrator receives a security event log notification indicating that a device installation has been blocked due to policy restrictions. The administrator needs to review the event details to track this policy violation. Which of the following fields should they examine to gather information about the device installation policy violation? (Select TWO.)",
        "choices": [
            "A: Device Instance Path",
            "B: Operating System Version",
            "C: Device Description",
            "D: User's Preferred Language Settings"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Event Log"
    },
    {
        "id": "682a7ade-4ea4-4a12-a433-848b5cac3577",
        "source": "windows_security",
        "question": "A company's IT department is reviewing their security policies for Windows clients. They are considering the implications of the 'Perform volume maintenance tasks' security policy setting. Which of the following statements are correct about this policy setting?",
        "choices": [
            "A: Enabling this policy allows users to bypass file permissions when extending a volume.",
            "B: Disabling this policy will encrypt the volume, adding an additional layer of security.",
            "C: Enabling this policy permits users to perform operations that can be disruptive to disk volumes.",
            "D: Disabling this policy increases the amount of time required to extend a volume."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Perform volume maintenance tasks"
    },
    {
        "id": "78a4f6ab-7aeb-45c5-bf1f-5796f958146e",
        "source": "attck",
        "question": "A cybersecurity team in a large organization is investigating an incident where an adversary was able to move laterally across multiple domains by exploiting domain trust relationships. As the team's lead, which of the following measures would you prioritize to mitigate such threats in the future?",
        "choices": [
            "A: Implement strict network segmentation between sensitive domains to limit unauthorized access.",
            "B: Decrease the complexity of user passwords to reduce the chance of credential stuffing attacks.",
            "C: Reduce the frequency of security audits to avoid revealing domain trust details to potential adversaries.",
            "D: Establish an open trust relationship between all domains to simplify resource access for users."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "29d4966e-05ff-4f81-9f0d-ed8b141d1e8b",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately describe the security mechanisms and benefits of the Secure Enclave in Apple devices? Select all that apply.",
        "choices": [
            "A: The Secure Enclave includes an AES engine to perform efficient and secure cryptographic operations, enhancing data encryption and decryption.",
            "B: The Secure Enclave Processor starts with an A11 and S4, includes a memory-protected engine, and encrypted memory with anti-replay capabilities.",
            "C: The Memory Protection Engine uses a static key to encrypt Secure Enclave memory, ensuring data remains secure even in the event of processor kernel compromise.",
            "D: The Secure Enclave Boot ROM is immutable code that establishes a hardware root of trust and verifies the sepOS image signature before booting."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Secure Enclave"
    },
    {
        "id": "0c6db526-0448-4e73-975b-c788a0b156cc",
        "source": "attck",
        "question": "An organization has identified an attempt by an adversary to install a fraudulent root certificate on their Windows systems to subvert security controls. Which of the following mitigation strategies would be MOST effective in preventing this type of attack? (Select TWO.)",
        "choices": [
            "A: Enable HTTP Public Key Pinning (HPKP) to enforce the use of expected certificates.",
            "B: Set the 'Flags' value of 'HKLM\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots' to 0 to allow non-administrator users to install root certificates.",
            "C: Use Windows Group Policy to manage root certificates and prevent non-administrator users from making root installations.",
            "D: Decrease the level of user mode signature validation to allow for easier detection of untrusted programs."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Root Certificate Management"
    },
    {
        "id": "4d43f415-22c1-48f4-9d0c-7e4c41f3e014",
        "source": "cwe",
        "question": "A software development team is reviewing a function that uses variadic parameters to handle a variety of tasks with different argument types and counts. In a security assessment, which of the following would be a valid concern related to the function's design?",
        "choices": [
            "A: The function could be performing tasks that are not necessary, leading to performance degradation.",
            "B: The function's signature allows for a variadic number of parameters, making it difficult to ensure which function or method is being invoked.",
            "C: The function's implementation uses recursion to handle the variable number of arguments, making the code easier to maintain.",
            "D: The function's documentation is incomplete, lacking examples of how to invoke the function correctly."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityAssessment"
    },
    {
        "id": "42c276a8-419d-4897-b88f-bb29727d2ee9",
        "source": "cwe",
        "question": "A developer is implementing a feature that processes user input for a mail program's subject line, which is expected to allow special characters such as ';' and '>'. Which of the following measures should the developer take to prevent OS command injection while ensuring the application behaves as intended?",
        "choices": [
            "A: Rely solely on denylists to filter out known malicious inputs.",
            "B: Implement strict input validation, rejecting any input that does not strictly adhere to the expected format.",
            "C: Use proper output encoding and escaping to ensure that special characters are handled correctly.",
            "D: Strip out all special characters from the subject line to avoid any possibility of command injection."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "OSCommandInjection"
    },
    {
        "id": "fb779ae7-3a14-492c-87cf-dc21a4ecaa3c",
        "source": "apple_platform_security",
        "question": "Consider a smartphone that integrates the Secure Enclave for security purposes. Select the features and protections that are directly enabled or enhanced by the Secure Enclave based on the provided design specifics.",
        "choices": [
            "A: The Secure Enclave allows for the secure generation and storage of keys necessary for encrypting data at rest.",
            "B: It prevents any software from engaging the microphone when the device's lid is closed, by using a hardware disconnect.",
            "C: It provides the foundation for evaluating the biometric data for Face ID and Touch ID.",
            "D: The Secure Enclave includes a special channel that provides keying material to the AES engine without exposing this information to the Application Processor."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Secure Enclave"
    },
    {
        "id": "4d7c33ac-f305-4e24-92d9-e1b53ccf9aad",
        "source": "cs161_textbook",
        "question": "An online coding platform evaluates user-submitted Python code in a sandboxed environment. Which of the following inputs would not lead to unintended code execution outside the sandbox if the platform has implemented appropriate input sanitation and sandboxing techniques? Select all that apply.",
        "choices": [
            "A: globals()",
            "B: 'Hello, World!'.upper()",
            "C: 3.14159 * 2",
            "D: exec('rm -rf /')"
        ],
        "answer": "BC",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Code Injection"
    },
    {
        "id": "3f44d801-d39f-4c63-b7b4-402eb5ecf492",
        "source": "windows_security",
        "question": "Your organization is implementing virtualization-based security features on its Windows devices. As a security administrator, you are tasked with enabling memory integrity on devices that support DMA protection and ensuring that the feature will only be turned on for computers with input/output memory management units (IOMMUs). Which registry keys and values should you correctly set to achieve this configuration?",
        "choices": [
            "A: Set 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity' /v 'Enabled' /t REG_DWORD /d 1 /f and 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard' /v 'RequirePlatformSecurityFeatures' /t REG_DWORD /d 3 /f.",
            "B: Set 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard' /v 'EnableVirtualizationBasedSecurity' /t REG_DWORD /d 1 /f and 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard' /v 'RequirePlatformSecurityFeatures' /t REG_DWORD /d 2 /f.",
            "C: Set 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity' /v 'Locked' /t REG_DWORD /d 1 /f and 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard' /v 'RequirePlatformSecurityFeatures' /t REG_DWORD /d 1 /f.",
            "D: Set 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard' /v 'EnableVirtualizationBasedSecurity' /t REG_DWORD /d 0 /f and 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard' /v 'RequirePlatformSecurityFeatures' /t REG_DWORD /d 3 /f."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "DMA Protection"
    },
    {
        "id": "444bda17-234f-4078-9282-c5fff4dd379e",
        "source": "owasp_mastg",
        "question": "A developer is attempting to include the standard string library in a C++ program but encounters compilation errors. Below are four different attempts to include the library. Select the attempts that would correctly include the standard string library without causing compilation errors:",
        "choices": [
            "A: #include <string>",
            "B: include <string>",
            "C: #include \"string\"",
            "D: import <string>"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "C++ Preprocessor Directives"
    },
    {
        "id": "e7605ba6-0bc6-4cd4-9bdf-4c7d2cac9e8f",
        "source": "attck",
        "question": "An organization wants to mitigate the risk of adversaries using scheduled tasks for privilege escalation. Which of the following configurations would most effectively reduce this risk?",
        "choices": [
            "A: Allowing all user accounts to schedule tasks and set higher priority processes.",
            "B: Disabling the server operators from scheduling tasks by setting the relevant Group Policy Object (GPO).",
            "C: Enforcing the use of the SYSTEM account for all scheduled tasks to maintain consistent permission levels.",
            "D: Increasing the number of user accounts with administrator privileges to oversee scheduled task creation."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Group Policy Object (GPO)"
    },
    {
        "id": "cd35dcfb-1b6f-4b73-adc7-39c795f32938",
        "source": "cwe",
        "question": "If an attacker is able to reverse engineer an application's executable file, which of the following outcomes is the most likely if sensitive information was stored in cleartext within the executable?",
        "choices": [
            "A: Attackers would need to break the advanced encryption to access the sensitive information.",
            "B: Attackers would be able to directly read the sensitive information without additional decoding.",
            "C: Attackers would have to guess the encoding scheme used to obfuscate the sensitive information.",
            "D: Attackers would be unable to access the sensitive information due to it being compressed."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "ReverseEngineering"
    },
    {
        "id": "112f996e-a4b0-4ceb-8728-b114c8da84c9",
        "source": "apple_platform_security",
        "question": "Which of the following conditions must be met for an Apple Watch to unlock a paired iPhone when utilizing the Auto Unlock feature?",
        "choices": [
            "A: The iPhone must be within a range of 10 meters or less from the Apple Watch.",
            "B: The Apple Watch or iPhone must have been unlocked recently, or the Apple Watch must show signs of wearer's activity.",
            "C: The iPhone must have Wi-Fi and Bluetooth enabled, and the Apple Watch must be in Water Lock mode.",
            "D: The iPhone must have been unlocked using another method at least once after the Apple Watch was put on and unlocked."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "AutoUnlock"
    },
    {
        "id": "ca4752f9-18e1-493b-a100-ebfbf618af63",
        "source": "cwe",
        "question": "Which of the following code snippets demonstrates a practice that would introduce the weakness where a system inappropriately treats untrusted data as trusted, potentially leading to security vulnerabilities?",
        "choices": [
            "A: User input is sanitized using a whitelist approach, where only known good patterns are accepted, and all other inputs are rejected.",
            "B: Data retrieved from a third-party API is directly embedded into the system's database without any validation or sanitization.",
            "C: All user inputs undergo strict type checking and length validation before being used in the system.",
            "D: The system uses parameterized queries to prevent SQL injection when inserting user input into the database."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "UntrustedData"
    },
    {
        "id": "1b3e9fe0-b12f-48bd-91e0-21fbc117ec56",
        "source": "owasp_wstg",
        "question": "Examine the following HTML snippet from a web application and identify the element that could make the application vulnerable to a CSRF attack:",
        "choices": [
            "A: <script src='https://www.example.com/script.js'></script>",
            "B: <form action='https://www.example.com/settings' method='POST'></form>",
            "C: <img src='https://www.example.com/action' width='0' height='0'>",
            "D: <a href='https://www.example.com/profile'>View Profile</a>"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTML Tags"
    },
    {
        "id": "3dc59cd7-0cf0-44dc-9249-dc050be3651a",
        "source": "owasp_mastg",
        "question": "A mobile application developer is implementing security controls for transmitting sensitive data between the client and the server. They must choose a method that ensures confidentiality, integrity, and authenticity of the data. Which of the following options would be the most secure practice for achieving these goals?",
        "choices": [
            "A: Use of custom encryption algorithms tailored to the application's specific requirements.",
            "B: Implementation of industry-standard encryption protocols such as TLS with appropriate cipher suites.",
            "C: Application of base64 encoding to all data before transmission to obfuscate the content from eavesdroppers.",
            "D: Exclusive use of symmetric key encryption for all data in transit to optimize for performance."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "TLS"
    },
    {
        "id": "ac6733a7-2727-440d-af81-c18c6653475f",
        "source": "android_sec_doc",
        "question": "Why is it not recommended to enable Android Verified Boot (AVB) on A/B devices launched before Android 10 that are upgraded to Android 10 with PRODUCT_RETROFIT_DYNAMIC_PARTITIONS set to true?",
        "choices": [
            "A: Because the devices will not support the logical partition structure required for AVB.",
            "B: Because enabling AVB can lead to frequent system crashes due to incompatibility with the older hardware.",
            "C: Because system_other.img is not included in the over-the-air package, which can lead to verification errors after updates.",
            "D: Because enabling AVB will significantly degrade the device's performance."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "PRODUCT_RETROFIT_DYNAMIC_PARTITIONS"
    },
    {
        "id": "d01ebc53-33ce-49fd-b8a8-511af7d4f04d",
        "source": "windows_security",
        "question": "A system administrator is reviewing security logs on a Windows-based server and notices an entry indicating that a user's account was successfully logged on. The administrator wants to document this type of event according to its standard event ID for future auditing processes. Which of the following event IDs should the administrator associate with this type of security event?",
        "choices": [
            "A: 4672",
            "B: 4624",
            "C: 4634",
            "D: 4720"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Event ID 4624"
    },
    {
        "id": "775d5fc8-9c45-466c-b2b5-ca31fac4ae51",
        "source": "owasp_mastg",
        "question": "In the context of configuring a secure TLS connection for a mobile application, choosing the right cipher suite is critical. Which of the following cipher suites is an inappropriate choice due to known security vulnerabilities?",
        "choices": [
            "A: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "B: TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
            "C: TLS_RSA_WITH_3DES_EDE_CBC_SHA",
            "D: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Cipher suite vulnerabilities"
    },
    {
        "id": "79a82caa-85a2-49b1-9b20-f605eefd2b71",
        "source": "owasp_wstg",
        "question": "Imagine you are tasked with testing a web application's security. You suspect that the application may be vulnerable to SQL injection attacks. Which of the following data inputs should be thoroughly tested for SQL injection vulnerabilities? (Select two)",
        "choices": [
            "A: Server-side source code that is not exposed to the user",
            "B: Application parameters in query strings of GET requests",
            "C: The static content of the website, such as HTML or CSS files",
            "D: Session-related information, like user ID or cookies"
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "451e0b47-acbf-4ae8-8272-9be2f70ed2e1",
        "source": "attck",
        "question": "A cybersecurity analyst observes unusual network traffic and suspects a breach. Upon inspecting a compromised host, the analyst discovers that specific processes related to security tools are being enumerated. Which of the following malware or threat actor behaviors could be consistent with this activity, based on known tactics and techniques?",
        "choices": [
            "A: A malware strain that exclusively targets document files for encryption.",
            "B: A threat actor that uses the 'tasklist /v' command to obtain a list of detailed processes.",
            "C: A malware family that prioritizes propagation over gathering system information.",
            "D: A malware that is known to cause system disruptions by indiscriminately terminating processes."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Process Enumeration"
    },
    {
        "id": "5eb7ad00-5556-4921-8568-59ebf9ed00a1",
        "source": "attck",
        "question": "An incident response team has identified that an adversary has exploited a vulnerability within the system to gain higher levels of access. Which of the following vulnerabilities have been historically exploited for the purpose of privilege escalation? Select TWO.",
        "choices": [
            "A: CVE-2017-0263, which allows for remote code execution.",
            "B: CVE-2021-36934, exploited by APT29 to escalate privileges on a compromised host.",
            "C: CVE-2019-0859, used by ProLock to escalate privileges on a compromised host.",
            "D: CVE-2020-0601, a spoofing vulnerability in Windows CryptoAPI."
        ],
        "answer": "BC",
        "topics": [
            "Vulnerability",
            "PenTest"
        ],
        "keyword": "CVE-2021-36934"
    },
    {
        "id": "299c9e63-3e6d-4a8c-8e03-582c9eeefdff",
        "source": "cs161_textbook",
        "question": "In the TCP three-way handshake process, why are initial sequence numbers used instead of starting sequence numbers at 0? (Select all that apply.)",
        "choices": [
            "A: To provide reliable, in-order delivery of data streams.",
            "B: To reduce the risk of sequence number prediction and subsequent security vulnerabilities.",
            "C: To uniquely identify each TCP connection using the 5-tuple including the sequence numbers.",
            "D: To allow the sender and receiver to manage two sets of sequence numbers for each bytestream."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "TCP Handshake"
    },
    {
        "id": "529f203c-303b-4c55-8b88-054ba8eb4939",
        "source": "attck",
        "question": "In a penetration testing exercise, you have identified a piece of adversary malware that uses execution guardrails to ensure it only operates in specific environments. Which of the following scenarios would render the use of execution guardrails by the malware ineffective?",
        "choices": [
            "A: The environment exactly matches the expected conditions defined by the execution guardrails.",
            "B: The malware is executed on a system outside the adversary's intended target list.",
            "C: The adversary intentionally wants to affect a broad range of victims without targeting.",
            "D: The defensive measures include anti-virus and signature-based detection mechanisms."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Defense Evasion"
    },
    {
        "id": "7caca903-23ab-4716-b69f-d31994ae5fc0",
        "source": "cs161_textbook",
        "question": "In the context of enforcing access control policies, which of the following scenarios do NOT comply with the principle of complete mediation?",
        "choices": [
            "A: A system where a reference monitor checks all requests to a database before granting access.",
            "B: A web application that validates user permissions for each API call but not for static resources.",
            "C: An operating system that requires authentication for every user interaction with the file system.",
            "D: A firewall that examines all incoming and outgoing network traffic to a protected network."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "CompleteMediation"
    },
    {
        "id": "4cb8e0cb-3d99-4a9b-816f-ab14e647aee8",
        "source": "mozilla_security",
        "question": "If a web application developer wants to prevent the website from being framed on another site, potentially leading to clickjacking attacks, which CSP directive would best serve this purpose and why?",
        "choices": [
            "A: The 'default-src' directive, because it sets a default source list for all content types.",
            "B: The 'script-src' directive, since scripts are the most common vector for clickjacking.",
            "C: The 'frame-ancestors' directive, because it specifies valid parents that may embed a page.",
            "D: The 'base-uri' directive, as it restricts the base URL for relative URLs in the document."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "CSP frame-ancestors directive"
    },
    {
        "id": "81316b8b-a524-4c22-a043-56d6fa80fff8",
        "source": "android_sec_doc",
        "question": "In an Android system, a developer needs to change a system process to interact with a new, non-AOSP vendor component. Why is it not possible to extend attributes in `system/sepolicy/public` to accommodate this change, and where must the policy dictating this interaction be placed?",
        "choices": [
            "A: Attributes can be extended in `system/sepolicy/public` to label new objects in `/vendor`, and the policy should be placed in `system/sepolicy/public`.",
            "B: Attributes can be extended in `system/sepolicy/public` for future compatibility, but the policy must be in `device/manufacturer/device-name/sepolicy` to handle vendor-specific details.",
            "C: Attributes cannot be extended in `system/sepolicy/public` due to compatibility guarantees, and policy must be in `device/manufacturer/device-name/sepolicy` to cater to vendor-specific details.",
            "D: Extending attributes in `system/sepolicy/public` is allowed for direct labeling of `/vendor` objects, and the policy should be in `system/sepolicy/private` to use system-only types."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "attribute extensions"
    },
    {
        "id": "b5a1f2bb-95d3-4f26-8d4f-6da49899bd7f",
        "source": "windows_security",
        "question": "You are configuring the security settings for a company's Windows-based computers. You need to audit file system access across the entire network. Which of the following actions would best leverage the File System (Global Object Access Auditing) policy setting to achieve this goal?",
        "choices": [
            "A: Configure a global system access control list (SACL) for each individual computer manually.",
            "B: Implement a global SACL at the domain level to automatically propagate the settings to all computers.",
            "C: Disable all local SACLs to ensure that only the global SACL is used for auditing.",
            "D: Set up a local audit policy on each computer to override the global SACL."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Global System Access Control List (SACL)"
    },
    {
        "id": "810567f1-5d6f-4449-b613-efef35ec2a7f",
        "source": "attck",
        "question": "A security analyst is reviewing logs and observes that an adversary has gathered detailed system information from a compromised host. Based on your knowledge of known adversary behaviors, which of the following commands or tools are likely to have been used by the adversary to collect such information? Select two.",
        "choices": [
            "A: `systeminfo` command execution",
            "B: `Win32_ComputerSystem` query",
            "C: `gethostbyname` POSIX API call",
            "D: Execution of `GetlogicalDrives` command"
        ],
        "answer": "AB",
        "topics": [
            "PenTest"
        ],
        "keyword": "systeminfo"
    },
    {
        "id": "c93e6e77-3673-44e3-8cb5-2c3001a6614c",
        "source": "cs161_textbook",
        "question": "In the context of the ARP protocol, under what circumstance might a computer cache an ARP reply?",
        "choices": [
            "A: A computer will cache the ARP reply only if it has previously broadcasted a request for that specific IP address.",
            "B: A computer will cache an ARP reply only if it comes from a device within the same LAN.",
            "C: A computer will cache any received ARP replies, even if no broadcast request was ever made.",
            "D: A computer will cache an ARP reply only if it is authenticated by a central authority."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "ARP Caching"
    },
    {
        "id": "622f8775-31c6-4182-817c-2e17e2a8ce1b",
        "source": "attck",
        "question": "Why would an adversary choose to use Automated Collection tools on a compromised local system as opposed to manually searching for files of interest?",
        "choices": [
            "A: Automated tools can significantly reduce the time and effort required for data collection.",
            "B: Manual search is more effective at bypassing antivirus detection mechanisms.",
            "C: Automated tools are more likely to corrupt data during collection.",
            "D: Manual searches are required to access configuration files or local databases."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Automated Collection"
    },
    {
        "id": "a75576fb-3f96-43ba-a223-c4e9d36baa38",
        "source": "cwe",
        "question": "A system administrator is reviewing the security measures in place to protect the organization's network against the threat of replicating malicious code. Which of the following actions should the administrator prioritize to mitigate the risk of such threats?",
        "choices": [
            "A: Implementing strict access controls to limit user permissions to the minimum required to perform their job functions.",
            "B: Configuring the firewall to block all incoming traffic that does not conform to the organization's expected communication patterns.",
            "C: Deploying antivirus software that regularly scans for viruses or worms and updating the virus definitions frequently.",
            "D: Ensuring that software integrity checks are performed before installation by verifying digital signatures and checksums."
        ],
        "answer": "CD",
        "topics": [
            "Vulnerability",
            "SoftwareSecurity"
        ],
        "keyword": "Mitigation"
    },
    {
        "id": "5115a62f-f463-4795-baa7-71056d3dd58c",
        "source": "apple_platform_security",
        "question": "A software developer is examining the security mechanisms of the Rosetta 2 translation process on a Mac with Apple silicon. Which of the following statements accurately reflect the security measures associated with the ahead-of-time (AOT) translation process?",
        "choices": [
            "A: The AOT artefact's code directory hash must match the original x86_64 image's hash for execution to proceed.",
            "B: The Rosetta AOT translation process allows for variations in output based on when and on which device the translation was performed.",
            "C: Translated artefacts are stored in a Data Vault that is only accessible by the Rosetta service.",
            "D: The AOT translation artefacts are signed using a public key widely available to multiple userspace entities."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Rosetta"
    },
    {
        "id": "73776168-b535-4b61-8f5d-635ddfb9cfe3",
        "source": "apple_platform_security",
        "question": "On Macs with Apple silicon, Rosetta 2 enables the execution of x86_64 code. There are two types of translation processes: Just-in-time (JIT) and Ahead-of-time (AOT). Considering system security, what are the potential advantages and disadvantages associated with each type?",
        "choices": [
            "A: JIT translation might introduce a security risk due to runtime code generation, which could be exploited if the code hash verification mechanism fails",
            "B: AOT translation reduces the attack surface by limiting the time-accessible storage of translated artefacts and managing access through the Rosetta service",
            "C: JIT translation ensures that all translated code is stored in persistent storage, thereby increasing the likelihood of tampering",
            "D: AOT translation can potentially lead to information leakage since the translated artefacts are stored without any form of encryption"
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "rosetta-translation-security"
    },
    {
        "id": "44d869c1-5667-494b-ac96-58b2104ae5be",
        "source": "android_sec_doc",
        "question": "An Android device manufacturer is facing an issue where certain vendor scripts are failing during the boot process. The scripts are intended to write to system files that are not part of the stable system-vendor ABI. Which of the following actions should the manufacturer take to comply with the vendor init process and resolve the script failures?",
        "choices": [
            "A: Grant the scripts additional permissions in the system `vendor_init.te` file.",
            "B: Reimplement the commands in the scripts through stable interfaces according to the Treble guidelines.",
            "C: Mark the scripts with the `data_between_core_and_vendor_violators` attribute in the system `vendor_init.te` to bypass the restrictions.",
            "D: Remove the scripts from the `/vendor` partition to avoid the SELinux context `u:r:vendor_init:s0` restrictions."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "vendor_init.te"
    },
    {
        "id": "1d0968b5-fd80-4cdf-9ef1-5dd9c55c5794",
        "source": "cs161_textbook",
        "question": "In a security game described to evaluate the robustness of a MAC algorithm, Georgia is an adversary interacting with Reginald, who uses a secure MAC algorithm with a randomly chosen key K. Which of the following statements is true about Georgia's capabilities in this game?",
        "choices": [
            "A: Georgia can win the game by observing the MAC tag on a set of messages and using it to forge a valid tag for a new message.",
            "B: Georgia can win the game if she asks a verification query for a message that appeared in a previous generation query.",
            "C: Georgia cannot win the game by choosing a set of messages, obtaining their MACs, and using these to forge a MAC for a new message.",
            "D: Georgia can win the game if she successfully forges a tag for an unseen message without any interaction with Reginald."
        ],
        "answer": "C",
        "topics": [],
        "keyword": "forgery"
    },
    {
        "id": "b23351f0-03df-4ebe-b24b-9455acbdaaac",
        "source": "owasp_mastg",
        "question": "When conducting program analysis of a mobile application, what is a primary challenge of using symbolic execution, and which complementary technique is often combined to mitigate this specific issue?",
        "choices": [
            "A: Handling infinite execution trees; mitigated by concolic execution.",
            "B: Decompiling obfuscated binaries; mitigated by static analysis.",
            "C: Automating UI interaction testing; mitigated by dynamic execution.",
            "D: Interpreting network traffic; mitigated by emulator-based dynamic analysis."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Symbolic Execution"
    },
    {
        "id": "9a90fef8-40dc-4d57-ada9-983f5ac6a589",
        "source": "cwe",
        "question": "A developer is reviewing the error handling configuration for an ASP.NET web application to ensure that sensitive information is not exposed to users when an error occurs. Which of the following configurations would be most appropriate for securing the web application against information leakage through error messages?",
        "choices": [
            "A: Set <customErrors mode='Off' />, to ensure that all users receive the same error page without any sensitive information.",
            "B: Set <customErrors mode='On' defaultRedirect='GenericErrorPage.htm' />, to redirect users to a custom error page that does not expose sensitive information.",
            "C: Set <customErrors mode='RemoteOnly' />, so that remote users receive a generic error page, while local users can see detailed stack traces for debugging.",
            "D: Avoid using <customErrors> tag and rely on the server's default error handling, which is guaranteed to be secure."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "ErrorHandling"
    },
    {
        "id": "db81af78-ce94-484a-ab2d-c9b8d39ee39a",
        "source": "cs161_textbook",
        "question": "A web server at 'shop.example.co.uk' needs to set cookies that are secure and comply with standard cookie policies. Which of the following cookie domain settings are permissible according to standard cookie policies?",
        "choices": [
            "A: The server sets a cookie with domain 'shop.example.co.uk'.",
            "B: The server sets a cookie with domain 'example.co.uk'.",
            "C: The server sets a cookie with domain '.co.uk'.",
            "D: The server sets a cookie with domain '.uk'."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CookiePolicy"
    },
    {
        "id": "b14ac0ca-403c-4033-aa73-e03052f2f045",
        "source": "cs161_textbook",
        "question": "Which of the following changes to the URL `http://example.com:80/page` would result in a different origin, according to the same-origin policy?",
        "choices": [
            "A: Changing the protocol to `https` while keeping the rest of the URL unchanged.",
            "B: Changing the domain to `example.org` while keeping the rest of the URL unchanged.",
            "C: Adding a path to make it `http://example.com:80/page/new`.",
            "D: Changing the port to `443` while keeping the rest of the URL unchanged."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "URL changes"
    },
    {
        "id": "c2a3091c-a68b-4fbc-a603-62a62d2fd961",
        "source": "cwe",
        "question": "Consider the following code snippet that attempts to mitigate the vulnerability of misinterpreting input: \n\njavascript\nfunction validateInput(input) {\n  // Intended to prevent misinterpretation of input\n  if (/^[0-9]+$/g.test(input)) {\n    return true;\n  }\n  return false;\n}\n \n\nWhich alternative implementation would NOT be effective in preventing the misinterpretation of numeric input?",
        "choices": [
            "A: Using a strict regular expression that also validates the length of the input.",
            "B: Implementing a whitelist of acceptable characters and checking the input against it.",
            "C: Casting the input to an integer type without additional validation.",
            "D: Employing a parsing function that throws an exception for any non-numeric characters."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "InputValidation"
    },
    {
        "id": "9adb28c8-9811-47db-b3d9-3917ca9bc899",
        "source": "attck",
        "question": "An organization is aiming to mitigate the risk of adversaries using browser extensions to establish persistent access to their systems. Which of the following strategies could effectively reduce the likelihood of such an attack? (Choose two.)",
        "choices": [
            "A: Implement a browser extension allow or deny list that aligns with the security policy.",
            "B: Remove all browser extensions to prevent any possible security breaches.",
            "C: Train users to close all browser sessions after use to prevent malicious extensions from running.",
            "D: Disallow the use of any browser profiles or configuration files on user systems."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Browser Extension Security"
    },
    {
        "id": "b99d911a-1326-44b7-8063-0dc5a56d10ca",
        "source": "owasp_wstg",
        "question": "In the context of web application security, which of the following attack patterns could potentially allow an attacker to disrupt the session management process by exploiting cookies?",
        "choices": [
            "A: Using a brute-force attack to guess a session token if the cookie generation algorithm is sufficiently random.",
            "B: Overflowing a cookie to interfere with the application's memory, potentially leading to remote code execution.",
            "C: Employing cross-site scripting (XSS) to inject client-side scripts that are executed on user interaction.",
            "D: Encrypting the cookie data with a weak cipher to obfuscate the session token from the server."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Cookie Security"
    },
    {
        "id": "30591e53-996c-4fd4-b01a-0e4c65197731",
        "source": "cwe",
        "question": "In the design phase of a new application using Hibernate, which of the following options offers the least security benefit in protecting against SQL Injection?",
        "choices": [
            "A: Choosing a non-SQL style database that is not subject to SQL Injection.",
            "B: Ensuring security checks are performed on both the client side and server side.",
            "C: Using a rigorous allowlist to validate user inputs that may be used in SQL commands.",
            "D: Implementing client-side hashing of user inputs before sending them to the server."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategies"
    },
    {
        "id": "6b81c500-fc37-4e22-a0e9-cf3c3910e620",
        "source": "attck",
        "question": "When securing an enterprise network, an administrator must consider various best practices. Which of the following would be a benefit of implementing multi-factor authentication (MFA) for access to software deployment systems, and what would be a potential drawback of restricting the use of third-party software suites within the network?",
        "choices": [
            "A: Benefit: MFA could prevent unauthorized software installations. Drawback: Restricting software may limit necessary administrative functions.",
            "B: Benefit: MFA could make it easier for adversaries to gain access. Drawback: Restricting software may cause an increase in network traffic.",
            "C: Benefit: MFA could streamline the software deployment process. Drawback: Restricting software may improve the performance of the network.",
            "D: Benefit: MFA could allow for a single point of failure. Drawback: Restricting software may create a false sense of security."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Multi-factor Authentication"
    },
    {
        "id": "30381b2a-999e-4ef6-8e40-cb4fe5cc1dd2",
        "source": "windows_security",
        "question": "An organization is implementing a Zero Trust security model and needs to ensure devices attempting to access corporate resources are healthy and uncompromised. Which of the following steps are part of the Windows device health attestation process to validate a device's security state?",
        "choices": [
            "A: Checking if the TPM is disabled and if the device has been altered in any way.",
            "B: Validating that the security features are in the expected states as per the attestation service policy.",
            "C: Ensuring that user access is limited with just-in-time and just-enough-access, risk-based adaptive policies.",
            "D: Verifying the device’s health by assessing if the OS has been installed with unauthorized modifications."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Zero Trust"
    },
    {
        "id": "574b0ba4-03ea-418e-b80d-9a0bfb124888",
        "source": "owasp_wstg",
        "question": "A security auditor is reviewing the metadata of an OpenPGP Public Key during a web application security assessment. Which of the following statements about the metadata elements is correct?",
        "choices": [
            "A: The Key ID is a unique identifier that is always displayed as a 40-character hexadecimal value.",
            "B: The Key Size is an indicator of the key's strength and can determine how many characters the Key Fingerprint will have.",
            "C: User IDs associated with the key may include the name and email address of the owner, but never contain optional comments.",
            "D: Key Expiration Date is set to indicate when a key becomes invalid, adding a layer of security by limiting the key's validity period."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "OpenPGP Public Key"
    },
    {
        "id": "08946499-0a0d-444e-985f-a84484f767c5",
        "source": "d3fend",
        "question": "A company's IT department is tasked with securing a host system to prevent unauthorized USB devices from being used. To achieve this, they are considering different isolation techniques. Which technique would be most effective in restricting access to the system's input/output (IO) ports?",
        "choices": [
            "A: Executable Allowlisting",
            "B: IO Port Restriction",
            "C: DNS Allowlisting",
            "D: Mandatory Access Control"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "IO Port Restriction"
    },
    {
        "id": "a65068b5-093a-4654-9e28-43ce4d04e764",
        "source": "attck",
        "question": "In a penetration testing simulation, you are emulating an adversary attempting to perform host discovery without being detected by the target's intrusion detection systems. Which of the following commands would be the most effective for discretely gathering information about running processes, while minimizing the chance of detection?",
        "choices": [
            "A: Using the hostname command to list processes.",
            "B: Employing the tasklist command with verbose output options.",
            "C: Executing the systeminfo command for process information.",
            "D: Implementing an algorithm to hash process names and compare them to a list."
        ],
        "answer": "D",
        "topics": [
            "PenTest",
            "NetworkSecurity"
        ],
        "keyword": "Host Discovery"
    },
    {
        "id": "5c725539-498d-4f82-8319-916d2267a3e4",
        "source": "apple_platform_security",
        "question": "As an IT security consultant, you are tasked with recommending security measures for a company's fleet of Apple devices to protect user data from malicious attack. Which of the following measures would you advise the company to implement? Select all that apply.",
        "choices": [
            "A: Enabling Data Protection by setting up device passcodes on iOS and iPadOS devices.",
            "B: Utilizing FileVault volume encryption technology on Intel-based Macs.",
            "C: Enforcing a policy through MDM to disable the Erase Data option after 10 consecutive incorrect passcode attempts on iOS devices.",
            "D: Implementing escalating time delays after incorrect password attempts on Macs with Apple silicon or a T2 chip."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "DeviceSecurity"
    },
    {
        "id": "2558351c-d550-4900-a37a-e6723e2c6092",
        "source": "windows_security",
        "question": "A system administrator needs to perform a system backup and ensure that all files, regardless of their access control list (ACL), are included in the backup. The administrator also wants to initiate a process that replaces the default token associated with a started subprocess. Which of the following privileges must the administrator have? (Select two.)",
        "choices": [
            "A: SeBackupPrivilege",
            "B: SeCreatePagefilePrivilege",
            "C: SeAssignPrimaryTokenPrivilege",
            "D: SeChangeNotifyPrivilege"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "User Privileges"
    },
    {
        "id": "0b81ec5a-6811-4105-9c80-2fdc713cb3ca",
        "source": "apple_platform_security",
        "question": "You are setting up a smart home environment using Apple's HomeKit technology. You must ensure that the communication between your Apple TV, which acts as a home hub, and other HomeKit accessories is secure. Considering Apple's security framework, which of the following measures would you apply to ensure the security of your smart home setup?",
        "choices": [
            "A: Use randomly generated AES256 keys for encrypting video streams between IP cameras and the home hub.",
            "B: Configure the HomeKit router using the manufacturer’s app to validate user access before adding it to the Home app.",
            "C: Utilize a common Wi-Fi password for all HomeKit accessories to simplify the network setup process.",
            "D: Store HomeKit data on the device using the Data Protection class 'Protected Until First User Authentication' and encrypt it with keys derived from the user's identity keys and a random nonce."
        ],
        "answer": "ABD",
        "topics": [
            "NetworkSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HomeKit"
    },
    {
        "id": "0bb77b63-5dbd-46aa-8405-cc32a5b5595c",
        "source": "cwe",
        "question": "Imagine you are an architect designing the directory structure for a web application. You need to store library, include, and utility files in a way that minimizes the attack surface and prevents attackers from directly requesting these files. Which of the following approaches best aligns with the recommended strategy for attack surface reduction?",
        "choices": [
            "A: Store library files in the web document root and rely on the web server's default configuration to prevent direct access.",
            "B: Store library files outside of the web document root, or in a separate directory with access control to prevent direct file requests.",
            "C: Store utility files in a publicly accessible directory and use custom scripts to intercept and validate direct file requests.",
            "D: Store include files in the web document root with no additional access control, assuming that attackers will not guess the file paths."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "AttackSurfaceReduction"
    },
    {
        "id": "4cf3060a-df5a-468c-a369-32685d31e9d0",
        "source": "attck",
        "question": "In the context of cybersecurity, network sniffing is a technique that can be utilized by adversaries to gather various types of data from a target network. Which of the following data types can typically be captured by an adversary using network sniffing?",
        "choices": [
            "A: Data in transit over the network, including unencrypted user credentials.",
            "B: Data stored on encrypted hard drives without the decryption key.",
            "C: Data printed to secure network printers.",
            "D: Data processed within a CPU before it is sent through any network."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Sniffing"
    },
    {
        "id": "5579b4d4-4bde-4b5b-9101-7eb75eb0fa98",
        "source": "attck",
        "question": "A software development company recently discovered that one of its developers accidentally committed sensitive information, including API keys, to a public code repository. Which of the following steps should the company take to mitigate this security issue? (Select TWO.)",
        "choices": [
            "A: Instruct the developer to only remove the sensitive information from the current version of the code.",
            "B: Scan the public code repository for exposed credentials and ensure any leaked information is removed from the commit history.",
            "C: Advise application developers to be cautious about publishing sensitive information to public code repositories in the future.",
            "D: Encrypt all sensitive data in the code repository to prevent unauthorized access, regardless of its public status."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "commit history"
    },
    {
        "id": "ba19f695-ba94-4673-9ed4-13ece458ec0e",
        "source": "windows_security",
        "question": "In a Windows Server environment, what is the primary security benefit of configuring the 'Domain controller: LDAP server signing requirements' policy to 'Require signature', and what is the potential drawback of this configuration?",
        "choices": [
            "A: Benefit: Ensures all LDAP traffic is encrypted; Drawback: Increases computational overhead on the server.",
            "B: Benefit: Makes man-in-the-middle attacks more difficult; Drawback: Clients without LDAP signing capability cannot execute queries.",
            "C: Benefit: Allows for default settings to be applied; Drawback: Potential loss of connection with non-compliant servers.",
            "D: Benefit: Enables clients to request data signing; Drawback: Can cause significant network latency issues."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "LDAP server signing"
    },
    {
        "id": "29ae21ee-6dd6-4875-b1ef-0a646f852e48",
        "source": "owasp_wstg",
        "question": "A security analyst performs a network scan to identify potentially vulnerable services on a web server. The output below shows the services running on the target IP address:\n\nbash\nPORT      STATE SERVICE     VERSION\n80/tcp    open  http        Apache httpd 2.4.29\n443/tcp   open  ssl/http    nginx 1.14.0\n3306/tcp  open  mysql       MySQL 5.7.22-0ubuntu0.17.10.1\n8080/tcp  open  http-proxy  Squid http proxy 3.5.27\n\nBased on this output, which of the following actions should the analyst prioritize to mitigate potential security risks?",
        "choices": [
            "A: Verify the Squid http proxy configuration on port 8080 to ensure it is not allowing anonymous access.",
            "B: Ignore the Apache server on port 80 as it is running on the standard HTTP port and poses no risk.",
            "C: Focus on the MySQL service on port 3306 as it is not a web service and can be secured later.",
            "D: Inspect the nginx server on port 443 as it is using SSL and therefore secure by default."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Network Scanning"
    },
    {
        "id": "615166a7-4a9b-4ecb-9418-004d5ccc6478",
        "source": "cs161_textbook",
        "question": "Considering the types of adversaries described (Off-path, On-path, and In-path), which of the following defense mechanisms would be most effective in protecting a TCP communication from packet injection attacks?",
        "choices": [
            "A: Implementing encrypted communication using TLS to prevent adversaries from understanding or manipulating the sequence numbers in TCP packets.",
            "B: Using a firewall to block all incoming traffic from untrusted sources, significantly reducing the risk of off-path adversaries spoofing IP addresses.",
            "C: Deploying intrusion detection systems that can identify unusual traffic patterns potentially caused by adversaries injecting TCP packets.",
            "D: Enforcing strict routing controls to ensure that all TCP packets follow a predetermined path, making it harder for on-path adversaries to intercept the communication."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "Defense Mechanisms"
    },
    {
        "id": "1da30ab2-09c0-4d05-af84-b21df6cfb7a6",
        "source": "cs161_textbook",
        "question": "You are tasked with choosing a hash function to pair with a symmetric encryption algorithm for a high-security system. If the encryption algorithm uses a 256-bit key, which hash function would you recommend, considering the computational difficulty for an attacker to break the encryption as well as the hash function's security?",
        "choices": [
            "A: SHA-256, because it offers a good balance between security and computational cost.",
            "B: SHA-512, because the larger output size offers the highest level of security.",
            "C: SHA3-512, because it provides security against length extension attacks and a large output size.",
            "D: SHA-384, as it provides sufficient security while acknowledging that an impractically high computational cost is already involved with breaking a 256-bit key."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "encryption"
    },
    {
        "id": "a331d117-13c8-4e6f-a8f3-ef6251a605ed",
        "source": "owasp_wstg",
        "question": "In the context of web security, which of the following statements accurately describes a potential issue with the session management during user logout?",
        "choices": [
            "A: Proper invalidation of server-side session state ensures that a session cannot be hijacked even if the session token is reused.",
            "B: Sessions that rely solely on session cookies without server-side tracking are secure because the cookie is removed from the browser upon logout.",
            "C: Unclear or ambiguous logout functions can cause users to mistrust the logout functionality, potentially leading to increased session vulnerabilities.",
            "D: Using a single sign-on (SSO) system guarantees that all sessions across different applications will be terminated simultaneously upon user logout."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Session Management"
    },
    {
        "id": "f68b1d40-3635-441e-94ec-97d0181341c5",
        "source": "apple_platform_security",
        "question": "Which of the following statements accurately describe the features and their respective benefits in Apple’s security architecture? Select all that apply.",
        "choices": [
            "A: Data Vault enforces kernel-based access control to protect data even within sandboxed apps by utilizing key-value pair mechanisms.",
            "B: Effaceable Storage provides an area for storing cryptographic keys which supports fast wipe and forward security, despite not offering physical possession protection.",
            "C: Exclusively using Device Firmware Upgrade (DFU) mode for recovery ensures that all data remains encrypted until the operating system is reinstalled.",
            "D: Elliptic Curve Diffie-Hellman Exchange Ephemeral (ECDHE) allows two parties to establish a shared secret key in a way that is resistant to eavesdropping."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Apple Security"
    },
    {
        "id": "c7fd5811-fc17-4d96-821e-30a6bd36718e",
        "source": "cwe",
        "question": "Why should an application not rely solely on removing dangerous characters like '../' from user input as its mitigation strategy against path traversal vulnerabilities?",
        "choices": [
            "A: This approach is equivalent to a denylist which might not be comprehensive and could miss certain attack vectors due to encoding issues or alternative traversal sequences.",
            "B: Special characters like '../' are needed for normal application operation and cannot be removed without impacting functionality.",
            "C: Only removing dangerous characters does not enforce strict input validation on length, type, or acceptable values as required.",
            "D: This method will cause the application to be incompatible with non-English file systems that do not use '../' as a traversal sequence."
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "Denylist"
    },
    {
        "id": "dccc6da5-bc6b-4754-ad61-19cc3ab33577",
        "source": "cwe",
        "question": "In a newly developed web application, the engineering team has identified several input handling issues during the code review process. Which of the following scenarios are likely instances of improper handling of structural elements within the application?",
        "choices": [
            "A: The application's parser fails to validate the nesting and syntax of JSON payloads, leading to erratic behavior when malformed JSON is received.",
            "B: User input for file paths is directly concatenated with system directories without sanitization, potentially leading to directory traversal attacks.",
            "C: When processing XML data, the application does not check for the presence of external entity references, which could lead to an XML External Entity (XXE) attack.",
            "D: The application does not properly escape user-supplied SQL queries, making it susceptible to SQL injection attacks."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "StructuralElementsHandling"
    },
    {
        "id": "333b212e-2827-4e43-ac61-b39f235b2bdc",
        "source": "attck",
        "question": "An adversary is in the process of gathering information about a victim's hosts. Why would details such as operating system and language configuration be particularly valuable to the adversary?",
        "choices": [
            "A: These details can reveal opportunities for further reconnaissance and exploitation.",
            "B: The language configuration is most useful for crafting culturally targeted social engineering attacks.",
            "C: Operating system details are only valuable for bragging rights in the adversary community.",
            "D: Such information is solely collected to sell to third-party advertisers for profit."
        ],
        "answer": "A",
        "topics": [
            "PenTest",
            "ApplicationSecurity"
        ],
        "keyword": "Host Information"
    },
    {
        "id": "9302fef6-ae80-47cc-8905-14b0419df159",
        "source": "owasp_mastg",
        "question": "You are evaluating the security of a newly developed iOS application that utilizes WebViews to display content. The application uses `WKWebView` for rendering web content and has implemented a JavaScript bridge for communication between the web content and the native Swift code. During your assessment, which of the following methods would you consider as a secure approach to enable communication from JavaScript to the native application environment?",
        "choices": [
            "A: Allowing direct reference to the `JSContext` of a `WKWebView` to enable JavaScript to call native Swift functions directly.",
            "B: Using the `add(_ scriptMessageHandler:name:)` method to set up a message handler that allows JavaScript to send messages to the native app.",
            "C: Implementing a custom `JSExport`-inherited protocol to map JavaScript objects directly to native Swift objects.",
            "D: Enabling the `get-task-allowed` entitlement on the app to inspect the contents of the WebView and facilitate communication."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "WKWebView"
    },
    {
        "id": "92ea1501-42f9-4df6-8377-a80b4880eb52",
        "source": "cwe",
        "question": "Given an application that must handle sensitive information in memory, which of the following code snippets correctly implements a mechanism to prevent sensitive data from being swapped to disk, and which one does not account for the specific platform limitations detailed in the description?",
        "choices": [
            "A: On a Linux system, a call to mlock() is made for sensitive data pages, followed by error checking to handle the case when locking fails.",
            "B: For a Windows 98 application, VirtualLock() is used to ensure sensitive data will not be swapped to disk, without any return value verification.",
            "C: On a POSIX-compliant system, mlock() is used for sensitive data with the assumption that it will not be swapped to disk, and supervisor privileges are not considered.",
            "D: An application uses VirtualLock() on a modern Windows system and verifies the function's success via return value, accounting for the possibility of failure."
        ],
        "answer": "AD",
        "topics": [
            "MemorySafety",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "MemoryLocking"
    },
    {
        "id": "c69edb30-6eb3-4c19-893d-5c946e115163",
        "source": "owasp_wstg",
        "question": "A web application uses form-based authentication and session management that relies on client-side cookies for maintaining user sessions. An attacker aims to exploit a Cross-Site Request Forgery (CSRF) vulnerability in this application by crafting a malicious HTML page. Which of the following scenarios is most likely to result in a successful CSRF attack?",
        "choices": [
            "A: The attacker convinces a logged-in user to visit an HTML page with an embedded `img` tag pointing to a sensitive action on the target application.",
            "B: The attacker sends an email with a link that, when clicked by the user, triggers a download of a PDF file containing the attack code.",
            "C: The web application uses HTTP POST requests with JSON payloads for browser to server communication, requiring the attacker to craft a self-submitting form with a JSON payload and the correct `enctype`.",
            "D: The application implements server-side CSRF tokens, and the attacker tries to circumvent this by including the correct token value in their malicious HTML page."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CSRF"
    },
    {
        "id": "9492d4a7-0b0c-4dc0-bfd3-c3c355e1f0db",
        "source": "mit6.858",
        "question": "Consider the challenges associated with securing the interface between an application and its libraries in a web browser context. What are the potential consequences of not properly sandboxing a library within a large application like Firefox?",
        "choices": [
            "A: If a library is not properly sandboxed, it may cause the application to lose its ability to render web pages correctly.",
            "B: A compromised library might be able to cause out-of-bounds memory reads or writes in code outside the sandbox.",
            "C: Unsandboxed libraries could lead to the application inadvertently leaking Address Space Layout Randomization (ASLR) information to an untrusted library.",
            "D: Failure to sandbox a library could lead to double-fetch bugs where a compromised library can modify a value between two checks in the application code."
        ],
        "answer": "BCD",
        "topics": [
            "ApplicationSecurity",
            "MemorySafety"
        ],
        "keyword": "sandboxing"
    },
    {
        "id": "ea72fe54-c3c6-4492-9dc3-63d0b317342c",
        "source": "owasp_wstg",
        "question": "A penetration tester discovers that a web application is leaking sensitive data such as authentication tokens and session IDs through an XSSI vulnerability. To mitigate this vulnerability, which of the following methods would be most effective?",
        "choices": [
            "A: Implementing strict input validation on all user-supplied data to prevent malicious scripts from running.",
            "B: Enforcing Content Security Policy (CSP) headers to restrict the sources from which scripts can be loaded.",
            "C: Upgrading the browser to the latest version to patch any old vulnerabilities that allow data leakage.",
            "D: Using only POST requests for all operations, as they are not susceptible to XSSI attacks."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Content Security Policy (CSP)"
    },
    {
        "id": "c7b2e845-8d3f-44cd-81d7-8c537f43a87e",
        "source": "owasp_wstg",
        "question": "Which of the following measures does NOT strengthen the protection against sensitive information being sent via unencrypted channels?",
        "choices": [
            "A: Implementing HTTP Strict Transport Security (HSTS) to enforce secure connections.",
            "B: Setting the 'Secure' flag on cookies to ensure they are only sent over HTTPS.",
            "C: Hardcoding sensitive credentials in the source code for convenience.",
            "D: Utilizing a service like Let's Encrypt to obtain a free SSL/TLS certificate."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Unencrypted Channels"
    },
    {
        "id": "91d52b1c-a42f-4d3a-921b-6b09b8815b52",
        "source": "attck",
        "question": "A software company is enhancing its security posture after an incident where adversaries stole OAuth access tokens by phishing. They are evaluating different mitigation strategies and their associated trade-offs. Which of the following strategies would not be effective in preventing the theft of application access tokens and what is a misleading reason for its ineffectiveness?",
        "choices": [
            "A: Blocking end-user consent to OAuth applications, falsely claimed to have no impact on user experience and productivity.",
            "B: Using audit reports to identify privilege escalation actions, inaccurately deemed ineffective due to the supposed inability to detect real-time attacks.",
            "C: Restricting web-based content to prevent phishing, incorrectly criticized for reducing the attack surface and thus the potential for token theft.",
            "D: Allowing unrestricted user registration of applications, mistakenly justified by the belief that users are knowledgeable enough to avoid malicious applications."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Phishing Prevention"
    },
    {
        "id": "90564c74-65ec-4762-af8a-2cad52205b30",
        "source": "cs161_textbook",
        "question": "You are tasked with designing a network communication system that ensures reliability and security in message transmissions. Given the limitations of the lower layers of the internet, such as the lack of connection concepts and only best-effort delivery by IP without error handling, which of the following layers or protocols would you integrate into your design to achieve the desired reliability and security? Select all that apply.",
        "choices": [
            "A: Transport Layer with TCP to establish reliable connections and manage packet order and retransmissions.",
            "B: Data Link Layer with MAC addresses to ensure secure and direct device-to-device communication.",
            "C: Application Layer with TLS to provide cryptographic protocols for secure data transmission.",
            "D: Network Layer with routers implementing Quality of Service (QoS) to prioritize certain types of traffic."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Networking"
    },
    {
        "id": "d9b3ef6c-1112-4286-8c75-30b0a0e09c46",
        "source": "cwe",
        "question": "An application is designed to interact with both a public internet forum and an internal messaging system. The developer has implemented a feature where certain posts from the public forum can be relayed automatically to the internal messaging system based on keywords. Which of the following scenarios could potentially introduce a vulnerability due to incorrect resource transfer between spheres?",
        "choices": [
            "A: The application uses a whitelist of keywords to filter which posts are relayed to the internal system.",
            "B: The application allows users to embed scripts in their messages, which are then executed by the internal messaging system.",
            "C: The application includes a feature to automatically translate posts from the public forum before posting them to the internal messaging system.",
            "D: The application enforces strict access controls, only allowing authorized employees to view messages relayed from the public forum."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ResourceTransfer"
    },
    {
        "id": "1833052d-7d27-407a-a2df-d13e11531b31",
        "source": "attck",
        "question": "An adversary is attempting to evade file system monitoring on a Windows system by directly accessing logical volumes to read and write files. Which of the following actions could potentially prevent or detect this behavior? (Select TWO)",
        "choices": [
            "A: Deploying network intrusion detection systems to monitor unusual traffic patterns",
            "B: Configuring endpoint security solutions to block behaviors related to backup creation",
            "C: Restricting handle opens on volumes and monitoring for direct data collection",
            "D: Enforcing strong password policies and two-factor authentication"
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Direct Volume Access"
    },
    {
        "id": "1786b19b-0206-4fa9-9727-a141b172cf66",
        "source": "attck",
        "question": "An adversary group is planning to compromise a corporate network by targeting common client applications. Which of the following approaches could they utilize, and what is a potential advantage of that method?",
        "choices": [
            "A: Exploiting vulnerabilities in web browsers, which often do not require an action by the user for the exploit to be executed.",
            "B: Sending phishing emails with malicious attachments that exploit server-side applications, ensuring immediate system-wide compromise.",
            "C: Targeting vulnerabilities in an obsolete encryption algorithm which the corporation uses, to intercept and decrypt all network traffic.",
            "D: Conducting a brute-force attack on user passwords, leveraging the fact that users often have weak passwords."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Exploitation for Client Execution"
    },
    {
        "id": "ae5dbe43-7d2b-43f8-b7ca-f331733d79f8",
        "source": "owasp_wstg",
        "question": "A web application uses the `postMessage()` method to enable communication between a page hosted on `https://www.primarydomain.com` and an iframe from `https://www.secondarydomain.com`. To ensure secure message exchange, what practices should the application implement? (Select two correct answers)",
        "choices": [
            "A: Validate the origin of the message to match exactly `https://www.secondarydomain.com` before processing.",
            "B: Use `*` as the target origin in the `postMessage()` method to allow flexibility in message reception.",
            "C: Ensure messages are only accepted over HTTPS to prevent man-in-the-middle attacks.",
            "D: Accept messages from `http://www.secondarydomain.com` since the schema does not influence origin validation."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "postMessage()"
    },
    {
        "id": "43f79df3-a7b6-4321-bb40-9b38f98c8bb1",
        "source": "attck",
        "question": "As a security engineer, you are tasked with hardening the security of a containerized environment against potential adversarial abuse of container administration services. Which of the following strategies would be effective in mitigating the risk of adversaries executing unauthorized commands within a container? (Select TWO.)",
        "choices": [
            "A: Installing antivirus software on all containers to automatically detect and prevent execution of malicious scripts.",
            "B: Using read-only containers and minimal images to prevent the execution of commands where possible.",
            "C: Disabling unauthenticated access to the Docker API and Kubernetes API Server and requiring secure port access via TLS.",
            "D: Allowing containers to run as root by default to enable thorough monitoring of container activities."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "container administration service"
    },
    {
        "id": "97cc97ec-d867-418e-8e9d-f102e52ca82f",
        "source": "android_sec_doc",
        "question": "A security researcher identifies a vulnerability in Android's lock screen that can be exploited to unlock the device, but the attack requires physical access to the device internals while the device is on and has previously been unlocked. What will be the adjusted severity rating for this vulnerability according to the Android security guidelines?",
        "choices": [
            "A: High Severity",
            "B: Moderate Severity",
            "C: Low Severity",
            "D: Negligible Security Impact"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Physical Access Attack"
    },
    {
        "id": "c2dc2a1d-45c9-4a49-a513-a41b8d257c07",
        "source": "attck",
        "question": "An adversary has staged a digital certificate on a server under their control. What is the primary purpose of this action, and what are the potential advantages and disadvantages of using web services like GitHub for staging capabilities?",
        "choices": [
            "A: To encrypt command and control traffic; web services offer easy application provisioning but can be easily scanned for known malicious content.",
            "B: To disrupt the SSL/TLS handshake; web services are harder to detect but offer limited storage capacity.",
            "C: To create a backup for compromised data; web services provide anonymity but are susceptible to takedown requests.",
            "D: To facilitate secure email communication; web services have high uptime but can lead to quick exposure of the adversarial activities."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Digital Certificate"
    },
    {
        "id": "a96ef1b8-a510-4c3f-aa1e-1b03043b9367",
        "source": "cwe",
        "question": "A developer is creating a file backup system that copies sensitive files from one directory to another. The system first initiates the copy, then sets the file permissions after the copy is complete. Considering best security practices, which of the following could lead to a vulnerability during the copying process?",
        "choices": [
            "A: The file permissions are replicated accurately in the new location after the copying process.",
            "B: Files are copied one at a time to decrease the load on the system.",
            "C: The copied files are temporarily accessible with default permissions until the copy is complete.",
            "D: The system uses a high-speed copying mechanism to minimize the time window of the copying process."
        ],
        "answer": "C",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "RaceCondition"
    },
    {
        "id": "a83fcb0c-2588-4317-8692-9a5ddbf5b456",
        "source": "owasp_wstg",
        "question": "You are performing a security review for a large web application's front-end codebase. The development team has used various technologies for performance optimization, including Sass, SCSS, and webpack. They are considering whether they should include source map files in the production environment to aid in debugging. What would be the most secure recommendation regarding the presence of source map files in the production environment?",
        "choices": [
            "A: Include the source map files in the production environment to facilitate debugging by developers and users.",
            "B: Exclude source map files from the production environment to prevent making the source code human-readable.",
            "C: Only include source map files for CSS but not JavaScript to balance security and debuggability.",
            "D: Deploy source map files to a public repository so they can be accessed as needed without including them in the production environment."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Source Map Files"
    },
    {
        "id": "ed0f7030-e600-497e-9997-b5d7035d5b09",
        "source": "cs161_textbook",
        "question": "Why is a basic variant of RSA encryption, which is deterministic, not considered IND-CPA secure?",
        "choices": [
            "A: Because it does not use a symmetric key for encryption.",
            "B: Because deterministic encryption allows for patterns to be discerned when the same message is encrypted multiple times.",
            "C: Because it relies on factorizing large primes which is computationally easy.",
            "D: Because it encrypts both the message and the random key, making it susceptible to attacks."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IND-CPA"
    },
    {
        "id": "5e51e197-b740-4438-89e8-b59a5ef2f1de",
        "source": "windows_security",
        "question": "A company is deploying a new set of Windows-based workstations and wants to ensure top-notch security against various cyber threats. Which TWO silicon-assisted security features should be considered essential to protect against threats like memory corruption, zero-day exploits, and unauthorized kernel-mode code execution?",
        "choices": [
            "A: Virtualization-based security (VBS) for isolated secure kernel operation",
            "B: Hypervisor-protected Code Integrity (HVCI) for kernel-mode code validation",
            "C: Hardware-enforced stack protection for safeguarding against return address hijacking",
            "D: Kernel Direct Memory Access (DMA) protection for preventing USB drive encryption"
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Silicon-assisted security"
    },
    {
        "id": "22c281bb-e34e-4d52-b84d-0aac010d48a8",
        "source": "cwe",
        "question": "A software development team is assessing different programming languages for a new project that involves managing a significant amount of system resources. Which of the following language features or strategies would be most effective in mitigating the risk of CWE 772: Missing Release of Resource after Effective Lifetime?",
        "choices": [
            "A: Choosing a language that performs automatic garbage collection to manage memory for objects that have been deallocated.",
            "B: Selecting a language that requires manual memory management and careful tracking of resource allocation and deallocation.",
            "C: Opting for a language that provides detailed error messages and logging features to track resource usage.",
            "D: Using a language that supports setting resource limits at runtime through system calls such as setrlimit() and getrlimit()."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "LanguageSelection"
    },
    {
        "id": "afa21780-9fa1-48e8-87df-1c94b8dee028",
        "source": "attck",
        "question": "A financial institution has identified a potential security threat where unauthorized hardware devices could be connected to their network to initiate cyber attacks. As a cybersecurity consultant, you are asked to recommend practices that will mitigate this risk. Which of the following strategies would be most effective in preventing unauthorized hardware additions from gaining access to the institution's network?",
        "choices": [
            "A: Implement device certificates and the 802.1x standard to establish network access control policies.",
            "B: Increase the frequency of changing network passwords to prevent hardware from establishing a persistent connection.",
            "C: Deploy additional antivirus software on all endpoints to scan for malicious hardware.",
            "D: Enforce endpoint security configuration to block unknown devices and set up monitoring agents to alert on unauthorized hardware installation."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "802.1x standard"
    },
    {
        "id": "3bc438da-9915-41ac-bca2-57db74a96db3",
        "source": "apple_platform_security",
        "question": "As a cybersecurity consultant, you are reviewing the architectural design of the Apple File System (APFS) and its implementation in macOS. Evaluate the following statements about the purpose and characteristics of the various APFS volumes in macOS 10.15 or later and select the correct ones. (Choose all that apply)",
        "choices": [
            "A: The Preboot volume contains the necessary files to start up the Mac and therefore is encrypted to protect boot-related data.",
            "B: The VM volume is used to store encrypted swap files and is unencrypted because it needs to be accessible for system performance purposes.",
            "C: The Recovery volume must be accessible without unlocking a system volume, facilitating secure recovery operations without exposing sensitive data.",
            "D: The Data volume contains user-installed apps and user data, which is kept separate from the System volume to prevent unauthorized modification."
        ],
        "answer": "BCD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "APFSVolumes"
    },
    {
        "id": "0f1c2b65-1831-4b26-8f1d-95ecc6ef4eb6",
        "source": "cwe",
        "question": "An application is designed to restrict file access within a certain directory. The developer has implemented a security control to filter out '../' sequences to prevent path traversal attacks. However, an attacker attempts to access files outside the restricted directory. Which of the following input sequences could potentially bypass the implemented security control and result in a path traversal vulnerability?",
        "choices": [
            "A: Using the sequence '.../...//' to collapse into '../'",
            "B: Employing the sequence '/././' to navigate within the current directory",
            "C: Applying the sequence '////' to denote the root directory",
            "D: Inserting the sequence '%2e%2e%2f' to perform URL-encoded traversal"
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "PathTraversal"
    },
    {
        "id": "589aabad-eb7d-4728-a9b0-a4b22bb339ea",
        "source": "windows_security",
        "question": "A security analyst claims that in order to investigate a Per User Audit Policy change, it is only necessary to review the Event ID 4912 if the 'Audit Policy Change' sub-category settings are configured to log such events. Is this claim accurate, and why?",
        "choices": [
            "A: Yes, because Event ID 4912 is only logged when 'Audit Policy Change' settings are configured to log Per User Audit Policy changes.",
            "B: No, because Event ID 4912 is logged regardless of the 'Audit Policy Change' sub-category settings.",
            "C: Yes, since the 'Audit Policy Change' sub-category settings control the logging of all security-related events.",
            "D: No, because only changes to system-wide policies are logged, and per-user policies are not included in the audit logs."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Audit Policy"
    },
    {
        "id": "cf57834a-4128-45df-8f46-a24ee0e74cff",
        "source": "mit6.858",
        "question": "When using the Baggy Bounds technique for memory safety, which of the following scenarios might still allow a buffer overflow to occur or might cause Baggy Bounds to panic, even though the C code is compliant with its specifications?",
        "choices": [
            "A: When a pointer arithmetic operation results in a pointer pointing to a location within an allocated array but beyond the intended bounds of a subarray.",
            "B: When a pointer is cast to an integer for comparison purposes, and the OOB bit affects the result of the comparison.",
            "C: When a developer dereferences a pointer that has been correctly reassigned to point to the middle of an allocated object without changing the OOB bit.",
            "D: When a pointer arithmetic operation results in a pointer that points exactly slot_size/2 bytes away from the boundary of its original object."
        ],
        "answer": "AB",
        "topics": [],
        "keyword": "BufferOverflow"
    },
    {
        "id": "4275b9af-b012-4410-b9b3-f42621f2de2f",
        "source": "owasp_wstg",
        "question": "You are assessing the security of a web application and discover that it relies on a serverless architecture with functions provided by AWS Lambda. Considering this architecture, which of the following statements are true regarding the security testing process?",
        "choices": [
            "A: Testing for server configuration issues is still in scope since the serverless model relies on traditional server management.",
            "B: Identifying specific AWS Lambda functions can be done by looking for HTTP headers such as 'X-Amz-Invocation-Type'.",
            "C: Serverless architectures eliminate the risk of server-side vulnerabilities, removing the need for any backend testing.",
            "D: Infrastructure testing, such as for the server and network configurations, is likely out of scope due to the managed nature of serverless platforms."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Serverless Architecture"
    },
    {
        "id": "bf270675-a5df-48ca-ada4-6faf02245711",
        "source": "cwe",
        "question": "An e-commerce application allows users to search for products using various filters. The search feature is designed to accept only alphanumeric characters and ignore any special characters entered. What are the potential weaknesses of this input validation approach? Choose all that apply.",
        "choices": [
            "A: The approach may not anticipate special character combinations that represent inconsistent special elements.",
            "B: Alphanumeric filters might inadvertently block legitimate searches that include non-English characters or special product codes.",
            "C: The application might be exposed to SQL injection attacks due to the exclusion of special characters.",
            "D: Denylists are not used, possibly allowing some forms of specially crafted inputs that could bypass validation."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "InputHandlingWeakness"
    },
    {
        "id": "eda33693-5b7e-43bc-a401-24be17917cb2",
        "source": "cs161_textbook",
        "question": "A company's network traffic pattern is highly irregular and user behavior is unpredictable. Which intrusion detection strategy would likely be least effective in this environment?",
        "choices": [
            "A: Signature-based detection, due to the variability of attack vectors.",
            "B: Anomaly-based detection, as it would generate too many false positives.",
            "C: Stateful protocol analysis, if the protocols used are highly variable.",
            "D: Heuristic detection based on statistical models of typical network traffic."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DetectionEffectiveness"
    },
    {
        "id": "7c646d5e-d9bf-4e12-ad42-4f82ba1d8f7e",
        "source": "windows_security",
        "question": "You are reviewing security logs and notice several entries with Event ID 4664, indicating successful creation of NTFS hard links. Based on best practices for security monitoring, which of the following actions should you consider? (Select two)",
        "choices": [
            "A: Investigate the events, as the creation of NTFS hard links is an unusual behavior and could signal malicious activity.",
            "B: Ignore the events, since NTFS hard link creation is a common and benign system operation.",
            "C: Correlate the events with other security events using the Logon ID to understand the context of the action.",
            "D: Immediately revoke the permissions of the user account involved, as it is likely compromised."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Event ID 4664"
    },
    {
        "id": "17336d81-4618-494e-8de8-4355537b7d03",
        "source": "apple_platform_security",
        "question": "When a user adds a state ID or driver's license to Apple Wallet, several security measures are taken to protect the user's information. Which of the following are true regarding this process?",
        "choices": [
            "A: The Secure Element generates a key pair that binds the user’s ID to the device, ensuring device-specific encryption.",
            "B: Apple Wallet uses the Secure Enclave to store user ID information in an unencrypted format for easy access by authorized applications.",
            "C: User authentication is required with Face ID or Touch ID before identity information can be relayed to the identity reader.",
            "D: Device retrieval is used to prevent server calls during the presentation of the ID, eliminating the risk of user tracking by the identity reader."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "AppleWalletSecurity"
    },
    {
        "id": "2cb27832-f74a-4625-9f2c-31bb9a7b5504",
        "source": "attck",
        "question": "A security team is reviewing their monitoring system's logs and wishes to improve detection of adversary software discovery activities within their network. Based on the ATT&CK framework, which data source and associated component should they prioritize to effectively detect this behavior?",
        "choices": [
            "A: Command Execution - Monitor executed commands that may list installed software versions.",
            "B: Firewall Enumeration - Monitor for changes in firewall rules and settings.",
            "C: Process Creation - Monitor for the creation of new user accounts within the network.",
            "D: Firewall Metadata - Monitor for contextual data around firewall activity such as policy or status."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command Execution"
    },
    {
        "id": "55a583bb-01b2-4d45-ac51-596052e8b15b",
        "source": "owasp_wstg",
        "question": "In the context of web application security, why is it recommended that session variables should only be used for a single, consistent purpose?",
        "choices": [
            "A: To prevent the application from running out of memory due to excessive session variable creation.",
            "B: To make it easier for developers to track the changes in the state of the application.",
            "C: To mitigate the risk of an attacker exploiting session variable overloading to perform unauthorized actions.",
            "D: To improve the performance of the application by reducing the number of read/write operations to the session store."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Session Management"
    },
    {
        "id": "d6a8defe-b5dc-44f8-952b-9cf77a77d04e",
        "source": "owasp_mastg",
        "question": "As a security analyst, you are reviewing the implementation of key attestation in a mobile application. Which of the following would be a red flag indicating a potential security risk in the attestation process? Select two.",
        "choices": [
            "A: The server confirms that the root certificate is signed with the Google attestation root key.",
            "B: The client application initiates the key attestation process instead of the server.",
            "C: The server checks the certificate chain for integrity and trustworthiness.",
            "D: The server does not verify if the attestation challenge matches the value initially generated."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Key Attestation"
    },
    {
        "id": "2968f4d2-3a56-4a8b-b7ee-ad8deeeae1ba",
        "source": "owasp_wstg",
        "question": "A web application uses an LDAP structure to store and search for user information. Consider the following LDAP search filter implementations. Which of the following search filter implementations is correct and helps in preventing LDAP injection attacks?",
        "choices": [
            "A: find(\"(&(cn=John*)(userPassword=mypass))\")",
            "B: find(\"(cn=John*)(userPassword=mypass)\")",
            "C: find(\"(&(cn=John)(userPassword={userInput}))\") where {userInput} is sanitized to escape LDAP metacharacters.",
            "D: find(\"cn=*John* & userPassword=*mypass*\")"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "LDAP Injection"
    },
    {
        "id": "192acf52-327f-49b5-8911-1023319d540f",
        "source": "android_sec_doc",
        "question": "As a server application developer, you're tasked with creating a named service port using the 'port_create()' method. Your protocol requires the client to send multiple messages before expecting a reply. What is the minimum number of receive buffers ('num_recv_bufs') you should specify when creating the port to accommodate this protocol?",
        "choices": [
            "A: Zero, since the messages will be processed one at a time synchronously.",
            "B: One, as it allows for a send and receive buffer which is sufficient for any protocol.",
            "C: At least two, to handle more than one message before a reply can appear.",
            "D: The maximum allowed by the system to ensure that no messages are dropped."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "port_create()"
    },
    {
        "id": "70001d43-417d-4319-bb76-f10dc491424f",
        "source": "apple_platform_security",
        "question": "Your company is considering the adoption of OAuth 2.0 for managing authorization in its services. What are the potential benefits and drawbacks of implementing OAuth 2.0 for this purpose? (Select all that apply)",
        "choices": [
            "A: OAuth 2.0 allows for scoped access, enabling the service to limit the permissions granted to third-party applications.",
            "B: OAuth 2.0 completely eliminates the risk of phishing attacks as it does not require users to provide their credentials directly to third-party services.",
            "C: OAuth 2.0 can introduce additional complexity to the system, potentially increasing the attack surface if not implemented correctly.",
            "D: OAuth 2.0 streamlines user experience by supporting single sign-on (SSO) across multiple services."
        ],
        "answer": "ACD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "OAuth"
    },
    {
        "id": "f5f8ce6f-e899-4307-aae0-9718eb718fe4",
        "source": "android_sec_doc",
        "question": "As a kernel module developer, you need to send a message to a Trusty service. After creating a 'tipc_chan' object and connecting to the Trusty service, which of the following steps should you perform next according to the Trusty IPC Client API?",
        "choices": [
            "A: Invoke 'tipc_chan_put_txbuf()' to obtain a message buffer, compose the message, and then use 'tipc_chan_queue_msg()' to send it.",
            "B: Call 'tipc_chan_get_txbuf_timeout()' to get a message buffer, compose and queue the message using 'tipc_chan_queue_msg()', and then 'tipc_chan_put_txbuf()' if queuing fails.",
            "C: Queue a message directly with 'tipc_chan_queue_msg()' without obtaining a buffer and handle the 'handle_msg()' callback for incoming messages.",
            "D: Use 'tipc_chan_get_rxbuf()' to obtain a buffer for the outgoing message, queue the message with 'tipc_chan_queue_msg()', and use 'tipc_chan_put_rxbuf()' after sending."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Kernel Trusty IPC Client API"
    },
    {
        "id": "3cd590f5-79fe-4359-86e4-ecc1daf24fd0",
        "source": "owasp_mastg",
        "question": "While conducting security tests on mobile applications, you decide to utilize a comprehensive guide for analysis. What legal and ethical considerations should you keep in mind before proceeding with the application of these tests?",
        "choices": [
            "A: Consulting local laws regarding testing and ensuring the tests do not violate them, and adhering to a code of conduct established for responsible testing.",
            "B: Focusing solely on the technical aspects of testing without considering any legal or ethical implications.",
            "C: Assuming permission is granted as long as the application is publicly available, and sharing findings without consent from the app creators.",
            "D: Obtaining a waiver from all potential legal consequences, and testing without any restrictions or guidelines."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Mobile Application Security Testing"
    },
    {
        "id": "a349458f-8fec-4e91-823f-b1b353d71b2e",
        "source": "apple_platform_security",
        "question": "A user intends to enable Advanced Data Protection for their iCloud account. Which of the following statements are correct regarding the requirements and implications of this action?",
        "choices": [
            "A: The user needs to have two-factor authentication enabled for their Apple ID and have a passcode set on their trusted devices.",
            "B: If the recovery methods like recovery contacts fail, Apple can recover the user's end-to-end encrypted iCloud data.",
            "C: To meet the requirements, all devices signed in with the user's Apple ID must be updated to the latest operating system versions as specified by Apple.",
            "D: The iCloud Backup service key remains on iCloud Hardware Security Modules in Apple data centers even after Advanced Data Protection is enabled."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "DataProtection"
    },
    {
        "id": "0adf29c3-fe2e-4ebe-a6fc-733d121b83cb",
        "source": "apple_platform_security",
        "question": "Consider a scenario where an employee is using a Mac with Touch ID enabled. Under which of the following circumstances would the employee be required to enter a passcode or password instead of using Touch ID to unlock their device?",
        "choices": [
            "A: The device has been inactive and not unlocked for more than two days.",
            "B: The employee wishes to update the software on their Mac.",
            "C: There have been three unsuccessful biometric match attempts.",
            "D: The Mac has been paired with a new Magic Keyboard with Touch ID but has not been restarted since the pairing."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "BiometricRestrictions"
    },
    {
        "id": "ba657a5d-ff86-4c07-b811-72cdb8251a0a",
        "source": "cs161_textbook",
        "question": "Consider a scenario where a wireless local network is being set up for a company. The network architect is concerned about the security of the wireless communication, specifically the potential for on-path attackers to learn the encryption keys during the handshake process or brute-force the password. What measures should the architect implement to mitigate this vulnerability?",
        "choices": [
            "A: Implementing WPA2-Enterprise which uses a RADIUS server for authentication and can provide protection against such attacks.",
            "B: Upgrading all wireless routers to the latest firmware to prevent on-path attackers from exploiting known vulnerabilities.",
            "C: Enabling MAC address filtering to restrict network access to known devices and reduce the risk of unauthorized access.",
            "D: Using stronger WEP encryption to secure the wireless network against on-path attackers."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "WPA2-Enterprise"
    },
    {
        "id": "53e2e30d-c519-4e06-a39e-d5ca07909e8b",
        "source": "owasp_wstg",
        "question": "In the context of web application security, which of the following statements accurately describes the relationship between a vulnerability and a threat?",
        "choices": [
            "A: A threat is the direct consequence of a vulnerability in a system's design or implementation.",
            "B: A vulnerability is a specific type of threat that targets the confidentiality of a system.",
            "C: A threat exploits a vulnerability to potentially compromise the system's security objectives.",
            "D: A vulnerability is any potential hazard that may be exploited by a threat to cause harm to the system."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Threat and Vulnerability Relationship"
    },
    {
        "id": "7ba0ce3b-d307-4d23-8880-355679c44b07",
        "source": "cs161_textbook",
        "question": "Consider a simple static 'Under construction' web page with no forms, user input, or dynamic content. Given the static nature of the page, which of the following security features might be considered redundant and not contribute to enhancing the web page's security?",
        "choices": [
            "A: Configuring the server to use the latest TLS protocol.",
            "B: Employing Content Security Policy (CSP) headers.",
            "C: Setting up a Web Application Firewall (WAF).",
            "D: Implementing Cross-Site Scripting (XSS) protections."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "RedundantSecurity"
    },
    {
        "id": "4c68cbfe-ccdb-4750-993d-8009d3fbf312",
        "source": "attck",
        "question": "In evaluating the security posture of a client's network infrastructure, you are considering the potential threat of Network Denial of Service (DoS) attacks. Which of the following characteristics are true regarding Network DoS attacks? (Select two.)",
        "choices": [
            "A: They always involve IP address spoofing to prevent tracing back to the attacking system.",
            "B: They can be executed by a single system or a distributed set of systems across the internet.",
            "C: The primary impact is on data confidentiality, not the availability of services.",
            "D: They may be politically motivated or used as a distraction to support other malicious activities."
        ],
        "answer": "BD",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network DoS"
    },
    {
        "id": "977186bb-ac66-419f-bf6d-620202754434",
        "source": "attck",
        "question": "A security analyst at XYZ Corporation is configuring the organization's detection systems to alert on possible password policy discovery attempts. They are focusing on monitoring activities that may indicate an adversary is trying to access password policy information. Which data sources and components should the analyst prioritize to enhance detection of such reconnaissance activities?",
        "choices": [
            "A: Monitoring for unusual user account creations and changes in user account metadata that might indicate an adversary is trying to escalate privileges.",
            "B: Monitoring executed commands and arguments, especially those associated with password policy discovery such as 'net accounts /domain'.",
            "C: Setting up alerts for every failed login attempt to capture any brute-force attack, regardless of its relevance to password policy discovery.",
            "D: Analyzing network traffic for encrypted packets that could be an indicator of an adversary exfiltrating password policy information."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command Execution Monitoring"
    },
    {
        "id": "57a481a9-c135-40c5-a3fe-6b4fe04d5262",
        "source": "cs161_textbook",
        "question": "In the context of RSA signatures, which of the following actions are impossible to perform without knowledge of the private key?",
        "choices": [
            "A: Verifying the validity of a signature using the public key.",
            "B: Computing the cryptographic hash of a given message.",
            "C: Finding a message that corresponds to a given cryptographic hash output.",
            "D: Generating a valid signature for a given message."
        ],
        "answer": "CD",
        "topics": [
            "Cryptography",
            "WebSecurity"
        ],
        "keyword": "RSA"
    },
    {
        "id": "5e9cb083-a849-40e8-bf66-0174b4c23700",
        "source": "cwe",
        "question": "You are reviewing the security of a web application designed to run database backups using a privileged user account. The application uses the following command to initiate the backup and cleanup process:\n\njava\nString btype = request.getParameter(\"backuptype\");\nString cmd = new String(\"cmd.exe /K \\\"c:\\util\\rmanDB.bat \"+btype+\"&&c:\\utl\\cleanup.bat\\\"\")\nSystem.Runtime.getRuntime().exec(cmd);\n\n\nWhat is a potential security risk associated with the above implementation, and how could it be mitigated?",
        "choices": [
            "A: Risk: The backup operation may fail silently. Mitigation: Implement detailed error logging.",
            "B: Risk: An attacker could inject commands via the backuptype parameter. Mitigation: Validate the backuptype parameter to contain only expected values.",
            "C: Risk: The cleanup.bat script may not execute if rmanDB.bat takes too long. Mitigation: Run cleanup.bat as a scheduled task independent of the backup operation.",
            "D: Risk: The application may consume excessive system resources. Mitigation: Set resource usage limits on the cmd.exe process."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "CommandInjectionMitigation"
    },
    {
        "id": "24f8a0d0-f6f6-49ba-ad49-59bf8b03f850",
        "source": "apple_platform_security",
        "question": "Apple has taken certain measures to secure the firmware of peripheral processors in Mac computers to prevent attackers from persistently infecting the operating system. Which of the following are strategies employed by Apple as part of their security efforts for peripheral processors?",
        "choices": [
            "A: Verifying the processor by downloading firmware from a secure internet database at startup",
            "B: Disabling debug interfaces to reduce attack vectors",
            "C: Requiring peripheral processors to implement secure boot chains and verify their own firmware at every startup",
            "D: Storing cryptographic firmware signing keys on public cloud storage for accessibility"
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "peripheral-security"
    },
    {
        "id": "da6ec626-8e86-4f67-ae1a-0b1bb60052b7",
        "source": "attck",
        "question": "A security analyst is monitoring a system to detect potential masquerading attempts by adversaries. The analyst needs to ensure that any manipulation of file or process features that could make them appear legitimate or benign to users and security tools are caught promptly. Which of the following measures should the analyst implement to effectively detect such masquerading activities? (Select TWO.)",
        "choices": [
            "A: Monitor for changes made to files outside of an update or patch that may attempt to manipulate file features.",
            "B: Only focus on monitoring the execution of high-integrity processes, as these are the sole targets of masquerading.",
            "C: Collect file hashes and monitor for files with known names but in unusual locations.",
            "D: Ignore scheduled tasks as they are less likely to be used in masquerading compared to direct malware injection."
        ],
        "answer": "AC",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Masquerading"
    },
    {
        "id": "edc85f6a-29f2-422a-adb8-270b3cba7e7c",
        "source": "attck",
        "question": "An organization has identified that adversaries use dynamic DNS resolution to randomly generate subdomains for command and control infrastructure. Which of the following mitigation strategies would be MOST effective in preventing this behavior?",
        "choices": [
            "A: Implementing strict firewall rules to block all incoming and outgoing DNS traffic.",
            "B: Using a local DNS sinkhole to help prevent behaviors associated with dynamic resolution.",
            "C: Enforcing a policy that requires manual approval for all domain name registrations within the organization.",
            "D: Disabling all dynamic DNS services within the organization's internal network."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "DNS Sinkhole"
    },
    {
        "id": "4ba6c69e-6b1b-4f37-932f-96b6ac965fe5",
        "source": "windows_security",
        "question": "A company is revising their platform firmware to adhere to Windows security specifications for a new line of devices with an Intel processor. Which of the following measures must be implemented to ensure compliance with the Windows security requirements for a secure launch?",
        "choices": [
            "A: The BIOS must include an Intel SINIT ACM and the platform must ship with a production ACM signed by an authorized Intel ACM signer.",
            "B: All DMA ports must remain permanently disabled to maintain security integrity.",
            "C: EfiConventionalMemory must be used for SMM page tables to ensure OS/VMM memory ownership.",
            "D: The system firmware must only be updated manually by the user to avoid automatic updates through Windows Update."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Platform firmware"
    },
    {
        "id": "be82160c-a200-422c-91b0-e73281ecb7cd",
        "source": "android_sec_doc",
        "question": "In a SELinux policy for an Android system, if a file labeled with 'sysfs' type in the platform policy is changed to 'sysfs_A' in a subsequent update, how does this affect the access of vendor domain 'v_domain' to the file, assuming the vendor policy remains unchanged?",
        "choices": [
            "A: The 'v_domain' will retain access because the file's label is backward compatible.",
            "B: The 'v_domain' will lose access because there is no policy for the new 'sysfs_A' type in the vendor policy.",
            "C: The 'v_domain' will gain additional access due to the new 'sysfs_A' label.",
            "D: The 'v_domain' access will not be affected since the SELinux policy is not concerned with file labeling."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux policy"
    },
    {
        "id": "ca1cff29-97b9-4dd4-a4eb-7236c83c4c2b",
        "source": "cs161_textbook",
        "question": "In developing a new web application, the security team is debating the merits of keeping the source code private versus making it open source. Based on Shannon's Maxim and related security principles, what should be the primary focus to ensure the security of the application?",
        "choices": [
            "A: Ensuring that the source code remains private to prevent attackers from discovering potential vulnerabilities.",
            "B: Focusing on the design of robust security measures that do not depend on the secrecy of the source code.",
            "C: Using obscure and less known programming languages to reduce the likelihood of an attacker being familiar with potential exploits.",
            "D: Designing the system to require frequent changes to the source code, making it harder for attackers to maintain up-to-date knowledge."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "source_code_security"
    },
    {
        "id": "9ae30129-74e9-4a1f-b059-ed54385c6ea7",
        "source": "owasp_wstg",
        "question": "In the context of a modern web application that uses client-side JavaScript frameworks like ReactJS, AngularJS, or Vue, why would it be a poor practice to hardcode sensitive information such as private API keys or credentials within the JavaScript variables on the frontend?",
        "choices": [
            "A: It can lead to increased website loading times and negatively affect user experience.",
            "B: Sensitive information can become outdated quickly and lead to maintenance issues.",
            "C: Hardcoded sensitive information can be easily extracted by attackers, leading to security breaches.",
            "D: It makes the codebase less modular and harder to manage across different development teams."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Hardcoded Sensitive Information"
    },
    {
        "id": "9a3242a9-fee3-4e87-842c-4533388282c3",
        "source": "cwe",
        "question": "In designing a cloud-based message routing service, which of the following strategies would effectively mitigate the risk of acting as an unintended proxy in line with the best practices suggested for avoiding CWE 441 vulnerabilities?",
        "choices": [
            "A: Implementing a system where the router drops the identity of the message sender and assumes its own identity for forwarding messages.",
            "B: Maintaining the immutability of the sender's identity and ensuring it is forwarded along with the message to the final recipient.",
            "C: Allowing the message sender to specify any recipient address, even if it is not pre-verified, as long as the message content is encrypted.",
            "D: Restricting the router's access to a predefined list of recipient addresses, irrespective of the sender's identity."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategy"
    },
    {
        "id": "b7092610-90ee-4f6b-ac4a-bbd4b63a041e",
        "source": "apple_platform_security",
        "question": "A user has lost their device and is looking to recover their iCloud Keychain data, which includes CloudKit service keys. Which of the following recovery methods could the user potentially employ? Choose all that apply.",
        "choices": [
            "A: The user can rely on Secure iCloud Keychain recovery to regain access to their data.",
            "B: The user may use Account Recovery Contacts to assist in the recovery of their iCloud Keychain data.",
            "C: The user can request direct assistance from Apple to decrypt their end-to-end encrypted data without any recovery mechanisms.",
            "D: An Account Recovery Key may be used by the user to recover their iCloud Keychain data."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Recovery"
    },
    {
        "id": "3155668b-347a-40c6-b5b1-7fea8e0865f5",
        "source": "attck",
        "question": "An adversary attempts to execute a cyber attack by compromising a document template using template injection. Which of the following scenarios correctly aligns with the adversary's technique to evade static file analysis and potentially trigger forced authentication attempts?",
        "choices": [
            "A: The adversary modifies a .docx file to include a remote template reference that fetches a malicious payload when the document is opened.",
            "B: The adversary inserts a VBA macro into an .xls file that automatically downloads and executes a payload from a hardcoded URL in the macro.",
            "C: The adversary alters an existing .rtf file to embed a `*\\template` control word with a URL resource pointing to a malicious payload.",
            "D: The adversary creates a phishing email with a script that, when clicked, initiates a download of a suspicious .exe file from a remote server."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Template Injection"
    },
    {
        "id": "eaffa54e-eaa7-413a-b963-9eae83de3350",
        "source": "owasp_mastg",
        "question": "When conducting mobile application security testing for an app designed to operate across multiple platforms, which of the following considerations should be included to ensure the resilience of the application?",
        "choices": [
            "A: Implementing platform-specific encryption algorithms to protect data at rest.",
            "B: Using obfuscation techniques to prevent reverse engineering of the application code.",
            "C: Restricting the app's functionality exclusively to one operating system for security purposes.",
            "D: Developing a custom security protocol for communication over the network."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Mobile Application Security Testing"
    },
    {
        "id": "806c5a1a-4536-476a-84bd-9a66a80a4d32",
        "source": "apple_platform_security",
        "question": "As an app developer, you're developing an iOS app that needs to access Safari-saved passwords. To ensure the proper security measures are taken, which steps must you follow according to the policies set by Apple?",
        "choices": [
            "A: Include an entitlement in your app that lists the fully qualified domain names of associated websites.",
            "B: Ensure the associated websites place a file on their server with your app's unique identifier.",
            "C: Wait for user consent before accessing any passwords, regardless of whether a trusted relationship has been established.",
            "D: Directly access the passwords stored in Safari without requiring any user consent or website approval."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Password Access"
    },
    {
        "id": "5d2edc03-7815-44e7-928b-98081c6345d6",
        "source": "owasp_wstg",
        "question": "What are the potential security implications of leaving unreferenced and backup files accessible on a web server?",
        "choices": [
            "A: May provide attackers with sensitive information or access to powerful functionality",
            "B: Can improve the performance of the web application by providing caching",
            "C: Allows for easier maintenance and update of the web application by the administrators",
            "D: Enhances the security of the application by keeping a backup of the code"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Sensitive Information Disclosure"
    },
    {
        "id": "cee3fd3d-8891-4128-8e01-52b5af432583",
        "source": "owasp_wstg",
        "question": "Consider a web application that allows users to post comments, which are then displayed on a public page. A user submits a comment containing a script tag that includes malicious JavaScript. This input is not sanitized by the application and is stored directly in the database. When other users visit the public page to read comments, the malicious script executes in their browsers. What kind of web application vulnerability is being exploited in this scenario?",
        "choices": [
            "A: SQL Injection",
            "B: Stored Cross Site Scripting (XSS)",
            "C: Cross-Site Request Forgery (CSRF)",
            "D: Local File Inclusion (LFI)"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Stored XSS"
    },
    {
        "id": "b35ebd47-4fc7-44b4-9021-4878e8b98360",
        "source": "cwe",
        "question": "Analyze the following Java code snippet from a web application that logs failed input parsing attempts: \n\nString val = request.getParameter(\"val\");\ntry { int value = Integer.parseInt(val); }\ncatch (NumberFormatException e) { log.info(\"Failed to parse val = \" + val); }\n\nWhich vulnerability does this code snippet most likely introduce?",
        "choices": [
            "A: SQL Injection due to concatenation of unsanitized input in a query.",
            "B: Improper output neutralization for logs, allowing log forging through untrusted input.",
            "C: Cross-site scripting (XSS) because of unescaped user input being rendered in the web interface.",
            "D: Buffer overflow due to insufficient bounds checking on the input value."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "LogInjection"
    },
    {
        "id": "5e666236-8a3f-4897-b02e-03c7c658941e",
        "source": "cwe",
        "question": "Consider a scenario where a system's performance starts to degrade, and upon inspection, it's found that two services are not responding. The logs indicate that each service is waiting on a resource the other holds. What might be the reason for the system's performance issues?",
        "choices": [
            "A: The system is experiencing a deadlock due to the cyclic dependency of resource allocation between services.",
            "B: Service A has entered an infinite loop, consuming all CPU resources and blocking Service B.",
            "C: Service B has exhausted the system memory, causing Service A to wait indefinitely for memory to be freed.",
            "D: A third-party API used by both services is down, causing both services to wait for a response."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Deadlock"
    },
    {
        "id": "854b136a-5774-471f-b03d-53d29c80e631",
        "source": "apple_platform_security",
        "question": "A user concerned about privacy wants to ensure their device usage data is secure. They are interested in utilizing the Screen Time feature across multiple devices. Considering the user has enabled two-factor authentication for their iCloud account, which of the following statements are true regarding the privacy and security of their Screen Time data?",
        "choices": [
            "A: Screen Time data is synced across devices using CloudKit end-to-end encryption.",
            "B: Usage data and configuration settings are transferred between devices using the end-to-end encrypted Apple IDentity Service (IDS) protocol.",
            "C: Screen Time analytics collected by Apple include specific app or web usage data.",
            "D: When parents manage Screen Time for their children, usage data may be briefly stored on IDS servers in an encrypted format, unreadable by Apple."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Screen Time"
    },
    {
        "id": "9e1b71c6-ec25-43f4-bcd2-69547335e865",
        "source": "owasp_wstg",
        "question": "When creating a Software Identification Tag (SWID) for an application, which of the following is NOT considered one of the predefined elements required to be included in the first block of a valid SWID tag?",
        "choices": [
            "A: The software's version number",
            "B: The software's patch status",
            "C: The tag creator's entity name",
            "D: The software's media type"
        ],
        "answer": "D",
        "topics": [
            "SoftwareSecurity",
            "WebSecurity"
        ],
        "keyword": "SWID"
    },
    {
        "id": "4b8aa558-b4d3-43b8-b737-fd59998bc4e1",
        "source": "apple_platform_security",
        "question": "When setting up a new iPhone for a senior executive, you are outlining the scenarios where the executive would need to use their passcode or password instead of Face ID or Touch ID. Which of the following scenarios would require the executive to manually enter their passcode or password? (Select all that apply.)",
        "choices": [
            "A: The executive has not unlocked their iPhone for more than 48 hours.",
            "B: The iPhone's software is being updated.",
            "C: The executive is attempting to pair their iPhone with a new Apple Watch.",
            "D: The executive is changing the configuration profiles on the iPhone."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Authentication"
    },
    {
        "id": "1f20d072-5bf5-4364-951e-f04239c18fed",
        "source": "cs161_textbook",
        "question": "In the context of DNS resolution, which of the following statements are true regarding the roles of the DNS Recursive Resolver and the DNS Stub Resolver?",
        "choices": [
            "A: The DNS Recursive Resolver sends queries, processes responses, and maintains an internal cache of records.",
            "B: The DNS Stub Resolver is responsible for performing the iterative process of contacting various name servers until the IP address is found.",
            "C: The DNS Stub Resolver on a local computer sends a query to the Recursive Resolver and awaits the final response.",
            "D: The DNS Recursive Resolver only caches the final IP address and does not interact with the name servers directly."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DNS Resolvers"
    },
    {
        "id": "268ea10f-2705-4776-bc9c-7876ec0cfd48",
        "source": "cs161_textbook",
        "question": "In the context of onion routing, which of the following are potential strengths and which are potential weaknesses of using this method for anonymity?",
        "choices": [
            "A: Strength: No single intermediary knows both the origin and the final destination of the message.",
            "B: Weakness: If the number of users is small, collusion between the first and last proxy could potentially link the message sender and receiver.",
            "C: Strength: The message content is always secure since it is encrypted by the sender's private key.",
            "D: Weakness: If all intermediaries except one are compromised, anonymity is automatically breached."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Anonymity"
    },
    {
        "id": "6c460791-e27e-4c70-b39a-6ed5928a3e15",
        "source": "mozilla_security",
        "question": "A content website wants to analyze traffic coming from external links but also wishes to maintain privacy for secure pages by not disclosing the URL path. Which Referrer Policy configuration should the webmaster apply to balance these requirements?",
        "choices": [
            "A: A strict policy of 'no-referrer', completely omitting the referrer information.",
            "B: A policy of 'origin', sending only the origin of the document and not the full URL path.",
            "C: A policy of 'same-origin', sending referrer information only for same-origin requests.",
            "D: A policy of 'unsafe-url', sending full URL path regardless of the request's origin."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Referrer Policy"
    },
    {
        "id": "66c93881-9f22-48dd-98f4-220b1086b158",
        "source": "cwe",
        "question": "Consider a software design where you are tasked to implement a class hierarchy for a graphics library. The base class is 'Shape', which will be extended by 'Circle', 'Rectangle', and 'Triangle'. You need to ensure that the 'Shape' class adheres to proper object-oriented design principles and does not introduce potential vulnerabilities. Which of the following modifications to the 'Shape' class would be most appropriate?",
        "choices": [
            "A: The 'Shape' class defines an instance method that casts itself to 'Circle' to calculate the area.",
            "B: The 'Shape' class declares an abstract method 'calculateArea' to be overridden by child classes.",
            "C: The 'Shape' class keeps a static reference to a 'Triangle' object to use its 'calculatePerimeter' method.",
            "D: The 'Shape' class initializes a 'Rectangle' object in its constructor to delegate the 'draw' operation."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Inheritance"
    },
    {
        "id": "9ca5bb8a-9b23-4f13-b85e-7f92d60f5350",
        "source": "apple_platform_security",
        "question": "A company is upgrading its wireless network infrastructure and has a mix of Apple devices in its environment. They aim to implement the highest level of data confidentiality for their Wi-Fi network. Which of the following Wi-Fi security protocols should they enable to meet their goal?",
        "choices": [
            "A: WPA2/WPA3 Transitional",
            "B: WPA3 Enterprise 192-bit security",
            "C: WEP Open with 104-bit keys",
            "D: Dynamic WEP"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Wi-Fi Security"
    },
    {
        "id": "d447ab35-4cc7-4b9f-8751-a6c15a871414",
        "source": "attck",
        "question": "A cybersecurity specialist is reviewing security protocols to prevent adversaries from enumerating system and service logs, which could reveal sensitive information such as user authentication records and vulnerable software. Considering the specialist's objective to limit adversaries' access to such data, what is the most effective mitigation strategy that should be implemented?",
        "choices": [
            "A: Implement network segmentation to isolate sensitive log data from general access.",
            "B: Limit the ability to access and export sensitive logs to privileged accounts where possible.",
            "C: Encrypt all system and service logs to prevent unauthorized access.",
            "D: Increase the storage capacity for logs to reduce the frequency of exportation."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "User Account Management"
    },
    {
        "id": "fe6dd28b-9b53-4e30-85b3-e48b1d38abf6",
        "source": "cwe",
        "question": "A development team has implemented session validation to secure form submissions in their web application. Despite this measure, you are concerned about the threat of Cross-Site Request Forgery (CSRF) attacks. What are the primary reasons why session validation alone is insufficient to prevent CSRF, and what additional steps should be taken to enhance security?",
        "choices": [
            "A: Session validation does not prevent CSRF because the attacker can forge a request from a user's browser with a valid session; additional steps include using anti-CSRF tokens and ensuring no cross-site scripting vulnerabilities.",
            "B: Session validation is sufficient on its own; no further action is required.",
            "C: Session validation is only effective for stateless applications; for stateful applications, implement secure socket layer (SSL) encryption.",
            "D: CSRF attacks can bypass session validation by exploiting open redirect vulnerabilities; it is essential to use the HTTP Referer header for validation."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "SessionValidation"
    },
    {
        "id": "bc4d9c17-9a00-40f2-a2ea-2730a5f04b0f",
        "source": "attck",
        "question": "A cybersecurity analyst observes that several critical services on a company's server have been stopped, resulting in major disruptions to operations. Upon investigation, the analyst finds evidence of an adversary's involvement. What could be the adversary's likely objective, and which mitigation strategy could be most effective in preventing such incidents?",
        "choices": [
            "A: The adversary's objective could be to conduct data destruction, and an effective mitigation strategy would be to operate intrusion detection systems on a separate network.",
            "B: The adversary's intent might be to create a backdoor for future access, and the mitigation would be to ensure proper registry permissions are in place.",
            "C: The adversary's goal could be to extract sensitive data, and mitigating this could involve restricting file permissions.",
            "D: The adversary may aim to compromise the integrity of the system, and mitigating this could involve user account management to limit service interaction."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Service Stop"
    },
    {
        "id": "1e6fca53-ff35-499c-8713-2a3d108c6f91",
        "source": "mozilla_security",
        "question": "A web application development team is reviewing the evolution of security guidelines and considering implementing several security measures that have been recommended over the years. Given the following updates to web security guidelines: 1) Adding SameSite cookies, 2) Deprecation of X-Frame-Options (XFO) in favor of Content Security Policy (CSP), 3) Introduction of Referrer Policy, which of the following combinations would provide the most comprehensive security improvements?",
        "choices": [
            "A: Implementing SameSite cookies and maintaining XFO without adopting CSP",
            "B: Deprecating XFO and implementing CSP along with adding Referrer Policy",
            "C: Adopting Referrer Policy only and disregarding SameSite cookies and CSP",
            "D: Maintaining XFO, ignoring SameSite cookies, and implementing Referrer Policy"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SameSite cookies"
    },
    {
        "id": "43747b4d-cafe-49da-90f4-04d658120cf3",
        "source": "apple_platform_security",
        "question": "Identify which of the following statements accurately describe the privacy features implemented in Bluetooth Low Energy (BLE) as utilized in iOS devices:",
        "choices": [
            "A: BLE privacy features include both address randomization and cross-transport key derivation to help secure user privacy.",
            "B: Address randomization changes the BLE device address periodically to prevent the tracking of the device over time.",
            "C: Cross-transport key derivation allows for the creation of a Bluetooth Classic link key from a BLE link key, but not vice versa.",
            "D: iOS 13 or later supports BLE privacy features by allowing device tracking through a constant Bluetooth device address."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "BLE"
    },
    {
        "id": "6496b772-b3c9-4f60-95a3-f8f3fc6464d3",
        "source": "owasp_wstg",
        "question": "Consider the following JavaScript snippet that is part of a web application's client-side code:\n\njs\nvar redir = location.hash.substring(1);\nif (redir) {\n    window.location='http://'+decodeURIComponent(redir);\n}\n\n\nAn attacker intends to exploit this code to redirect victims to a malicious site. Which of the following inputs included in the URL would directly exploit this vulnerability and cause redirection to a malicious site?",
        "choices": [
            "A: http://www.victim.site/?#www.malicious.site",
            "B: http://www.victim.site/?#redirect=www.malicious.site",
            "C: http://www.victim.site/?#http://www.malicious.site",
            "D: http://www.victim.site/redirect?www.malicious.site"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Client-side URL Redirection"
    },
    {
        "id": "af068a73-4330-49be-b6f7-ffdf03cdc260",
        "source": "cs161_textbook",
        "question": "If an Autonomous System (AS) mistakenly advertises responsibility for a network it is not actually responsible for, what are the potential consequences for Internet connectivity? (Select two)",
        "choices": [
            "A: The creation of routing loops, where packets circulate between ASs indefinitely.",
            "B: Automatic correction of the mistake by BGP, with no impact on Internet traffic.",
            "C: The misdirected traffic could lead to a black hole, where the data packets are dropped.",
            "D: Increased network latency due to the additional processing required to filter the incorrect advertisement."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "BGP Consequences"
    },
    {
        "id": "366a404d-5fd0-4364-9e3d-b9ec8a563af4",
        "source": "android_sec_doc",
        "question": "You are conducting a calibration phase for facial recognition spoof testing on an Android device. You have already enrolled a target face and taken a high-quality photo for testing. What steps will you take next to ensure that the paper mask you have created will effectively challenge the device's facial recognition system?",
        "choices": [
            "A: Bend the paper mask at both cheeks to mimic the curvature of the target face and cut eye-holes to show the tester's eyes, as blinking detection is a common liveness test.",
            "B: Attach the paper mask to a flat surface and avoid creating any curvature or cuts, since the facial recognition system is designed to detect flat images better.",
            "C: Use a transparent overlay on top of the paper mask to obscure the features, ensuring the device relies on shape recognition instead of visual details.",
            "D: Keep the paper mask unaltered but change the distance from the camera in increments of 5 cm to test the device's depth perception capabilities."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Biometric Spoof Testing"
    },
    {
        "id": "cca3a87b-646e-4a36-8fb1-a866ddb7d7cd",
        "source": "attck",
        "question": "In the context of preventing adversaries from forging SAML tokens to access cloud-based resources, which of the following would be considered an ineffective mitigation strategy and why?",
        "choices": [
            "A: Auditing access lists and permissions for web applications, as it helps establish a baseline for normal activity.",
            "B: Restricting permissions to AD FS servers from non-privileged workstations, as it limits potential points of unauthorized access.",
            "C: Disabling audit logs for ADFS, as it could hinder the detection of unauthorized access attempts.",
            "D: Regularly updating software configurations to prevent exploitation of known vulnerabilities."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "SAML Tokens"
    },
    {
        "id": "9a748c8b-199e-485e-a244-e4c30a03a72b",
        "source": "owasp_mastg",
        "question": "You are tasked with reviewing the security of a newly developed Android mobile application before its release. Which of the following actions would be considered best practice to ensure the application's security?",
        "choices": [
            "A: Using ProGuard to obfuscate the code and thus make reverse engineering more difficult.",
            "B: Storing sensitive information such as passwords and API keys directly in the application’s source code.",
            "C: Relying exclusively on client-side validation to secure the application from malicious inputs.",
            "D: Implementing certificate pinning to prevent man-in-the-middle (MITM) attacks in network communication."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Code Obfuscation"
    },
    {
        "id": "454b2de5-944b-42fc-adf7-4219365faedc",
        "source": "owasp_wstg",
        "question": "A web development team is evaluating which HTTP methods to enable for their new RESTful application. They want to ensure a balance between functionality and security. Based on the standard definitions and RESTful uses of HTTP methods, which of the following methods should the team consider enabling? (Select two)",
        "choices": [
            "A: TRACE, because it can be useful for debugging purposes in a RESTful application.",
            "B: CONNECT, because it allows the establishment of a connection to another system within the RESTful application.",
            "C: PUT, as it is used to create an object within the RESTful application.",
            "D: OPTIONS, since it can perform a CORS Preflight request in a RESTful application."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HTTP Methods"
    },
    {
        "id": "25e7b4c9-dd6d-489e-b2ec-89c6c4c5171c",
        "source": "android_sec_doc",
        "question": "In an Android system implementing file-based encryption (FBE), which of the following statements correctly describe the storage and protection of encryption keys? Select two.",
        "choices": [
            "A: The System DE key is stored in an encrypted state within the System DE storage class.",
            "B: User CE (internal) keys are stored encrypted by another FBE key and can only be unlocked after the corresponding System DE storage class is unlocked.",
            "C: The per-boot key is stored encrypted on-disk along with other FBE keys to ensure persistence across reboots.",
            "D: User DE (adoptable) keys are stored in a storage class encrypted by the System DE key and protected additionally by AES-256-GCM encryption."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "file-based encryption (FBE)"
    },
    {
        "id": "fb409d74-45c5-4518-bc5e-c762a4e028cc",
        "source": "cwe",
        "question": "During a security audit of a proprietary communication protocol, you discover several instances where the protocol permits negotiation of cryptographic algorithms between the server and the client. Which of the following scenarios would NOT indicate a vulnerability related to the 'Selection of Less-Secure Algorithm During Negotiation'?",
        "choices": [
            "A: The protocol defaults to the strongest mutual algorithm but allows a client to request a weaker algorithm, which the server may accept based on a predefined security policy.",
            "B: The server and client start with high-strength algorithms, but an attacker can interfere in the negotiation phase, causing both to fall back to a less secure algorithm without detection.",
            "C: The protocol is hardcoded to use a single, well-vetted encryption algorithm, which does not allow for any negotiation or alteration by either party.",
            "D: During negotiation, the server offers a list of algorithms ranked by strength, but due to a flaw, it accepts a client's request for a weaker algorithm that is lower on the list."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "AlgorithmDowngrade"
    },
    {
        "id": "3af4cf94-dd22-43d3-8e06-38707a7301fb",
        "source": "attck",
        "question": "A financial institution has identified potential vulnerabilities in their network infrastructure that could allow an adversary to conduct an adversary-in-the-middle (AiTM) attack. As a security analyst, you are tasked with recommending mitigation strategies to protect against such attacks. Which of the following strategies would be MOST effective in preventing AiTM attacks?",
        "choices": [
            "A: Enforce a strict bring-your-own-device (BYOD) policy to control the types of devices that can access the network.",
            "B: Disable unnecessary legacy network protocols and ensure traffic is encrypted using modern standards.",
            "C: Increase the strength of passwords used by employees to make credential interception more difficult.",
            "D: Regularly update antivirus software on all devices connected to the network."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "AiTM Mitigation Strategies"
    },
    {
        "id": "af1daf0f-470b-4435-9203-b16a9a82e14f",
        "source": "mozilla_security",
        "question": "A security consultant is reviewing a client's web application that currently employs X-Frame-Options to mitigate clickjacking attacks. The consultant suggests deprecating XFO in favor of implementing a robust Content Security Policy (CSP). Which of the following would be the best counterargument against deprecating XFO?",
        "choices": [
            "A: CSP provides an equivalent level of protection against clickjacking and is more flexible, making the deprecation of XFO unnecessary.",
            "B: CSP is not widely supported by all browsers, and maintaining XFO would ensure better compatibility and protection.",
            "C: XFO is a newer standard than CSP, providing more advanced protection mechanisms.",
            "D: Referrer Policy alone can provide sufficient protection against clickjacking, rendering both XFO and CSP redundant."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "X-Frame-Options (XFO)"
    },
    {
        "id": "34ea72d4-4a71-4096-9fd8-6807cfabf3b4",
        "source": "attck",
        "question": "In designing a network architecture for an organization that is concerned about adversary-in-the-middle (AiTM) attacks, how would implementing network segmentation contribute to mitigating the risk of such attacks?",
        "choices": [
            "A: Network segmentation allows for better traffic analysis by aggregating all network traffic into a single segment for easier monitoring.",
            "B: Network segmentation increases the attack surface by creating more network segments, making it easier for adversaries to find vulnerable points.",
            "C: Network segmentation can isolate critical systems and limit the scope of AiTM activity by controlling access to various network segments.",
            "D: Network segmentation simplifies network protocols, thereby reducing the likelihood of protocol vulnerabilities that can be exploited for AiTM attacks."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Segmentation"
    },
    {
        "id": "105822e5-7c4b-4da9-bb0c-fd9d44bc202e",
        "source": "attck",
        "question": "An adversary has infiltrated a network and is attempting to discover application window titles for subsequent exploitation. As a cybersecurity analyst, you are tasked with detecting this behavior. Which combination of data source and analytic strategy should you focus on to identify and mitigate this threat?",
        "choices": [
            "A: Monitor system logs for unusual outbound network traffic patterns that could indicate exfiltration of window titles.",
            "B: Monitor executed commands and arguments for actions that could be taken to gather system and network information, and look for suspicious API calls like 'GetForegroundWindow()'.",
            "C: Set up alerts for any new admin user account creations, as this could signify unauthorized access to window title information.",
            "D: Enable file integrity monitoring tools to detect changes in system files that may be indicative of adversaries enumerating application windows."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "GetForegroundWindow()"
    },
    {
        "id": "9d0a6e8b-314c-4d5e-8ddc-5fa0f728df06",
        "source": "windows_security",
        "question": "A system administrator receives a notification indicating that a 'monitored security event pattern' has occurred. The administrator claims this is not a cause for concern as the system is just flagging regular user login attempts. What is the best counterargument to this claim?",
        "choices": [
            "A: Regular user login attempts should not trigger a monitored security event unless they deviate from established patterns.",
            "B: The administrator is correct; such notifications are typically false alarms and do not require further action.",
            "C: Monitored security events are only related to hardware failures and not to user login attempts.",
            "D: Such notifications are part of the system's user education program to demonstrate the login process."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Monitored Security Event"
    },
    {
        "id": "d7764627-cf8e-406b-8c06-5fc6955e0c04",
        "source": "attck",
        "question": "An organization has implemented a mitigation strategy to combat domain policy abuse by adversaries. They have employed auditing tools to identify and correct Group Policy Object (GPO) permissions abuse opportunities. What is the most likely reason this mitigation strategy is effective in preventing adversaries from modifying domain policy settings?",
        "choices": [
            "A: It encrypts data transmitted between domain controllers, preventing adversaries from intercepting and altering GPOs.",
            "B: It facilitates the tracking of administrative access and potential unauthorized changes to GPO permissions.",
            "C: It automates the patching process for software vulnerabilities on domain controllers.",
            "D: It ensures that all user accounts have administrative privileges, reducing the attack surface for privilege escalation."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "GPO Permissions Abuse"
    },
    {
        "id": "1e347a00-b414-40db-b0b3-2163302a2228",
        "source": "cs161_textbook",
        "question": "A company is planning to deploy a single NIDS to cover their entire network. Analyze the pros and cons of this design choice. Select all that apply:",
        "choices": [
            "A: The NIDS installation is cost-effective due to the requirement of a single unit and results in low management overhead.",
            "B: The NIDS will be able to decrypt all HTTPS traffic by default, thus ensuring complete visibility into encrypted connections.",
            "C: The NIDS could fail to detect evasion attacks where an attacker obfuscates attack contents to avoid pattern-based detection mechanisms.",
            "D: The NIDS will have difficulty reconstructing TCP connections accurately when packets are dropped or received out of order."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "NIDS Deployment"
    },
    {
        "id": "42377318-0c16-4ac5-9ba1-dcc430033311",
        "source": "attck",
        "question": "A cybersecurity analyst is monitoring a network for potential malicious activities. Which of the following behaviors would MOST likely indicate an adversary is employing a technique to capture video recordings through peripheral devices or video call applications for the purpose of information gathering?",
        "choices": [
            "A: An unknown process is regularly executing commands that interact with the video camera APIs and is periodically writing files that contain video or camera image data.",
            "B: A known process is frequently updating system time settings, causing synchronization issues across the network.",
            "C: An application is repeatedly generating large volumes of outbound network traffic during off-peak hours.",
            "D: A process is accessing the file system API at regular intervals to perform routine backups of system logs."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Peripheral Device Exploitation"
    },
    {
        "id": "dd7c8d58-e64c-4bcd-b427-b4e26879ab4c",
        "source": "apple_platform_security",
        "question": "Imagine you are a security engineer tasked with explaining to a development team the data protection mechanisms used by Apple devices. You need to explain how file encryption keys are managed and how different classes of data protection affect access to encrypted data after the user locks their device. Which of the following statements correctly describe these mechanisms?",
        "choices": [
            "A: Class A encrypts each file with a unique key, which is wrapped with a class key derived from the user's passcode and the device UID. Once the device is locked, the decrypted class key is discarded, making the data inaccessible.",
            "B: Class B allows files to be written while the device is locked by using symmetric encryption with a static key stored in the device's non-volatile memory.",
            "C: Class C behaves similarly to Class A but does not discard the decrypted class key when the device is locked, allowing data to be accessible after the first user authentication.",
            "D: Class D provides no protection and stores file encryption keys as plain text within the file's metadata for ease of access."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DataProtection"
    },
    {
        "id": "986dd692-46a9-42e2-80b1-1eb9b33d8b9b",
        "source": "cs161_textbook",
        "question": "Alice and Bob are using the one-time pad encryption scheme. Due to an oversight, they reuse their \\(n\\)-bit key \\(K\\) to encrypt two different messages \\(M\\) and \\(M'\\). Eve intercepts both ciphertexts \\(C\\) and \\(C'\\). Which of the following statements are true concerning the security of the messages and the role of Eve?",
        "choices": [
            "A: Eve can determine the exact content of both messages \\(M\\) and \\(M'\\) without additional information.",
            "B: Eve can deduce \\(M \\oplus M'\\) from \\(C \\oplus C'\\), which may reveal patterns or redundant information.",
            "C: Eve's knowledge of \\(M \\oplus M'\\) allows her to reconstruct the key \\(K\\) if she also knows one of the messages.",
            "D: Key reuse in OTP has no significant security implications and does not affect the IND-CPA security of the scheme."
        ],
        "answer": "BC",
        "topics": [
            "Cryptography",
            "WebSecurity"
        ],
        "keyword": "Key Reuse"
    },
    {
        "id": "c7e8b762-983f-4313-ab0f-1f6916b9401e",
        "source": "android_sec_doc",
        "question": "You are tasked with configuring a Keymaster implementation on a device that has just booted up. Based on the Keymaster version being utilized on the device, which function should you invoke to provide the KM_TAG_OS_VERSION and KM_TAG_OS_PATCHLEVEL to Keymaster, and what is the expected behavior if the values provided do not match those provided by the bootloader?",
        "choices": [
            "A: Invoke the 'configure' function; if the values do not match the bootloader's, the method returns `KM_ERROR_INVALID_ARGUMENT`.",
            "B: Invoke the 'addRngEntropy' function; if the values do not match, the method will still accept the values.",
            "C: Invoke the 'getHardwareFeatures' function; if there is a mismatch with the bootloader, the function defaults to secure hardware values.",
            "D: Invoke the 'generateKey' function; the method ignores OS version and patch level as it is only concerned with generating keys."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity"
        ],
        "keyword": "Keymaster HAL"
    },
    {
        "id": "faa37ace-d327-4b50-b10b-8d1350d8a9dd",
        "source": "apple_platform_security",
        "question": "An educational institution uses Shared iPads for its students. One of the iPads is unable to connect to the internet. What are the possible user experiences and limitations under these circumstances? (Select all that apply)",
        "choices": [
            "A: Existing users with local accounts can sign in for a limited number of days without internet access.",
            "B: New users can create a temporary session and their data will be synced once the device reconnects to the internet.",
            "C: Users can still sign in using federated Managed Apple IDs even without internet connectivity.",
            "D: After the offline time limit expires, users must authenticate online, even if a local account exists."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "authentication"
    },
    {
        "id": "02f7c988-1486-4d26-b19b-28ca2696b03d",
        "source": "apple_platform_security",
        "question": "During the Apple Card application process, what measures are taken to ensure the secure transmission and protection of the applicant's personal information?",
        "choices": [
            "A: The user's social security number or ID document image is transmitted to Goldman Sachs Bank USA without encryption for credit evaluation.",
            "B: For identity verification, the applicant's information is shared with Apple's identity provider partners and encrypted with their respective keys.",
            "C: The applicant's bank account information is saved in plaintext within the secure enclave for bill payment purposes.",
            "D: Income information provided during the application is encrypted with Goldman Sachs Bank USA's key before transmission."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Apple Card"
    },
    {
        "id": "7aa82a4c-78e6-4344-a8bb-8f5fc9aaba4d",
        "source": "cs161_textbook",
        "question": "Your company decides to implement a web proxy to manage its web traffic. As the lead security analyst, you are tasked with presenting the benefits and potential challenges associated with this implementation. Which of the following statements accurately reflect the implications of using a web proxy as per the described scenario?",
        "choices": [
            "A: The web proxy allows for fine-grained allow/deny decisions due to the availability of application-layer information for each request and reply.",
            "B: The web proxy simplifies implementation by removing the need to understand the details of the application protocol it mediates.",
            "C: The web proxy may be subject to performance issues if it becomes a bottleneck for the site’s outbound traffic.",
            "D: The web proxy will not affect the performance of the site's outbound traffic since it processes requests and replies independently."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Web Proxy"
    },
    {
        "id": "15e0a70e-dfd1-4cfb-b12a-fc4ec48d8f39",
        "source": "mozilla_security",
        "question": "An application is returning various content types, including HTML, CSS, and JavaScript. To enhance security and ensure that browsers do not interpret non-executable MIME types as executable content, which HTTP response header should the application implement?",
        "choices": [
            "A: X-Frame-Options: deny",
            "B: X-Content-Type-Options: nosniff",
            "C: Strict-Transport-Security: max-age=31536000",
            "D: Content-Security-Policy: script-src 'self'"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "X-Content-Type-Options"
    },
    {
        "id": "cb526c66-f831-4d12-8a5f-b5239a565439",
        "source": "apple_platform_security",
        "question": "Consider a scenario where a user is sharing a custom shortcut with another user through iCloud. Evaluate the implications and select the statements that accurately reflect the benefits and risks involved in this feature of the Shortcuts app.",
        "choices": [
            "A: Sharing through iCloud enhances collaboration but may risk exposing the shortcut to unauthorized iCloud account access.",
            "B: Encrypted local storage of shortcuts prevents any form of sharing, ensuring high security.",
            "C: Sharing shortcuts allows users to inspect and modify the shortcut before use, reducing the likelihood of executing malicious code.",
            "D: The inability to share shortcuts through iCloud would significantly reduce the risk of malware proliferation."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "iCloudSharingRisks"
    },
    {
        "id": "23948b6e-ab54-46dc-8584-952329224767",
        "source": "attck",
        "question": "In designing a secure video conferencing application, what feature would BEST mitigate the risk of an adversary using malware or scripts to capture video recordings without the user's knowledge?",
        "choices": [
            "A: Implementing an API that allows video recording only when the application is in focus and with visible on-screen indicators.",
            "B: Enabling the application to run with the highest privileges to prevent unauthorized access to video recording features.",
            "C: Allowing unrestricted access to the camera's API to ensure compatibility with a wide range of peripheral devices.",
            "D: Scheduling periodic system scans to remove any malware or scripts that may interact with the camera."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Secure API Design"
    },
    {
        "id": "51e9a4bd-7308-458f-b975-3e2e8d1e3bd0",
        "source": "owasp_wstg",
        "question": "A web application uses XMLHttpRequest to fetch and display content based on the URL's hash fragment. An attacker convinces a victim to visit a URL where the hash fragment points to a malicious site that sends back a payload with an Access-Control-Allow-Origin header set to the victim's domain. What is the security flaw in the application, and how should it be addressed?",
        "choices": [
            "A: The flaw is that the application improperly validates the `location.hash` before using it in a CORS request, which can lead to the execution of malicious scripts. The application should implement strict input validation and sanitization on the URL fragment before usage.",
            "B: The application flaw is the use of `XMLHttpRequest`, which is less secure than the Fetch API. The application should switch to using the Fetch API with built-in security features to mitigate this flaw.",
            "C: The security flaw is in the server configuration that allows any origin in the Access-Control-Allow-Origin header, not in the application itself. The server should be configured to only allow known origins.",
            "D: There is no flaw in the application because CORS requests are inherently safe due to the browser's same-origin policy. The attack scenario described is not feasible."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "CORS"
    },
    {
        "id": "e762581e-074d-4a5c-baf8-6995f9e8875f",
        "source": "apple_platform_security",
        "question": "You are tasked with explaining to a group of cybersecurity trainees how Apple's security features protect data on a device. Which of the following features contribute to ensuring that cryptographic material is protected and that devices only activate data connections under conditions indicating that they are under the control of the authorized owner?",
        "choices": [
            "A: The user keybag and KEK are protected using the password-derived key, which includes the long-term SKP key and Hardware key 1 from the Secure Enclave.",
            "B: The Secure Enclave Boot Monitor measures the Secure Enclave OS and contributes to the security configurations loaded by the LocalPolicy.",
            "C: iOS and iPadOS devices can be set to allow data connections only via Face ID, Touch ID, or a passcode after an hour has passed since the last lock or data disconnection.",
            "D: Apple File System (APFS) uses a proprietary encryption method that is optimized for HDD storage and includes a unique sequential-write design to maximize performance."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Apple Security"
    },
    {
        "id": "d4d7f004-d738-42b9-82e3-b3fee62a9151",
        "source": "apple_platform_security",
        "question": "When configuring a Mac with Secure Multi-Boot options and System Integrity Protection, various settings can be adjusted that have implications for the system's security posture. Which of the following are potential consequences of altering these settings?",
        "choices": [
            "A: Changing the smb1 setting to 'true' will allow Secure Enclave signed custom kernel collections, increasing flexibility in managing kernel extensions.",
            "B: Setting sip2 to 'true' can prevent the Configurable Text Read-only Region (CTRR) hardware register from locking, potentially exposing kernel memory to write operations.",
            "C: Modifying the sip3 setting to 'true' could bypass the built-in allow list for boot-args, enabling unrestricted passing of options to the kernel.",
            "D: Enabling smb4 will disable MDM control of the operating system, reverting the device to local user authentication only."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SystemProtection"
    },
    {
        "id": "a8ada9ff-9197-41b7-8234-2752cb1478db",
        "source": "cs161_textbook",
        "question": "A programmer is working with an x86 system and needs to store the word value `0x55667788` in memory starting at address `0x100`. How should the bytes be arranged in memory to adhere to the x86 little-endian system?",
        "choices": [
            "A: At address `0x100`: `0x55`, `0x66`, `0x77`, `0x88`",
            "B: At address `0x100`: `0x88`, `0x77`, `0x66`, `0x55`",
            "C: At address `0x100`: `0x77`, `0x66`, `0x55`, `0x88`",
            "D: At address `0x100`: `0x66`, `0x77`, `0x88`, `0x55`"
        ],
        "answer": "B",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "memory-storage"
    },
    {
        "id": "a374b7bf-874a-4574-a9ba-2751de339d25",
        "source": "cwe",
        "question": "In a recent audit of a company's IT infrastructure, a security analyst discovered that although the authentication system correctly implements multi-factor authentication (MFA), there are reports of unauthorized access. Upon further investigation, it was found that the system permits unlimited login attempts. What is the most likely cause-and-effect relationship between the design decision and the reported unauthorized access?",
        "choices": [
            "A: Unlimited login attempts allow brute-force attacks, rendering MFA ineffective if one factor is weak.",
            "B: Unlimited login attempts may cause system overload and downtime, indirectly affecting authentication integrity.",
            "C: Without a limit on login attempts, the encryption keys used for MFA could become compromised over time.",
            "D: Unlimited login attempts could lead to faster discovery of session tokens, allowing attackers to hijack authenticated sessions."
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "DesignWeakness"
    },
    {
        "id": "0bba4052-289a-4f87-823b-eaada6c5f012",
        "source": "mozilla_security",
        "question": "Which of the following statements best illustrates the advantage of implementing the 'Content-Security-Policy' header with the 'frame-ancestors' directive over the 'X-Frame-Options' header?",
        "choices": [
            "A: 'Content-Security-Policy' allows multiple domains to be specified, offering more granular control compared to 'X-Frame-Options'.",
            "B: 'X-Frame-Options' provides better performance as it is a newer standard and optimized for modern web applications.",
            "C: 'Content-Security-Policy' can only be used to control framing by same-origin pages, while 'X-Frame-Options' allows whitelisting specific domains.",
            "D: 'X-Frame-Options' is deprecated and should not be used, as it offers no protection against clickjacking attacks."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Content-Security-Policy"
    },
    {
        "id": "919d0a27-6a3c-4063-b2ad-66f92d35eea2",
        "source": "attck",
        "question": "An organization is looking to enhance its network security posture against adversaries known to exfiltrate data in fixed-size chunks. Which of the following is the most effective mitigation technique, and what are its potential limitations?",
        "choices": [
            "A: Implementing strict egress filtering rules could prevent unauthorized data transfers, but may also block legitimate traffic if not configured correctly.",
            "B: Deploying network intrusion prevention systems that use signatures to identify specific adversary infrastructure could mitigate this type of exfiltration, though adversaries could change their infrastructure to bypass such signatures.",
            "C: Increasing the threshold for network data transfer alerts could help in catching large chunks of data, but adversaries could adapt by sending even smaller chunks.",
            "D: Enforcing full disk encryption on all endpoints would render exfiltrated data useless, but it would not prevent the exfiltration itself."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Intrusion Prevention"
    },
    {
        "id": "e326358b-6079-42a8-8437-e32150e8c806",
        "source": "owasp_wstg",
        "question": "An online application allows users to upload images for profile customization. To safeguard the server from potential security threats, which of the following practices should the security team implement? (Select TWO.)",
        "choices": [
            "A: Restrict uploads solely based on file extensions, such as .jpg or .png.",
            "B: Scan uploaded files for malicious content using anti-virus software or security features like SCAP.",
            "C: Allow all file types to be uploaded, relying on server-side execution prevention to mitigate risks.",
            "D: Review and determine acceptable file types based on the application's purpose and implement content-type verification."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Malicious File Scanning"
    },
    {
        "id": "f9869177-179a-4150-8fd6-830812576aca",
        "source": "owasp_wstg",
        "question": "You are tasked with testing the security of a web application. During your assessment, you intend to identify potential entry and injection points. Which of the following approaches would allow you to accomplish this effectively?",
        "choices": [
            "A: Using an intercepting proxy to analyze GET and POST requests and pay special attention to parameters passed in the body of the requests, including hidden form fields.",
            "B: Focusing solely on the visual elements of the application's frontend to determine the possible entry points without analyzing the HTTP requests.",
            "C: Assuming all hidden form fields are secure by default and only concentrating on visible form fields and parameters.",
            "D: Ignoring GET requests since they are not commonly used to pass parameters and do not contribute to the application's attack surface."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Intercepting Proxy"
    },
    {
        "id": "c9be498f-86c1-4b0b-aacf-b346b3561c2e",
        "source": "attck",
        "question": "An adversary is planning to utilize a Content Delivery Network (CDN) to proxy command and control traffic for a cyber-attack campaign. Which of the following counterarguments best refutes the claim that using a CDN will not aid in disguising the source of the attack?",
        "choices": [
            "A: CDNs cannot be used for malicious purposes because they are designed to optimize legitimate content delivery.",
            "B: Using a CDN can actually expose the attack infrastructure since CDNs log all the traffic that passes through them.",
            "C: Adversaries cannot use CDNs for proxying command and control traffic because CDNs are not designed to handle dynamic content.",
            "D: Adversaries can take advantage of routing schemes in CDNs to proxy command and control traffic effectively."
        ],
        "answer": "D",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "CDN proxying"
    },
    {
        "id": "22f5c4c3-c734-405b-9277-ea18167a69bd",
        "source": "attck",
        "question": "A security analyst is reviewing the security controls of a company's Windows infrastructure to prevent adversaries from hijacking SIP and trust provider components. Why would restricting registry permissions alone be insufficient for preventing this type of attack?",
        "choices": [
            "A: Restricting registry permissions would not stop adversaries from installing malicious content as registry keys related to SIP and trust provider components can still be hijacked.",
            "B: Adversaries cannot modify the registry if permissions are properly set, thus completely securing SIP and trust provider components from being hijacked.",
            "C: The installation of a root certificate does not involve registry modifications, so altering registry permissions would have no impact on trust provider components.",
            "D: Changing registry permissions would prevent the execution of any code, including legitimate updates and system processes, thereby hindering system functionality."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "SIP and Trust Provider Hijacking"
    },
    {
        "id": "b8b79f91-e47a-410c-a39f-36017e3f7e49",
        "source": "cs161_textbook",
        "question": "A developer claims that for all requests made to a server using the HTTP protocol, the server's response does not always include a payload body with the requested data. What is the most accurate counterargument based on the HTTP request-response model?",
        "choices": [
            "A: The HTTP response always includes a payload with the requested data, otherwise, it violates the HTTP protocol standards.",
            "B: The server generates a response that includes headers and may include a payload with the body of the requested data depending on the nature of the request.",
            "C: HTTP responses are optional and the server can choose not to send any data back to the client, including headers and payload.",
            "D: In the HTTP request-response model, the payload is only included in responses to POST requests, not GET requests."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Response"
    },
    {
        "id": "d545a0e0-9301-4b6f-8cd1-8d8e3726561d",
        "source": "cwe",
        "question": "An engineer is developing a new component that will be deployed on an application server. The component needs to handle resources such as database connections and file streams. Which of the following approaches to resource management should the engineer consider to ensure proper runtime resource management, and what are the potential drawbacks of not following the best practice?",
        "choices": [
            "A: Utilize the application server's API for resource management to leverage built-in optimizations and avoid conflicts with the server's resource handling mechanisms.",
            "B: Directly employ low-level functions/methods for resource management to have granular control over the resources and their lifecycle.",
            "C: Rely on the garbage collection provided by the programming language runtime to automatically manage all resources.",
            "D: Outsource resource management to a third-party library to reduce development effort and focus on business logic."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ResourceManagement"
    },
    {
        "id": "4d46e207-22b3-4db9-9484-987b3e899b62",
        "source": "cwe",
        "question": "A manufacturer argues that using default credentials in their products simplifies the installation and deployment process for system administrators. As a security consultant, which counterargument highlights the most significant risk of this practice?",
        "choices": [
            "A: Default credentials can lead to unauthorized access if they are not changed, compromising the security of multiple organizations.",
            "B: Using default credentials simplifies the user experience and reduces the need for technical support.",
            "C: System administrators prefer to use default credentials to avoid the hassle of managing multiple passwords.",
            "D: Manufacturers can save costs by using default credentials, making their products more competitive in the market."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "RiskCounterargument"
    },
    {
        "id": "648bfd55-f095-4da7-82e0-d53a5a92b60a",
        "source": "apple_platform_security",
        "question": "Apple implements various security measures to enforce Activation Lock across different devices. Identify the correct enforcement mechanisms for each type of Apple device:",
        "choices": [
            "A: On iPhone and iPad, Activation Lock is enforced after the Wi-Fi selection screen during the initial setup by verifying iCloud credentials.",
            "B: On a Mac with Apple silicon, Activation Lock is enforced by verifying the LocalPolicy nonce hash values with the Secure Storage Component.",
            "C: On Intel-based Mac computers with the T2 chip, Activation Lock is enforced by ensuring a physical security key is present before boot.",
            "D: For all Apple devices, a user-defined security code is used to enforce Activation Lock."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "ActivationLock"
    },
    {
        "id": "04ae0721-b964-4921-bffc-dce0a7c99de1",
        "source": "windows_security",
        "question": "Which of the following practices is least likely to be included in a robust security assurance process during the software development lifecycle?",
        "choices": [
            "A: Conducting regular code reviews to identify security vulnerabilities.",
            "B: Implementing strong encryption algorithms to protect data.",
            "C: Deferring all security considerations to the post-deployment phase.",
            "D: Integrating automated security testing tools within the development pipeline."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Proactive Security Measures"
    },
    {
        "id": "513cb7db-09db-4ca2-8013-de2e303f4d2a",
        "source": "cwe",
        "question": "You are reviewing a piece of code that processes user input for a web application. The application needs to handle a variety of text inputs, including some with special characters. You're tasked with implementing strategies to prevent encoding errors that could lead to security vulnerabilities. Which of the following strategies would be effective in mitigating potential encoding errors? (Select two)",
        "choices": [
            "A: Allow only a list of predefined acceptable inputs that match business rule logic, rejecting or transforming any input that does not conform.",
            "B: Use dynamic query strings that combine control and data, ensuring the use of special characters is limited to alphanumeric and whitespace.",
            "C: Decode and canonicalize inputs to a consistent internal representation before validation, avoiding double-decoding to prevent bypassing validation.",
            "D: Implement a denylist of malicious inputs and rely on it as the primary method of input validation to ensure security."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "EncodingError"
    },
    {
        "id": "f725c3e7-99fe-4eb2-b589-97d7c43de1b4",
        "source": "cwe",
        "question": "In designing a secure system that frequently passes objects to various methods, what are the primary considerations when choosing between cloning mutable objects versus using immutable objects as arguments?",
        "choices": [
            "A: Cloning preserves original object state but may incur performance overhead, while immutable objects ensure security without performance impact but may limit functionality.",
            "B: Cloning creates unnecessary redundancy in the codebase, while immutable objects can be altered without affecting the original object state.",
            "C: Cloning can lead to security vulnerabilities if not implemented correctly, while immutable objects prevent any form of object state modification.",
            "D: Cloning requires additional storage space, while immutable objects require complex refactoring of existing code to support immutability."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "ImmutableVsClone"
    },
    {
        "id": "9a0f92ea-11dd-42e8-9a0f-73655a4b44c6",
        "source": "apple_platform_security",
        "question": "Why might relying solely on the HomeKit protocol's default settings not be the most secure approach to setting up a smart home network?",
        "choices": [
            "A: Default settings might not restrict accessory access to the internet beyond the manufacturer-provided list of sites and ports, which may not account for all possible vulnerabilities.",
            "B: The use of PPSK for all accessories might not be supported, leaving some devices using a common Wi-Fi password that could be compromised.",
            "C: HomeKit data is only encrypted in backups, leaving local data storage on the devices vulnerable to unauthorized access.",
            "D: Automatic default settings could allow unrestricted local network access until a manufacturer-provided list is available, potentially exposing the network."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "SecuritySettings"
    },
    {
        "id": "948cd20f-b671-4b29-9fc8-016120ca4b43",
        "source": "owasp_wstg",
        "question": "You have been tasked with conducting a security assessment of a web application using a popular security testing guide. During the assessment, you notice that the guide is very helpful and decide to include some of its content into your company's internal documentation. Considering best practices for copyright and licensing, which of the following actions should you take?",
        "choices": [
            "A: Reproduce the content verbatim in the internal documentation without any attribution, as security testing methodologies are universally known.",
            "B: Include excerpts from the guide in the internal documentation while providing proper attribution and a link to the guide's license.",
            "C: Modify the content of the guide to fit your company's branding and distribute it internally without referencing the original source.",
            "D: Use the guide as a reference but create entirely original content for the internal documentation to avoid copyright issues."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Creative Commons 4.0 License"
    },
    {
        "id": "646c5447-9f6f-470e-9eb6-c8486f9e5a8f",
        "source": "cs161_textbook",
        "question": "In the context of defending against XSS attacks, an application developer argues that replacing potentially dangerous characters with their HTML encoding is always sufficient to prevent XSS. Choose the counterargument(s) that demonstrate why this method might not be foolproof.",
        "choices": [
            "A: Attackers can use encoding techniques that bypass simple character replacements, allowing malicious scripts to be executed.",
            "B: HTML encoding prevents data from being interpreted as code, which is always effective regardless of the context.",
            "C: Character encoding may not protect against XSS in all contexts, such as when user input is placed inside a JavaScript context.",
            "D: Encoding is only effective when combined with a Content Security Policy (CSP) that disables inline JavaScript execution."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "XSS Defense"
    },
    {
        "id": "d9d13637-21dc-4000-875f-6f72afde27d0",
        "source": "windows_security",
        "question": "You are a security administrator tasked with setting up a system for detecting potential intrusions on a network of Windows-based systems. You decide to use Windows Event Forwarding (WEF) as part of your strategy. What are the advantages of using WEF in this scenario? (Select two)",
        "choices": [
            "A: WEF enables real-time response to detected intrusion attempts.",
            "B: WEF allows for the centralized collection of events from multiple devices.",
            "C: WEF provides automatic mitigation of intrusions without the need for administrator intervention.",
            "D: WEF can help in reducing the volume of events by filtering out irrelevant information before forwarding."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Windows Event Forwarding"
    },
    {
        "id": "719a5258-b425-42e2-9d02-cd098614aee7",
        "source": "windows_security",
        "question": "A Windows 10 enterprise environment is considering implementing the Blocking Untrusted Fonts feature to improve security. If the feature is turned on, what could be the potential implications for the network and users?",
        "choices": [
            "A: All fonts, including those in the '%windir%/Fonts' directory, will be blocked from loading.",
            "B: Fonts installed outside of the '%windir%/Fonts' directory will be blocked, potentially impacting the rendering of websites and documents that rely on untrusted fonts.",
            "C: The feature will prevent any font, trusted or untrusted, from being logged in the event log, reducing visibility into font usage.",
            "D: Print jobs sent to a remote printer server that does not exclude the spooler process may not print fonts not available in the server's '%windir%/Fonts' folder."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Blocking Untrusted Fonts feature"
    },
    {
        "id": "afd33e5f-4696-4fbf-b4d7-ae6aba9b7fa4",
        "source": "apple_platform_security",
        "question": "Which features of the Secure Enclave are designed to condition data access based on the device's mode of operation? Select all that apply.",
        "choices": [
            "A: Lockable seed bits in the AES Engine deny access to password-protected data when booting from DFU mode.",
            "B: The True Random Number Generator (TRNG) adjusts its entropy output based on the device's current state to enhance security during critical operations.",
            "C: The UID and GID keys generated by the Secure Enclave are used to encrypt data differently depending on whether the device is in normal or recovery mode.",
            "D: Sealed Key Protection (SKP) uses the UID and sepOS hash combination to prevent access to keying material if critical system changes occur without user authorization."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "DataAccessConditioning"
    },
    {
        "id": "56b21f93-be65-48d1-b336-54c1ec370422",
        "source": "owasp_wstg",
        "question": "A web server does not specify the character encoding in use, leading to potential security vulnerabilities. Why does the unspecified character encoding increase the risk of security issues such as XSS attacks?",
        "choices": [
            "A: The browser defaults to the most secure character encoding, which may not match the server's encoding, leading to a misinterpretation of the input.",
            "B: Without specifying the character encoding, the server cannot determine which characters are special, creating an opportunity for alternative encodings of special characters to be executed by the browser.",
            "C: Unspecified character encoding leads to the server automatically rejecting all input containing characters above ASCII value 128, causing a denial of service.",
            "D: Browsers are unable to render any characters above ASCII value 128, resulting in a loss of data integrity for the web application."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Character Encoding"
    },
    {
        "id": "fec2f025-f550-46f0-9f36-9b3407e90261",
        "source": "owasp_mastg",
        "question": "An iOS application development team is considering implementing a Virtual Private Network (VPN) to secure communication between the app and its backend services. What are the advantages and potential drawbacks of this approach? Select two.",
        "choices": [
            "A: Advantage: A VPN can provide an additional layer of encryption for data in transit, enhancing privacy and security.",
            "B: Advantage: Implementing a VPN allows the application to bypass client-side security mechanisms, simplifying development.",
            "C: Drawback: A VPN might introduce latency issues, potentially affecting the user experience.",
            "D: Drawback: Using a VPN prevents the application from implementing its own encryption algorithms, reducing overall security."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "VPN (Virtual Private Network)"
    },
    {
        "id": "59a857ab-e667-4667-bac2-792ba6779342",
        "source": "d3fend",
        "question": "An organization is planning to enhance its cybersecurity posture by mapping out all the data flows between its systems at the application layer, to ensure that data exchange complies with their intended design. Which technique from the D3FEND model should be primarily implemented to accomplish this task?",
        "choices": [
            "A: Operational Activity Mapping (D3-OAM)",
            "B: Service Dependency Mapping (D3-SVCDM)",
            "C: Data Exchange Mapping (D3-DEM)",
            "D: Network Traffic Policy Mapping (D3-NTPM)"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Data Exchange Mapping (D3-DEM)"
    },
    {
        "id": "5cfaacc9-87f6-4a22-a85d-3e62a2b58401",
        "source": "owasp_mastg",
        "question": "You are tasked with ensuring the secure storage of sensitive data in a mobile application developed for the iOS platform. Which of the following practices should you implement to align with best practices for cryptographic storage on this platform?",
        "choices": [
            "A: Use the built-in Keychain services for storing sensitive data such as passwords and cryptographic keys.",
            "B: Store sensitive information in plain text within the application's sandbox to simplify application development.",
            "C: Encrypt sensitive data using a hard-coded symmetric key within the application's source code.",
            "D: Utilize user defaults for storing sensitive data, as they are automatically encrypted by the iOS operating system."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Cryptographic Storage"
    },
    {
        "id": "03f527f5-b6a0-42f2-b679-031a1aded62b",
        "source": "attck",
        "question": "In the context of network reconnaissance by malware, why would a threat actor choose to use the command `ipconfig /all` instead of just `ipconfig`?",
        "choices": [
            "A: To obtain a concise overview of the network interfaces only.",
            "B: To gather detailed configuration data including DNS and DHCP settings.",
            "C: To reduce the amount of data to analyze for faster operation.",
            "D: To interact directly with network hardware bypassing the OS."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Network Command"
    },
    {
        "id": "64833db9-4441-4a43-be12-3bc3d6a64826",
        "source": "apple_platform_security",
        "question": "An iOS application developer is designing a secure messaging feature similar to iMessage. They must ensure the privacy and integrity of messages. Which of the following measures should the developer implement to achieve a security level comparable to iMessage's standards?",
        "choices": [
            "A: Use AES in CTR mode with a randomly generated key per message and RSA-OAEP to encrypt the message key.",
            "B: Store the private encryption and signing keys on a remote server to prevent their exposure if the device is compromised.",
            "C: Encrypt metadata such as timestamps and APNs routing information to prevent any form of data leakage.",
            "D: Generate a unique HMAC-SHA256 key for each message, derive a 40-bit value for message integrity, and encrypt the message using the device’s public key."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "iMessage"
    },
    {
        "id": "db155e64-0c03-4825-9f3b-f82222dedeec",
        "source": "android_sec_doc",
        "question": "An Android application developer is implementing a security feature that requires a unique key ID for continuous access to a specific cryptographic key, ensuring that subsequent calls operate on the same key. Given the need for consistent key access, which Keystore domain should the developer specify when accessing the key?",
        "choices": [
            "A: DOMAIN_APP",
            "B: DOMAIN_SELINUX",
            "C: DOMAIN_KEY_ID",
            "D: DOMAIN_BLOB"
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Keystore Domains"
    },
    {
        "id": "63369784-7b0f-4cfe-90a1-af5dfaa8c70e",
        "source": "owasp_mastg",
        "question": "In the context of mobile application development, dynamic code loading can be used to load and execute code at runtime. What are the potential security implications of using dynamic code loading?",
        "choices": [
            "A: It can increase the attack surface by allowing execution of untrusted code.",
            "B: It enhances security by ensuring that only the necessary code is loaded at runtime.",
            "C: It can complicate static analysis and make the detection of malicious code more difficult.",
            "D: It restricts the application's functionality, reducing the risk of security vulnerabilities."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "dynamic code loading"
    },
    {
        "id": "01ae4df4-cd01-4e2a-b797-396f59f49072",
        "source": "android_sec_doc",
        "question": "As an Android UI designer, you're tasked with creating the Shield Icon for the Protected Confirmation feature. Your colleague suggests that the Shield Icon should have a container corner radius of 4dp to match the Arrow icon. What is the most accurate counterargument to this suggestion?",
        "choices": [
            "A: The Shield Icon does not require a container corner radius specification.",
            "B: The Shield Icon should have a container corner radius of 8dp for better visibility.",
            "C: The Shield Icon must have a larger icon size of 48dp.",
            "D: The Shield Icon's container corner radius should be 2dp to create a sharper appearance."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Protected Confirmation Design"
    },
    {
        "id": "e6692719-ad61-4584-a59e-4e13dd9292d9",
        "source": "owasp_wstg",
        "question": "A web application needs to enhance security for its session cookies. Which of the following attributes should be set to ensure that cookies are not unnecessarily exposed to security risks?",
        "choices": [
            "A: Set the Secure attribute to ensure cookies are sent over HTTPS only, preventing unencrypted transmission.",
            "B: Set the Domain attribute to '.com' to restrict cookies to the top-level domain only, limiting their use to the main site.",
            "C: Set the Path attribute to '/' to narrow the scope of the cookies to the most specific section of the site.",
            "D: Set the SameSite attribute to 'Strict' to prevent the cookies from being sent on requests initiated by third-party sites."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cookie Security Attributes"
    },
    {
        "id": "8233324b-61d2-4ae9-8493-1ec519ddff9b",
        "source": "cs161_textbook",
        "question": "Consider a scenario where a developer is implementing an intrusion detection system for a web application. The developer decides to use a specification-based detection strategy. What could be the potential benefits and drawbacks of this approach?",
        "choices": [
            "A: The system may have a very low false positive rate if the specifications are well-defined.",
            "B: It can require significant time to manually write specifications for complex web applications.",
            "C: Such a system can automatically adapt to changes in user behavior over time without manual intervention.",
            "D: The system can detect new attacks that deviate from the manually specified normal activity."
        ],
        "answer": "ABD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IntrusionDetection"
    },
    {
        "id": "15883e58-565c-4231-b73c-f2c35e7d9900",
        "source": "apple_platform_security",
        "question": "When adding a new credit card to Apple Pay, several security measures and processes are involved to ensure the safe provisioning of the card. Select the steps that accurately describe this process and the security features in place.",
        "choices": [
            "A: The card issuer or network uses server-side calls such as Required Fields, Check Card, and Link and Provision to verify and approve the card for Apple Wallet.",
            "B: A photo of the credit card taken during the manual addition process is saved to the device and stored in the photo library for future reference.",
            "C: The Device Account Number created during provisioning is accessible by Apple and is the same as the credit or debit card number.",
            "D: The Secure Element contains a unique Device Account Number encrypted in such a way that Apple cannot access it, distinct from the card number."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Provisioning"
    },
    {
        "id": "fb812f20-6436-454e-a6c0-2cdc8955b965",
        "source": "owasp_mastg",
        "question": "In the context of an iOS application security assessment, an auditor finds that an application stores sensitive user data, such as login credentials, within its 'Custom resource files' directory. Which of the following is a likely security concern that arises from this practice, and what could be a potential remedy?",
        "choices": [
            "A: Storing sensitive data in 'Custom resource files' can lead to data leakage if the files are not encrypted, and the remedy is to implement proper data encryption mechanisms.",
            "B: There's no concern as 'Custom resource files' are designed to securely store sensitive data, and the application is following best practices.",
            "C: The main concern is that storing data in 'Custom resource files' will make the app run slower, and the remedy is optimizing the application's performance.",
            "D: Sensitive data in 'Custom resource files' could be compromised via SQL injection, and using parameterized queries is the remedy."
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Data Encryption"
    },
    {
        "id": "d92e3b1b-35ed-4c74-9881-654c5a750504",
        "source": "attck",
        "question": "An adversary has just taken ownership of a critical system file on a server. What could be the possible reason for this action?",
        "choices": [
            "A: To escalate privileges and gain administrative control over the system.",
            "B: To modify, replace, or delete specific files or directories as part of establishing persistence or executing a malicious payload.",
            "C: To harden the system against other adversaries by improving file system access controls.",
            "D: To prepare the system for an upcoming legitimate software update."
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "File and Directory Permissions Modification"
    },
    {
        "id": "9aa89e62-6022-4989-8a48-9454f54a89dc",
        "source": "owasp_wstg",
        "question": "A web application uses a parameter in the URL to determine which user's profile page to display. The application does not perform proper authorization checks on this parameter. Which of the following actions represents a direct exploitation of this Insecure Direct Object Reference (IDOR) vulnerability?",
        "choices": [
            "A: Brute-forcing the username and password fields on the login page to gain unauthorized access to a user's profile.",
            "B: Changing the parameter in the URL to the identifier of another user's profile, potentially gaining unauthorized access to their information.",
            "C: Sending a phishing email to a user to trick them into revealing their password, thus gaining access to their profile page.",
            "D: Exploiting a cross-site scripting weakness on the user's profile page to inject malicious JavaScript."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Insecure Direct Object References (IDOR)"
    },
    {
        "id": "fa500e4e-7516-4aa7-b388-ab3793387e24",
        "source": "windows_security",
        "question": "In the context of Windows security, which of the following practices is recommended when configuring User Account Control (UAC) to enhance security during elevation prompts?",
        "choices": [
            "A: Disabling the secure desktop switch to allow users to interact with elevation prompts in their current desktop environment.",
            "B: Enabling the secure desktop switch to prevent other programs from interacting with the elevation prompt.",
            "C: Configuring UAC to automatically deny all elevation requests to minimize the risk of unauthorized changes.",
            "D: Allowing all users to approve elevation requests without administrative credentials to streamline workflow."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "User Account Control"
    },
    {
        "id": "2d5feefa-d17a-44a5-91b6-6efe0d69d793",
        "source": "windows_security",
        "question": "An administrator needs to configure a Windows Event Forwarding (WEF) subscription that prioritizes timely delivery of critical alerts while also aiming to limit network bandwidth consumption as much as possible. Which of the following subscription delivery options should the administrator select and configure correctly to meet these requirements?",
        "choices": [
            "A: Normal delivery with pull mode, batching 5 items at a time and setting a batch timeout of 15 minutes.",
            "B: Minimize bandwidth with push delivery mode and a batch timeout of 6 hours, plus a heartbeat interval of 6 hours.",
            "C: Minimize latency with push delivery mode and setting a batch timeout of 30 seconds.",
            "D: Custom delivery with push delivery mode, setting DeliveryMaxItems to 1 and DeliveryMaxLatencyTime to 10 ms."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "WEF Subscription Configuration"
    },
    {
        "id": "d9e4ad6c-7bc5-402c-ae34-e1dce0057efb",
        "source": "apple_platform_security",
        "question": "When designing a secure network, an administrator must consider various factors that could potentially impact security. What are the possible consequences of not implementing proper network access controls? (Select all that apply)",
        "choices": [
            "A: Unauthorized access to sensitive data may occur.",
            "B: Network performance can be increased due to reduced overhead.",
            "C: There may be an increased risk of data breaches and exploitation of network resources.",
            "D: Compliance with industry security standards can be more easily achieved."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "NetworkAccessControl"
    },
    {
        "id": "fd136413-5d55-4186-909f-06947f546b86",
        "source": "attck",
        "question": "A company's security policy allows all users unrestricted permissions to create, delete, and modify cloud compute infrastructure components to foster a flexible working environment. Which of the following arguments BEST counters this policy by emphasizing the necessity for restrictive permissions?",
        "choices": [
            "A: Unrestricted permissions can lead to increased operational efficiency and should be maintained for maximum productivity.",
            "B: Allowing all users unrestricted permissions can compromise security, as it may bypass restrictions that prevent access to existing infrastructure.",
            "C: Restrictive permissions hinder the ability of users to collaborate effectively on cloud-based projects.",
            "D: Unrestricted permissions are necessary to ensure that all users can respond quickly to any required changes or updates in the cloud environment."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "User Account Management"
    },
    {
        "id": "4e2a1f5d-80ad-4135-b263-08407419b642",
        "source": "attck",
        "question": "An adversary has employed protocol tunneling to hide malicious traffic within encrypted HTTPS packets, evading network filtering and reaching systems that would otherwise be inaccessible. As a security analyst, you are tasked with proposing mitigation strategies to counter this threat. Which of the following strategies would be effective in mitigating the risks associated with protocol tunneling used for command and control activities, and why might they be beneficial?",
        "choices": [
            "A: Implement strict egress filtering to prevent unauthorized outbound connections, potentially disrupting the adversary's established communication channels.",
            "B: Increase the complexity of network passwords to prevent adversaries from gaining initial access, thereby avoiding the need for protocol tunneling.",
            "C: Employ network intrusion prevention systems to identify and prevent traffic associated with specific adversary malware based on network signatures.",
            "D: Encourage users to adopt strong endpoint security practices, such as regular patching, which can indirectly mitigate the risk of protocol tunneling."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Protocol Tunneling"
    },
    {
        "id": "1f16710f-c35b-424b-bbcc-7cf9b2d5b62b",
        "source": "windows_security",
        "question": "When assessing the security considerations for policy settings in Windows 10 and Windows 11, why might an IT professional disregard 'User Rights Assignment' as non-critical to securing the enterprise against malicious software threats?",
        "choices": [
            "A: User Rights Assignment is critical and should not be disregarded as it defines user permissions that can limit the actions malware may perform.",
            "B: User Rights Assignment only applies to older versions of Windows and is not relevant for Windows 10 and Windows 11.",
            "C: User Rights Assignment is managed automatically by Windows and does not require manual configuration.",
            "D: User Rights Assignment is not a security setting and does not contribute to the mitigation of malware threats."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "User Rights Assignment"
    },
    {
        "id": "d0da9864-a45f-4811-bf20-ddf54841aafd",
        "source": "cs161_textbook",
        "question": "Why is the Hypertext Transfer Protocol (HTTP) considered fundamental in the context of web security?",
        "choices": [
            "A: HTTP is the only protocol used to encrypt data transmitted over the web, ensuring confidentiality.",
            "B: HTTP serves as the primary language for client-server communication on the web, affecting resource access control and data integrity.",
            "C: HTTP exclusively determines the physical network paths for data packets, directly impacting network efficiency and performance.",
            "D: HTTP is a redundant system that serves as a backup for the Secure Shell (SSH) protocol in web transactions."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP"
    },
    {
        "id": "9cbbdc44-9115-48a4-a8b8-6abd14759a04",
        "source": "cwe",
        "question": "A software company is developing a health management platform which leverages several third-party libraries for data processing and visualization. To enhance security posture and streamline vulnerability management, what should be included in the company's security policy regarding third-party components?",
        "choices": [
            "A: Require vendors to only use proprietary components to avoid public vulnerability disclosures.",
            "B: Maintain a Software Bill of Materials (SBOM) for active monitoring of component changes and vulnerabilities.",
            "C: Outsource all security patching responsibilities to third-party component vendors.",
            "D: Implement manual checks for updates and patches at yearly intervals for each component."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Third-Party Component Security"
    },
    {
        "id": "59752af5-aeb5-4767-a9ac-cbe3ac288fb3",
        "source": "attck",
        "question": "In setting up a monitoring system to detect potential website defacement, which of the following would NOT be an effective data source or component to monitor according to best practices?",
        "choices": [
            "A: Changes made to files for unexpected modifications to internal and external websites.",
            "B: Traffic patterns and packet inspection associated with protocol(s) that do not follow expected standards.",
            "C: CPU usage spikes to detect unauthorized computational resource consumption.",
            "D: Third-party application logging for modifications to visual content available on the network."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Content"
    },
    {
        "id": "9075cd44-dbc4-4ea8-bb64-f397f2098365",
        "source": "attck",
        "question": "A financial organization has observed unusual network traffic and suspects that an adversary might be using remote access software for command and control activities. As a security analyst, you are tasked with recommending mitigation strategies. Which of the following methods would be effective in preventing the installation and use of unauthorized remote access tools?",
        "choices": [
            "A: Implement application control to prevent execution of unapproved software.",
            "B: Increase the strength of user passwords across the network.",
            "C: Deploy a software patch management system for automatic updates.",
            "D: Consolidate all remote access under a single, less-known remote access tool to avoid detection."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Application Control"
    },
    {
        "id": "53d81fbe-2e91-4f80-a5c5-a43747d47705",
        "source": "cs161_textbook",
        "question": "In what ways does obtaining David Wagner's digital certificate from an untrusted source potentially impact Alice's ability to establish a secure communication channel with David?",
        "choices": [
            "A: The integrity of the certificate may be compromised, but Alice can verify its validity if she has Jerry's public key.",
            "B: Alice cannot be certain of the certificate's validity since it comes from an untrusted source.",
            "C: The certificate's origin does not impact its validity as long as Alice can verify the signature using Jerry's public key.",
            "D: Alice is at risk of man-in-the-middle attacks if she does not obtain the certificate from a trusted source."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Certificate Verification"
    },
    {
        "id": "31030e6c-998e-4e75-98db-56b1b8956a5d",
        "source": "android_sec_doc",
        "question": "When using RSA keys in an Android Keymaster for unpadded signing operations, which of the following measures should be taken if the provided data is shorter than the key's length?",
        "choices": [
            "A: The data should be left zero-padded on the right before signing.",
            "B: The data should be left zero-padded on the left before signing.",
            "C: The operation should proceed without padding, as the input length is irrelevant.",
            "D: The data should be rejected and the operation aborted, as RSA keys require data to match their length exactly."
        ],
        "answer": "B",
        "topics": [],
        "keyword": "RSA Unpadded Signing"
    },
    {
        "id": "ab6b8430-b4e1-49f9-96ba-6a79ca43a8f5",
        "source": "apple_platform_security",
        "question": "On a Mac with Apple silicon, there are three security policies: Full Security, Reduced Security, and Permissive Security. Each policy offers different levels of protection and operational capabilities. Select the statements that accurately describe the features or implications of these security policies.",
        "choices": [
            "A: Full Security policy uses a personalized signature for each Apple CPU, tying a version of macOS to a specific Mac, which provides better protection against rollback attacks.",
            "B: Reduced Security allows for the booting of any third-party kernel extensions without requiring a reboot due to the inclusion in the Auxiliary Kernel Collection.",
            "C: Permissive Security allows the booting of user-generated Boot Kernel Collections and supports running fully untrusted operating system kernels.",
            "D: The Permissive Security setting disables signature verifications entirely, allowing any software to be booted without checks."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SecurityPolicies"
    },
    {
        "id": "b2f3ea12-0823-4886-8560-4c80e67e2b2e",
        "source": "windows_security",
        "question": "In a Windows domain, if a security policy setting for 'Maximum lifetime for user ticket' was defined on the local computer, site, domain, and organizational unit (OU) levels, which policy setting will ultimately apply to a member server after a Group Policy update?",
        "choices": [
            "A: OU policy settings",
            "B: Domain policy settings",
            "C: Site policy settings",
            "D: Local policy settings"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Group Policy Order"
    },
    {
        "id": "03a34a6a-1c9e-491d-a1c8-e143f3a17fbc",
        "source": "cs161_textbook",
        "question": "Imagine you are a security consultant advising a client on the use of Certificate Authorities (CAs) for their web application. The client seeks to understand the risks and trust model associated with CAs in securing web communications. Which of the following statements accurately reflect aspects of this model and its potential risks?",
        "choices": [
            "A: The more CAs that are trusted by a browser, the lower the risk of a security breach, as this diversification means that trust is not concentrated in a single entity.",
            "B: A web application that buys a digital certificate from a CA ensures secure communication since the certificate links the domain to its public key, which browsers validate using the issuing CA's public key.",
            "C: If any one of the many trusted CAs behaves maliciously or issues a certificate to the wrong person, it could compromise the security of all web users.",
            "D: The CA's role is to maintain an online directory service that is less scalable, reliable, and useful than digital certificates, which is why they are not widely used today."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Certificates"
    },
    {
        "id": "0d088d56-63af-4009-bacf-277bf585f24e",
        "source": "attck",
        "question": "If an organization wants to proactively protect its Kerberos-based authentication system against ticket attacks, which of the following measures would be effective? (Select TWO)",
        "choices": [
            "A: Regularly rotating the KRBTGT account password to invalidate existing golden tickets.",
            "B: Implementing a single sign-on solution to replace Kerberos and thus eliminate the need for ticket management.",
            "C: Setting short expiration periods for service account passwords to prevent the abuse of long-term credentials.",
            "D: Storing credential cache Kerberos blobs in a world-readable directory to allow for easier monitoring by security tools."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "KRBTGT account password rotation"
    },
    {
        "id": "0c168594-8b5e-4a03-ae15-3e583b2a8526",
        "source": "apple_platform_security",
        "question": "In the context of mobile device management (MDM), which of the following statements correctly describe the features or functions of the various device enrolment types?",
        "choices": [
            "A: Automated Device Enrolment allows users to prevent the MDM profile from being removed.",
            "B: User Enrolment integrates with Managed Apple IDs and provides cryptographic separation of user and corporate data.",
            "C: Device Enrolment permits users to manually enrol devices and manage a wide range of device settings including device erasure.",
            "D: Automated Device Enrolment is primarily intended for devices that are personally owned but used within an organisational environment."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Enrolment"
    },
    {
        "id": "b7e8c76c-fe6d-48d5-9942-f771ad4346ed",
        "source": "android_sec_doc",
        "question": "In an Android device with a TrustZone-based Keymaster implementation that does not support key expiration, how does the Keystore system handle an attempt to use a key after its expiration date?",
        "choices": [
            "A: The secure hardware enforces the expiration and any cryptographic operation fails.",
            "B: The TrustZone-based implementation ignores the expiration date and allows the key usage.",
            "C: Keystore implements software-based enforcement, rejecting attempts to use the key after expiration.",
            "D: The key expiration is not enforced at all, and the key can be used without restrictions."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "TrustZone"
    },
    {
        "id": "6dc1c35c-8483-4b50-a23e-e72d439b6f92",
        "source": "apple_platform_security",
        "question": "In the context of iOS and iPadOS, why are different keybags used, and what are the potential security implications of using a backup keybag with a weak password?",
        "choices": [
            "A: User keybag is used for normal operation, and using a backup keybag with a weak password can be vulnerable to brute-force attacks.",
            "B: Device keybag stores keys for shared device configurations, and a weak password does not affect its security due to its user passcode independence.",
            "C: Escrow keybag allows Finder or iTunes syncing without a passcode, and a weak backup keybag password does not impact its security.",
            "D: The backup keybag is protected by a password and a weak password makes it susceptible to parallelised brute-force attacks."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Keybags Security"
    },
    {
        "id": "7231db3c-fb5e-4d85-ac89-88ac362f689b",
        "source": "cs161_textbook",
        "question": "You have inherited a large and complex codebase written in a memory-unsafe language, which you have been asked to update. Considering the impracticality of reasoning about each memory access and the necessity of employing code hardening defenses, select the options that correctly describe the purpose and effectiveness of these defenses:",
        "choices": [
            "A: Code hardening defenses ensure the complete elimination of memory safety exploits in the code.",
            "B: They are intended to make exploiting vulnerabilities harder and ideally cause any exploit attempts to fail by crashing the program.",
            "C: The use of multiple code hardening defenses together can create a compound effect, making it more challenging for an attacker to exploit the system.",
            "D: Code hardening defenses replace the need for reviewing and reasoning about the memory access in the code, thus fully guaranteeing security."
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "MemorySafety"
        ],
        "keyword": "CodeHardening"
    },
    {
        "id": "c8dd31e9-1a87-4956-a0bd-102c1612bfba",
        "source": "apple_platform_security",
        "question": "Which of the following are correct statements regarding the security features and processes used when adding credit or debit cards to Apple Wallet using Apple Pay?",
        "choices": [
            "A: During the provisioning of a card via a card issuer's app, the card details are encrypted using keys established between the app and the user's Apple device.",
            "B: The Secure Enclave's UID key and the Secure Element's unique identifier are used to generate a shared pairing key for Secure Enclave and Secure Element communication.",
            "C: When adding a card from a card issuer's website, the user must enter their card's CVV on the website before they are directed to Apple's secure sign-in experience.",
            "D: Additional verification for a card can include options like a text message, email, customer service call, or a method within an approved third-party app."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "ApplePay"
    },
    {
        "id": "f11e9c2e-3c6c-41e6-acf2-10375eafdadb",
        "source": "attck",
        "question": "As a cybersecurity analyst, you are monitoring cloud storage access for potential adversarial activities. Which of the following activities should raise an alert for possible unauthorized cloud storage object discovery?",
        "choices": [
            "A: Repeated access requests to cloud storage objects from recognized service accounts during peak business hours.",
            "B: Unusual queries to the cloud storage service from unexpected sources that could indicate improper permissions.",
            "C: Regular automated backups of cloud storage objects to a secure offsite location as part of disaster recovery planning.",
            "D: Successful login attempts followed by the download of publicly shared objects from the cloud storage."
        ],
        "answer": "B",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Storage Enumeration"
    },
    {
        "id": "b3f06b0b-19da-4c68-9da5-379a06b0f102",
        "source": "apple_platform_security",
        "question": "A user has activated Advanced Data Protection for their iCloud account but wants to maintain web access to their data via iCloud.com. Evaluate the consequences and mechanisms of the user's decision to enable web access after activating Advanced Data Protection.",
        "choices": [
            "A: Enabling web access after turning on Advanced Data Protection requires the user to authorise web sign-in on a trusted device, which temporarily uploads required service keys to iCloud web servers.",
            "B: Once web access is enabled, encrypted iCloud data remains inaccessible through the web, ensuring no decryption keys are exposed to iCloud web servers.",
            "C: Authorising web access after enabling Advanced Data Protection will allow iCloud web servers to decrypt and display the user's data without further device authorisation for each session.",
            "D: When web access is enabled, the user's device will only upload service keys for an allow list of services, and user notifications will be triggered upon each service key upload."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "iCloud Web Access"
    },
    {
        "id": "ace699e0-59c2-48e2-b221-4d9978cf02e4",
        "source": "attck",
        "question": "A cybersecurity team is analyzing a breach wherein an adversary used the 'Taint Shared Content' technique for lateral movement within the organization's network. The adversary added malicious scripts to files on network drives, which were then executed when accessed by unsuspecting users. Which of the following mitigation measures could best minimize the risk of such an attack in the future?",
        "choices": [
            "A: Restricting file and directory permissions to limit write access to shared folders.",
            "B: Increasing the password complexity requirements for user accounts.",
            "C: Implementing stronger network firewalls to filter out malicious traffic.",
            "D: Conducting regular user awareness training for recognizing phishing emails."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Lateral Movement"
    },
    {
        "id": "af9530ea-8f9c-4761-b1e9-f56a3c7abf26",
        "source": "cs161_textbook",
        "question": "Why are non-executable pages not considered a robust defense against attackers using Return-oriented programming (ROP)?",
        "choices": [
            "A: ROP allows the execution of arbitrary code by using existing executable code snippets, thus bypassing the need for writable and executable pages.",
            "B: Non-executable pages are easily made executable by standard user programs, rendering such defenses ineffective against any form of attack.",
            "C: The size of the code base and the number of imported libraries have no impact on the effectiveness of ROP, which requires only a small and constant set of gadgets.",
            "D: ROP compilers are not widely available, making it difficult for attackers to generate the necessary return addresses to exploit vulnerabilities."
        ],
        "answer": "A",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "Non-executable"
    },
    {
        "id": "0742ca88-dfd7-4b40-b042-8eec1b094f1a",
        "source": "cs161_textbook",
        "question": "In designing a new cryptosystem for a secure communication application, which of the following should be the top priority to keep secret from potential attackers based on Kerckhoff's Principle?",
        "choices": [
            "A: The underlying mathematical problems on which the encryption is based",
            "B: The source code of the encryption and decryption algorithms",
            "C: The secret key(s) used in the encryption and decryption process",
            "D: The documentation detailing the use and limitations of the cryptosystem"
        ],
        "answer": "C",
        "topics": [],
        "keyword": "Kerckhoff's Principle"
    },
    {
        "id": "0e6c063c-0fa5-4f58-9cad-851f0e22ae4e",
        "source": "apple_platform_security",
        "question": "When integrating ARKit into their iOS app, developers have to adhere to various security standards. Which of the following statements are true regarding the privacy and security features of ARKit?",
        "choices": [
            "A: ARKit apps can access the device’s cameras without user consent for augmented reality experiences.",
            "B: The user can control whether photos and videos taken with the ARKit app contain location data by adjusting settings in iOS.",
            "C: Third-party ARKit apps can use face tracking information without transparency or indication that the camera is in use.",
            "D: ARKit uses world tracking that processes sensor data on-device to determine user position relative to physical space without sending data externally."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "ARKitSecurity"
    },
    {
        "id": "79c8f3ee-a590-4dec-94d3-944a5ff07c4f",
        "source": "attck",
        "question": "Which of the following registry query actions would be least effective for a malware to gather valuable system information from a compromised host?",
        "choices": [
            "A: Querying HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces for network configuration details.",
            "B: Querying HKLM\\HARDWARE\\DESCRIPTION\\System for system hardware information.",
            "C: Querying HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced for user-specific Windows Explorer settings.",
            "D: Querying HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion for the operating system version and product name."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Windows Registry"
    },
    {
        "id": "6faddb1c-b879-4809-93fc-ca6dae025a27",
        "source": "owasp_wstg",
        "question": "As a security analyst, you have been tasked with evaluating the caching strategy used by a web application. Which of the following approaches to caching could potentially prevent Web Cache Deception attacks, and what would be a significant disadvantage of that approach?",
        "choices": [
            "A: Classifying and handling cached content based on file extension, but it could potentially cause false cache hits and serve incorrect content to users.",
            "B: Using content-type to determine caching policies, but this might lead to a higher server load since it requires a more dynamic analysis of content.",
            "C: Implementing cache-control headers strictly, but it may restrict some user experience features requiring frequent content updates.",
            "D: Allowing all user-generated paths to be cached, but this increases the risk of sensitive data exposure through cache-based attacks."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Cache-Control Headers"
    },
    {
        "id": "7100618b-0f78-4e60-b9c6-e69c4a850da6",
        "source": "attck",
        "question": "A company's network management system relies heavily on SNMP for device configuration. Recently, there has been an increase in cyber threats targeting configuration data. As a security consultant, you are tasked with enhancing the defense mechanisms against potential breaches. Which TWO of the following mitigation strategies would most effectively secure the SNMP data and the network traffic as a whole?",
        "choices": [
            "A: Implement SSL/TLS inspection for encrypted traffic to monitor and analyze traffic patterns that do not follow expected protocol standards.",
            "B: Configure a web application firewall to automatically block any SQL injection attempts detected in the network traffic.",
            "C: Apply extended ACLs to block unauthorized protocols outside the trusted network.",
            "D: Enforce password complexity requirements on all network devices to prevent unauthorized access."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "SNMP"
    },
    {
        "id": "f0a97f6c-30ef-4778-8eb3-759c5fbc4187",
        "source": "android_sec_doc",
        "question": "For an Android device that includes UFS-based storage and supports hardware-wrapped keys, which encryption flag would be the most suitable to enable hardware-wrapped keys for FBE?",
        "choices": [
            "A: emmc_optimized",
            "B: inlinecrypt_optimized",
            "C: wrappedkey_v0",
            "D: v2"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "hardware-wrapped keys"
    },
    {
        "id": "3726acf9-e1da-4733-a34a-2867c64892a0",
        "source": "windows_security",
        "question": "In the context of Windows security, which of the following algorithms are used by Windows cryptographic modules and what are the benefits of using Federal Information Processing Standards (FIPS) 140 certified cryptography?",
        "choices": [
            "A: RSA for signing, ensuring the use of US government-approved algorithms for security.",
            "B: MD5 for hashing, providing a fast and efficient way to generate hash values.",
            "C: ECDH with NIST curves for key agreement, proving the randomness for entropy sources.",
            "D: HKDF for key derivation, enhancing the security of key generation processes."
        ],
        "answer": "ACD",
        "topics": [
            "WebSecurity",
            "Cryptography"
        ],
        "keyword": "FIPS 140"
    },
    {
        "id": "3aae7ce1-d610-4a25-9cce-890e7ab5808a",
        "source": "owasp_mastg",
        "question": "In the context of secure communication for mobile applications, which of the following options ensure that data confidentiality and integrity are maintained during transmission?",
        "choices": [
            "A: Using a deprecated encryption algorithm that is widely supported for backward compatibility.",
            "B: Employing certificate pinning to prevent interception of data by unauthorized parties.",
            "C: Transmitting data over an unencrypted channel and relying on application logic for security.",
            "D: Obfuscating the data payload instead of encrypting it to reduce computational overhead."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Certificate Pinning"
    },
    {
        "id": "d05b6e38-1fad-4e9e-a4ff-43d355c91e36",
        "source": "cwe",
        "question": "You are tasked with securing a hardware system against authentication bypass vulnerabilities. You suggest funneling all access through a single choke point as a mitigation strategy. What is the primary advantage of this approach, and what could be a potential disadvantage?",
        "choices": [
            "A: Advantage: Simplifies access control checks; Disadvantage: May introduce a single point of failure.",
            "B: Advantage: Allows for multiple authentication pathways; Disadvantage: Increases the complexity of access control.",
            "C: Advantage: Reduces the need for an allowlist; Disadvantage: Decreases the security by limiting access checks.",
            "D: Advantage: Ensures multiple checkpoints for authentication; Disadvantage: Reduces system performance due to multiple checks."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "ChokePoint"
    },
    {
        "id": "642f0f29-3c12-4d84-834f-2064e53ed0f4",
        "source": "owasp_mastg",
        "question": "A developer is working on an Android application that needs to support devices running versions lower than Android 7.0 (API level 24). To ensure consistent cryptography across different API levels, which of the following libraries should the developer integrate, and what is the correct way to register the provider?",
        "choices": [
            "A: Use Bouncy Castle library and register the provider by calling `Security.addProvider(new BouncyCastleProvider())`.",
            "B: Use Conscrypt library and register the provider by calling `Security.addProvider(Conscrypt.newProvider())`.",
            "C: Use Conscrypt library and register the provider by calling `Security.insertProviderAt(new ConscryptProvider(), 1)`.",
            "D: Use the default Java Security Provider and no additional registration is required."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Conscrypt library"
    },
    {
        "id": "f2fad912-3d20-4dc4-8dbc-f4c7d2010996",
        "source": "attck",
        "question": "A financial institution has recently migrated its sensitive customer data to a cloud storage solution. However, the security team has been alerted to potential unauthorized access attempts. Based on the ATT&CK framework's guidelines, which of the following measures should the institution prioritize to mitigate this threat? (Select TWO.)",
        "choices": [
            "A: Encrypt data stored at rest in cloud storage.",
            "B: Increase the data upload frequency to prevent data stagnation.",
            "C: Restrict access to resources and cloud storage APIs using multi-factor authentication.",
            "D: Implement a strict password rotation policy every 30 days."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Cloud Storage Security"
    },
    {
        "id": "8b6449a0-7609-46b1-b9e7-0b108e4b1c03",
        "source": "attck",
        "question": "If an adversary is using remote access software like AnyDesk or TeamViewer for command and control within a network, which of the following detection methods would be least effective?",
        "choices": [
            "A: Monitoring network connections from untrusted hosts.",
            "B: Tracking process creation related to remote admin software.",
            "C: Inspecting outgoing traffic content for anomalies.",
            "D: Observing patterns of daytime employee logins for irregularities."
        ],
        "answer": "D",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Command and Control"
    },
    {
        "id": "343606d4-f518-4cbd-9648-a3bd0e3da2a1",
        "source": "cwe",
        "question": "Review the following pseudocode for an image recognition system and identify which part is LEAST likely to introduce a vulnerability related to adversarial input perturbations:",
        "choices": [
            "A: The function that scales image pixels to a normalized range before processing.",
            "B: The subroutine that applies a complex transformation algorithm to enhance image features.",
            "C: The logging mechanism that records each recognized image and the corresponding classification.",
            "D: The data augmentation process that slightly rotates and translates images during training."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "AdversarialResistance"
    },
    {
        "id": "8250f916-c99c-4ab2-8ad6-418303077550",
        "source": "cwe",
        "question": "An application developer argues that specifying an output encoding like UTF-8 in the HTTP header is sufficient to prevent XSS attacks on a web page. What is the best counterargument to this claim?",
        "choices": [
            "A: Specifying the encoding does not prevent XSS if the downstream component does not support or respect the specified encoding.",
            "B: All modern browsers automatically use UTF-8 encoding, rendering the specification in the header redundant.",
            "C: Output encoding should be handled by the client's browser, not the server, to ensure compatibility.",
            "D: UTF-8 encoding can only be used for English language web pages, limiting its effectiveness in a global application."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Encoding"
    },
    {
        "id": "a30d9d7b-1e7c-45d6-82e6-b32e48c5b79c",
        "source": "cwe",
        "question": "In designing a web application architecture, which of the following strategies for storing state information could potentially leave the application vulnerable to external control of critical state data?",
        "choices": [
            "A: Storing sensitive data on the server side only, using a framework that manages state information and enforces legitimate state transitions.",
            "B: Storing state information in encrypted cookies on the client side with integrity checking through the use of a message authentication code (MAC) algorithm.",
            "C: Storing state information in a hidden web form field without any server-side validation or encryption.",
            "D: Storing state information on the server side and implementing redundant security checks on both the client and server sides."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "StateDataStorage"
    },
    {
        "id": "aa473dc5-3dff-4dc9-aad0-e8b4771d10ad",
        "source": "attck",
        "question": "A financial organization is facing targeted phishing attacks, where attackers have been attempting to gain sensitive information through deceptive emails. As a security consultant, you are tasked with recommending mitigation strategies to defend against such attacks. Which of the following measures would be most effective in preventing the adversaries from successfully phishing for information?",
        "choices": [
            "A: Implement strict network traffic flow monitoring to detect unusual data transfers.",
            "B: Use anti-spoofing and email authentication mechanisms to filter messages based on sender domain validity.",
            "C: Increase the complexity of password policies to reduce the chance of credential compromise.",
            "D: Deploy antivirus software on all endpoints to automatically remove phishing messages."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Anti-spoofing"
    },
    {
        "id": "f190d94b-f408-4ee7-99cf-68235cbe0969",
        "source": "cwe",
        "question": "In a case study of a web application, a security audit reveals that users are able to access data belonging to other users by modifying a certain parameter in their browser's address bar. As a security consultant, what would be the best explanation for how this vulnerability may have been introduced into the system?",
        "choices": [
            "A: The user authentication process is not implemented correctly.",
            "B: The encryption algorithm used for user data is weak.",
            "C: The authorization functionality does not properly verify if the user is entitled to access the requested data based on the modified parameter.",
            "D: The application's session timeout settings are too generous, allowing users to remain logged in for extended periods."
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "UserControlledKey"
    },
    {
        "id": "5d248a73-a789-48de-9796-e27ae7532297",
        "source": "android_sec_doc",
        "question": "You are designing the Protected Confirmation user interface for an Android app and need to customize its body text element. Which of the following properties will you apply to meet the design guidelines?",
        "choices": [
            "A: Font face: Roboto-Regular, Font size: 16sp, Line height: 24dp",
            "B: Font face: Roboto-Medium, Font size: 22sp, Line height: 28dp",
            "C: Font face: Roboto-Regular, Font size: 14sp, Line height: 20dp",
            "D: Font face: Roboto-Medium, Font size: 16sp, Line height: 24dp"
        ],
        "answer": "A",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "UI Design"
    },
    {
        "id": "ce9c94db-4e17-4938-87af-2aa8d81f1f3b",
        "source": "cs161_textbook",
        "question": "Consider you've clicked a URL in your browser. Which of the following parts of the URL will not be sent to the server but will affect how the browser displays the page?",
        "choices": [
            "A: The port number",
            "B: The username",
            "C: The anchor",
            "D: The path"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "URL Behavior"
    },
    {
        "id": "e73e0da7-c2eb-4576-894c-49a9f0066d75",
        "source": "owasp_mastg",
        "question": "A mobile application development team is considering whether to implement stateful or stateless authentication. Their primary concern is scalability and reducing server load. Which authentication method should they choose, and why?",
        "choices": [
            "A: Stateful authentication, because it generates a unique session ID for each user, reducing the need to store user data.",
            "B: Stateful authentication, because it maintains user data on the server, improving performance by eliminating client-side processing.",
            "C: Stateless authentication, because it eliminates the need to store session state on the server, improving scalability.",
            "D: Stateless authentication, because it requires a unique session ID, allowing for better load distribution across servers."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Stateless Authentication"
    },
    {
        "id": "8f574b93-a7c9-4579-b790-42164beeffea",
        "source": "owasp_mastg",
        "question": "In a team discussion about mobile application security, one developer argues that using 'dlfcn.h' for dynamic loading of shared libraries is always a security risk and should be avoided. As a security expert, how would you counter this argument?",
        "choices": [
            "A: Dynamic loading is inherently secure and poses no risk, so 'dlfcn.h' can be used without concern for security.",
            "B: Although dynamic loading can introduce security risks, using 'dlfcn.h' with best practices such as absolute paths and immediate symbol resolution mitigates these risks.",
            "C: Dynamic loading of shared libraries is not supported on mobile platforms, so the use of 'dlfcn.h' is irrelevant.",
            "D: Using 'dlfcn.h' is only secure when loading libraries that have been statically linked at compile-time."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Dynamic Loading"
    },
    {
        "id": "e5836ecb-2e6c-4569-a2ab-ce7b11afcc7a",
        "source": "owasp_mastg",
        "question": "In C++ programming, ensuring the correct inclusion of header files is important for application security. Which of the following scenarios could potentially create a security risk if the developer uses an incorrect header file inclusion syntax?",
        "choices": [
            "A: The program might fail to compile, leading to a delay in the development process.",
            "B: The compiler may include the wrong version of a library, possibly containing known vulnerabilities.",
            "C: A missing library could cause the program to crash at runtime if the functions from the library are called.",
            "D: Including a local header file instead of a system library could expose the application to malicious code injection if the local file is tampered with."
        ],
        "answer": "BD",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Header File Inclusion"
    },
    {
        "id": "e33caa01-13fa-40aa-a4b5-3dfa70bdf138",
        "source": "cs161_textbook",
        "question": "A web server is experiencing a DoS attack where the attacker is spoofing the source IP address with each packet, making it difficult to simply blacklist offending IP addresses. What steps should the network administrator consider to mitigate this attack? (Select two.)",
        "choices": [
            "A: Implement rate limiting to restrict the number of requests from a single source in a given timeframe.",
            "B: Deploy a CAPTCHA system to distinguish between legitimate users and automated traffic.",
            "C: Increase the bandwidth of the server to accommodate the additional traffic from the attack.",
            "D: Utilize a packet analyzing tool to trace back the real source IP addresses of the attack."
        ],
        "answer": "AB",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DoS"
    },
    {
        "id": "881ba8de-aada-4511-80a5-7cd595abd301",
        "source": "cwe",
        "question": "Given a code snippet for an HMAC engine that processes messages using SHA-256, but only for messages up to 512 bits in length, which of the following steps, if implemented, would complete the HMAC engine to handle messages of arbitrary length?",
        "choices": [
            "A: Implementing an iterative function to break up a message into blocks of a fixed size.",
            "B: Increasing the size of the 'bigData' variable to support larger messages.",
            "C: Adding a random number generator to provide entropy for each message block.",
            "D: Changing the SHA-256 module to a SHA-512 module for increased security."
        ],
        "answer": "A",
        "topics": [
            "Vulnerability"
        ],
        "keyword": "HMAC"
    },
    {
        "id": "0874c321-3eab-4bc4-8d82-fc7ca5024e80",
        "source": "attck",
        "question": "An incident responder finds that an adversary has executed the `netstat` command on a compromised machine. Why might the adversary choose `netstat` over other network enumeration techniques? (Select TWO.)",
        "choices": [
            "A: To explicitly list current connections, including IP addresses and port numbers.",
            "B: To exploit vulnerabilities within the `netstat` utility to gain elevated privileges.",
            "C: To avoid detection by blending in with legitimate administrative tools often used for diagnostics.",
            "D: To encrypt the traffic between the compromised machine and the adversary's command and control servers."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "netstat"
    },
    {
        "id": "c585b075-dd14-41c1-b6df-f877e79d17c8",
        "source": "attck",
        "question": "An organization’s security team observes unusual network traffic patterns and system resource usage. Analysis reveals repeated connections to suspicious external IP addresses known for hosting cryptocurrency pools, and high CPU usage by processes with cryptomining software names. As a cybersecurity professional, which of the following would be the most effective initial response to mitigate the impact of a potential Resource Hijacking incident?",
        "choices": [
            "A: Implement strict access controls on systems to prevent users from installing any software.",
            "B: Monitor executed commands and arguments for common cryptomining functionality.",
            "C: Increase the bandwidth of the network to accommodate the increased traffic.",
            "D: Deploy antivirus software to remove common viruses and malware."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Resource Hijacking"
    },
    {
        "id": "5a466d93-f94e-4d49-b053-4e694c42e847",
        "source": "attck",
        "question": "An adversary is attempting to gather detailed system configuration and installed software information from a Windows machine. Which of the following software or malware examples, according to the ATT&CK framework, could the adversary use to query the Registry for this purpose? (Select TWO.)",
        "choices": [
            "A: ADVSTORESHELL, which can enumerate registry keys.",
            "B: HOPLIGHT, which hooks lsass.exe but does not interact with the Registry.",
            "C: Bumblebee, which checks for specific keys in the Registry.",
            "D: InvisiMole, which is known for its advanced evasion techniques but not for querying the Registry."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Registry Query"
    },
    {
        "id": "04e0af8d-a47d-41d2-ae1a-49934d1b8d98",
        "source": "owasp_mastg",
        "question": "An iOS app developer aims to increase the security of their application against reverse engineering. Which of the following measures can enhance the app's resilience to tampering and reverse engineering, and what is a limitation that the developer should consider?",
        "choices": [
            "A: Implementing file-based checks for jailbreak detection improves app security by providing an absolute method to detect all jailbroken devices.",
            "B: Scattering jailbreak detection checks throughout the app's source code can improve the overall anti-tampering scheme, although they cannot guarantee 100% effectiveness.",
            "C: Using protocol handler checks like 'cydia://' to detect jailbroken devices is an outdated method and should not be considered for modern iOS security.",
            "D: Adding automated jailbreak detection bypass techniques to the app can thwart reverse engineers and make the app completely secure against debugging."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "Jailbreak Detection"
    },
    {
        "id": "938b518c-f052-46f0-82a5-6590be052915",
        "source": "windows_security",
        "question": "As an IT security administrator, you are assessing the potential risks associated with adjusting the 'Maximum lifetime for user ticket' policy in a Windows domain environment. If this policy's value is set too high, which of the following scenarios could pose a security risk?",
        "choices": [
            "A: Users may be unable to access network resources during their designated sign-in hours.",
            "B: Users may access network resources outside of their designated sign-in hours using valid tickets.",
            "C: Disabled user accounts will immediately lose access to network services.",
            "D: Ticket-granting tickets will require renewal more frequently, causing system performance issues."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Group Policy"
    },
    {
        "id": "70e163d9-e602-42b6-864e-11127b2932ef",
        "source": "apple_platform_security",
        "question": "A user with Advanced Data Protection for iCloud enabled decides to turn off the feature. What are the immediate steps taken by the user’s device in response to this action?",
        "choices": [
            "A: The user’s device uploads service keys for all services, including those end-to-end encrypted under standard data protection, such as iCloud Keychain and Health.",
            "B: The user’s device records the new choice in iCloud Keychain participation metadata and synchronizes this setting across all the user’s devices.",
            "C: Apple servers modify the user’s Advanced Data Protection settings to reflect the new choice.",
            "D: The device uploads both the original service keys and the new service keys generated after Advanced Data Protection was enabled."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Disabling Protection"
    },
    {
        "id": "6e03455e-5715-486e-bf20-87c35cedb4ec",
        "source": "windows_security",
        "question": "Your organization has implemented the Blocking Untrusted Fonts feature and is running it in Audit mode. The IT manager claims that this will cause immediate usability issues due to the blocking of untrusted fonts. What would be the best counterargument to this claim?",
        "choices": [
            "A: The Audit mode does not block fonts from loading; it only logs them, so there should be no immediate usability issues.",
            "B: The Audit mode increases the risk of EOP attacks, thus causing more usability issues due to increased security measures.",
            "C: Turning on the feature, even in Audit mode, will block all fonts indiscriminately, trusted or untrusted, leading to system-wide font issues.",
            "D: Audit mode will prevent any fonts from being installed on the system, whether from '%windir%/Fonts' or any other directories."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Audit mode"
    },
    {
        "id": "b1ae1660-99a3-4294-ba40-ddb45e597faf",
        "source": "owasp_wstg",
        "question": "An application uses the PHP connector for PostgreSQL to execute database queries. A developer is tasked with fetching a set number of news articles and offsetting the results based on user input. Which practice would be secure and appropriate for incorporating user input into the `LIMIT` and `OFFSET` clauses of a `SELECT` statement while mitigating the risk of SQL Injection?",
        "choices": [
            "A: Dynamically inserting user input directly into the `LIMIT` and `OFFSET` clauses without validation or sanitization.",
            "B: Casting user input to integers before including them in the `LIMIT` and `OFFSET` clauses.",
            "C: Using regular expressions to validate that user input consists solely of numeric characters before insertion into the `LIMIT` and `OFFSET` clauses.",
            "D: Implementing a fixed `LIMIT` value and ignoring user input for the `OFFSET` clause to ensure a consistent and secure query."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Input Validation"
    },
    {
        "id": "82371a29-d04a-4a11-88ee-221ae1bb23ea",
        "source": "cs161_textbook",
        "question": "You are analyzing the security of a DNS system and considering the potential impacts of on-path and off-path attackers. Given the following scenarios, select the outcomes that are consistent with the nature of DNS security challenges as described in the context of DNS cache behavior and attacker capabilities.",
        "choices": [
            "A: An on-path attacker can intercept DNS requests and respond with malicious records that will be cached if their response arrives first, regardless of the TTL value.",
            "B: An off-path attacker can frequently attempt to inject malicious DNS responses, as the caching behavior of DNS does not restrict the number of tries an attacker has.",
            "C: An off-path attacker's chances of successfully injecting a malicious DNS response are limited due to the need to guess the ID field and the caching of legitimate responses.",
            "D: On-path attackers can only read DNS requests but cannot send spoofed responses due to the secure nature of the DNS protocol."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNS Security"
    },
    {
        "id": "bd6146d7-74bf-46eb-8fc0-500fae7f4ed6",
        "source": "mozilla_security",
        "question": "A web developer is configuring a session identifier cookie for a secure web application on 'secureapp.example.com'. The cookie should not be accessible via JavaScript, must only be sent for requests to the 'secureapp.example.com' domain, should not be sent along with cross-origin requests, and must offer robust defense against CSRF attacks. Which of the following Set-Cookie header configurations would best achieve these requirements?",
        "choices": [
            "A: Set-Cookie: SECURESESSID=abc123; Domain=secureapp.example.com; Path=/; Secure; HttpOnly; SameSite=Strict",
            "B: Set-Cookie: SECURESESSID=abc123; Path=/; Secure; SameSite=None",
            "C: Set-Cookie: SECURESESSID=abc123; Expires=Fri, 31 Dec 9999 23:59:59 GMT; Domain=example.com; Path=/; HttpOnly",
            "D: Set-Cookie: SECURESESSID=abc123; Domain=secureapp.example.com; Path=/; Secure; SameSite=Lax"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Set-Cookie"
    },
    {
        "id": "0c9b5e48-6400-41cc-8f54-744382a28035",
        "source": "mozilla_security",
        "question": "What are the potential consequences of not using the 'integrity' attribute in a script tag when including a third-party JavaScript library?",
        "choices": [
            "A: The browser is unable to execute the script without an 'integrity' attribute.",
            "B: There is an increased risk of executing tampered code if the third-party library is compromised.",
            "C: Including the 'integrity' attribute causes the page to load slower due to hash computation.",
            "D: The 'integrity' attribute is only necessary when the script is executed in a cross-origin context."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Subresource Integrity (SRI)"
    },
    {
        "id": "f8fa5d9f-029e-4971-99ff-a54ed13cabf2",
        "source": "android_sec_doc",
        "question": "You are developing an Android device that only incorporates a Class 1 biometric sensor. According to Android's tiered authentication model and integration privileges, which API should you ensure your device's biometric sensor is integrated with?",
        "choices": [
            "A: android.hardware.biometrics APIs, as all biometric classes should be compatible with it.",
            "B: ACTION_BIOMETRIC_ENROLL API, to enable users to enroll in a secure and compatible authentication method.",
            "C: BiometricManager.Authenticators interface, to specify authentication types accepted by apps.",
            "D: None, as Class 1 biometrics are not allowed to integrate with any API due to security constraints."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "API Integration"
    },
    {
        "id": "a5b3974e-5fd4-4ade-ba3c-65071349faac",
        "source": "apple_platform_security",
        "question": "An Apple device with an A15 SoC is in the process of starting up. The Secure Enclave is initializing and preparing to load sepOS. Select the steps that accurately describe the security measures and components involved in this startup process.",
        "choices": [
            "A: The Secure Enclave Boot ROM establishes a hardware root of trust and initializes the Memory Protection Engine to provide cryptographic protection.",
            "B: The Application Processor sends the sepOS image to the Secure Enclave Boot ROM, which verifies the cryptographic hash and signature before executing sepOS.",
            "C: The Memory Protection Engine verifies the nonce and integrity tree for reads, and updates the nonce and integrity tree for writes to the SRAM.",
            "D: The Public Key Accelerator uses a hash of the sepOS to generate OS-bound keys before the Secure Enclave Boot ROM initiates the sepOS."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SecureBoot"
    },
    {
        "id": "10cc4543-69b8-42d1-96b4-8eb764a32326",
        "source": "apple_platform_security",
        "question": "In developing an application, a programmer decides to override certain default settings of App Transport Security (ATS) and chooses not to incorporate the recommended IPv6 security measures. What are the potential consequences of these actions?",
        "choices": [
            "A: The app may use weaker ciphers like RSA_AES without forward secrecy if the domain-specific forward secrecy requirement is disabled.",
            "B: The IPv6 addresses of the app's users could be more easily tracked across networks, reducing user privacy.",
            "C: The app's network connections could fail if the server does not support TLS 1.2 or if the server's certificate is not valid or strong enough.",
            "D: The app may experience uninterrupted service as certificate validity and revocation are not checked."
        ],
        "answer": "ABC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "Security Consequences"
    },
    {
        "id": "2d3f7fa9-f150-4d24-a87a-9fb5488611f1",
        "source": "attck",
        "question": "A security analyst is tasked with anticipating potential methods adversaries could use for gathering information during an operation. Considering typical adversary behaviors, which of the following methods could be used to capture the screen contents of a compromised desktop? (Select TWO.)",
        "choices": [
            "A: Utilizing a malicious browser extension to intercept Copy/Paste events",
            "B: Employing API calls such as `CopyFromScreen`, `xwd`, or `screencapture`",
            "C: Manipulating CSS rendering on a web page to mirror screen contents",
            "D: Activating a remote access tool's built-in feature for screen capturing"
        ],
        "answer": "BD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Remote Access Tool"
    },
    {
        "id": "e28c5b64-a631-4171-8e83-cc375f5cb13e",
        "source": "apple_platform_security",
        "question": "Which of the following features contribute to the secure handling of video data by HomeKit IP cameras?",
        "choices": [
            "A: Video streams are sent directly to local devices without encryption to ensure real-time viewing without delays.",
            "B: Video clips are encrypted with AES-256-GCM using a randomly generated key before being uploaded to iCloud servers.",
            "C: A per-session HKDF-SHA512 derived key-pair is used to encrypt video streams between the HomeKit IP camera and the home hub.",
            "D: HomeKit routers decrypt video streams for analysis before forwarding them to Apple servers for facial recognition processing."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "VideoSecurity"
    },
    {
        "id": "41cc6013-bdeb-4c46-8310-b6f415c21a0e",
        "source": "owasp_wstg",
        "question": "An application developer argues that setting the SameSite attribute of cookies to 'Lax' provides the best balance between security and user experience. Which of the following statements best counters this claim?",
        "choices": [
            "A: The 'Lax' setting can inadvertently allow cookies to be sent with some cross-site requests, potentially leading to information leakage.",
            "B: The 'Lax' setting is too restrictive and will prevent cookies from being sent on any third-party site requests, causing functionality issues.",
            "C: The 'Strict' setting is more balanced as it allows cookies to be sent with all requests, enhancing the user's navigation experience.",
            "D: The 'None' setting is the only option that fully protects against cross-site request forgery (CSRF) attacks."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SameSite Cookie Attribute"
    },
    {
        "id": "0b2c771a-8cd4-47c5-a46f-e2481f943013",
        "source": "cs161_textbook",
        "question": "If a network security consultant argues that placing detectors only at the network perimeter is sufficient for comprehensive intrusion detection, what is the best counterargument to this claim?",
        "choices": [
            "A: Detectors at the perimeter only provide limited visibility and cannot monitor internal network traffic or detect insider threats.",
            "B: Placing detectors at the perimeter is the most cost-effective approach and therefore cannot be improved upon.",
            "C: Perimeter detectors will overload the network with unnecessary traffic monitoring, causing latency issues.",
            "D: Having detectors at the perimeter can hinder the performance of the intrusion detection system due to environmental factors."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "PerimeterDetectorLimitations"
    },
    {
        "id": "267d70d2-7e49-409c-b927-a602361f30f5",
        "source": "cwe",
        "question": "In the aftermath of the OT:ICEFALL study which revealed that multiple Operational Technology products used default credentials, leading to 'insecure by design' vulnerabilities, you are evaluating various mitigation strategies. What could be the potential implications of continuing to use default passwords in these products, and what strategy would mitigate these implications?",
        "choices": [
            "A: Potential implication: Uninterrupted service continuity. Mitigation strategy: Implementing a system that locks the account after three unsuccessful login attempts.",
            "B: Potential implication: Easier for attackers to bypass authentication. Mitigation strategy: Forcing the administrator to change the credential upon installation.",
            "C: Potential implication: Enhanced user convenience for initial setup. Mitigation strategy: Enabling two-factor authentication for the default credentials.",
            "D: Potential implication: Improved system performance. Mitigation strategy: Encrypting the default password using a reversible encryption algorithm."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "MitigationStrategies"
    },
    {
        "id": "d8d21f8d-799d-4000-afbf-f72cb120ddcc",
        "source": "owasp_wstg",
        "question": "A developer claims that focusing on secure coding practices is sufficient to ensure web application security, and there is no need to consider design-level security measures. Which of the following arguments best counters this claim?",
        "choices": [
            "A: Secure coding practices are only one aspect of web application security, and design-level security measures are essential to mitigate threats that arise from architectural flaws.",
            "B: Secure coding practices are outdated, and modern web applications rely solely on third-party security tools for protection.",
            "C: Web application security is exclusively the responsibility of the network security team, not developers.",
            "D: Focusing on secure coding practices increases the cost and complexity of web application development, thus it should be avoided."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Design-Level Security"
    },
    {
        "id": "bb62352b-e26c-4503-a5a0-c451d8ab9022",
        "source": "owasp_wstg",
        "question": "A penetration tester is evaluating a web application's security and discovers several files within the web server's directory. Which of the following file types should be considered a potential security risk due to the likelihood of containing sensitive information or outdated code that may pose a threat to the application?",
        "choices": [
            "A: Current version files with the correct file extensions",
            "B: Old version files such as 'viewdoc.old.jsp' with outdated code",
            "C: Server-side code files with altered file extensions like 'login.asp.old'",
            "D: Newly uploaded media files like 'image-uploaded.jpg'"
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Unreferenced Files"
    },
    {
        "id": "a2a28828-0121-4b1a-97a1-6a124cb9c4bf",
        "source": "cs161_textbook",
        "question": "Why should Alice be cautious about placing complete trust in the proxy server when sending an anonymous message to Bob?",
        "choices": [
            "A: The proxy server could potentially log the decrypted messages and compromise the anonymity of the communication.",
            "B: The proxy server is not capable of decrypting messages and therefore cannot be trusted with sensitive information.",
            "C: Full trust in the proxy server is required as it is the only way to ensure the message reaches Bob without revealing Alice's identity.",
            "D: The proxy server may not use strong enough encryption methods, leaving the message vulnerable to decryption by eavesdroppers."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Trust"
    },
    {
        "id": "87951795-f2ba-4721-a5a9-35a015574e8f",
        "source": "apple_platform_security",
        "question": "In the context of Apple Pay, which of the following statements are true regarding the security features and card provisioning process?",
        "choices": [
            "A: The Secure Element hosts a specially designed applet to manage Apple Pay, and includes applets certified by payment networks or card issuers.",
            "B: The NFC controller ensures that all contactless payment transactions are conducted with a terminal that is not in close proximity to the device.",
            "C: During card provisioning, Apple Pay uses TLS 1.2 to transfer data between the client-server sessions.",
            "D: The Device Account Number is stored on Apple Pay servers and backed up to iCloud for recovery purposes."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "ApplePay"
    },
    {
        "id": "a52c0420-4b2f-4d1e-a3bb-45b5e2e90b6d",
        "source": "apple_platform_security",
        "question": "You are a network administrator tasked with upgrading an organization's wireless infrastructure to enhance security and privacy. Based on the provided information, which of the following actions should you take to achieve this goal?",
        "choices": [
            "A: Migrate all Wi-Fi implementations to WPA3 Personal or WPA3 Enterprise.",
            "B: Continue using WEP Shared with 104-bit keys for backward compatibility.",
            "C: Enable MAC address randomization on all devices that support it.",
            "D: Implement Wi-Fi frame sequence number randomization on compatible devices."
        ],
        "answer": "ACD",
        "topics": [
            "NetworkSecurity",
            "SystemSecurity"
        ],
        "keyword": "Wi-Fi Security"
    },
    {
        "id": "a9c1b2d6-c9b1-41be-acd7-931ed25ea67a",
        "source": "android_sec_doc",
        "question": "You are tasked with debugging an Android application that is failing to complete key attestation. The logs indicate a consistent failure with 'ErrorCode::CANNOT_ATTEST_IDS'. Which of the following reasons could be causing this attestation failure?",
        "choices": [
            "A: The identifiers supplied with the attestation request do not match the hardware identifiers known to the TEE.",
            "B: The device's secure element is offline, hence unable to process the attestation request.",
            "C: The attestation request is using an outdated API that is no longer supported on the device.",
            "D: The application is requesting attestation for too many hardware identifiers simultaneously, causing an overflow."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "TEE Verification"
    },
    {
        "id": "1b790c88-db7e-4fed-abf0-ead4f23a6cd9",
        "source": "attck",
        "question": "In an Infrastructure as a Service (IaaS) environment, an adversary has made authenticated API calls that returned data such as the operating system platform and status of a particular instance. What might be the adversary's next step given this information?",
        "choices": [
            "A: Exploiting known vulnerabilities specific to the retrieved operating system version.",
            "B: Immediately exfiltrating all accessible data without further reconnaissance.",
            "C: Launching a brute force attack on all user accounts within the IaaS environment.",
            "D: Assuming direct control over physical network devices in the IaaS provider's data center."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "IaaS Environment"
    },
    {
        "id": "ae6ef008-0353-4dfa-acbc-d8d551dbbe55",
        "source": "android_sec_doc",
        "question": "In the context of Android SELinux policies, which of the following statements represents the correct way to handle system property and process labeling to avoid naming collisions?",
        "choices": [
            "A: Control properties should use prefixes such as 'ctl.vendor.' and all read-only properties should start with 'ro.vendor.' to prevent naming collisions.",
            "B: For persistent properties, any prefix can be used as long as it does not clash with existing platform properties.",
            "C: Property namespaces are not necessary for the vendor properties, and all properties should start with 'vendor.' regardless of their type.",
            "D: Read-writable properties should start with 'rw.vendor.' and read-only properties should use the prefix 'ro.vendor.' for clear ownership and to avoid conflicts."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux Policy Namespacing"
    },
    {
        "id": "b92e0e55-b51c-4932-8619-acdd41d1cf22",
        "source": "attck",
        "question": "A security analyst is configuring a monitoring system to detect instances where adversaries may have modified the authentication process by implanting malicious network provider DLLs. Which data source and component should the analyst prioritize to effectively monitor for such modifications?",
        "choices": [
            "A: Active Directory: Active Directory Object Modification",
            "B: File: File Creation",
            "C: Application Log: Application Log Content",
            "D: Logon Session: Logon Session Creation"
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Provider DLLs"
    },
    {
        "id": "19dd6e6c-b87f-4d4d-9b8e-4ad2353c399f",
        "source": "owasp_wstg",
        "question": "When considering the implementation of black-box web application scanners in a security testing program, which of the following are advantages and disadvantages of using such tools?",
        "choices": [
            "A: Advantages: Can uncover hidden backdoors through exhaustive brute-force attacks; Disadvantages: May not detect issues in the design context of the code.",
            "B: Advantages: Requires a relatively lower skill-set than source code review; Disadvantages: May not be completely effective due to the nature of automated testing.",
            "C: Advantages: Can replace all other testing techniques due to advanced automation; Disadvantages: Not suitable for early stages of SDLC.",
            "D: Advantages: Can identify issues due to flaws in the design; Disadvantages: Requires significant manual effort to validate findings."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "black-box web application scanners"
    },
    {
        "id": "acf33f8a-5c7c-41ff-bc12-7bf2216e14f0",
        "source": "attck",
        "question": "An adversary is attempting to bypass signature-based defenses in a Windows environment by executing malicious content through a trusted binary. Which of the following system binaries could potentially be exploited for this purpose?",
        "choices": [
            "A: Mshta",
            "B: Notepad",
            "C: Msiexec",
            "D: Wordpad"
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "System Binary Proxy Execution"
    },
    {
        "id": "8850298a-a2ef-487f-9c21-480d86cf5e8f",
        "source": "apple_platform_security",
        "question": "An administrator is setting up single sign-on (SSO) for an organization's devices running iOS and iPadOS. What information must be included in the configuration profile payload to enable SSO functionality? Select all that apply:",
        "choices": [
            "A: The user principal name and Kerberos realm settings",
            "B: The AirDrop short identity hash",
            "C: The settings for which apps and Safari URLs are allowed to use SSO",
            "D: The Associated Domains payload for redirect type SSO extensions"
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "SSO"
    },
    {
        "id": "de1c290f-0dc4-4cf5-967a-443788c16ae8",
        "source": "cwe",
        "question": "Consider a system that uses security identifiers for access control to sensitive data, such as encryption keys stored in registers. The system's transaction scheme includes a special register called 'KEY_ACCESS_POLICY', which dictates which agents are allowed to access the encryption key registers based on their security identifiers. In this register, each bit corresponds to a security identifier, and if a bit is set to '1', the respective agent is allowed access; if set to '0', access is disallowed. Given that an agent with Security Identifier '3' is allowed to access the encryption keys, and that the default KEY_ACCESS_POLICY is set to '0x00000008', what would be the correct implementation and usage of the security identifier in a transaction initiated by this agent?",
        "choices": [
            "A: The agent sends the transaction with Security Identifier '0x00000008', which matches the allowed identifier in the KEY_ACCESS_POLICY register.",
            "B: The agent sends the transaction with Security Identifier '3', which is the position of the bit set in the KEY_ACCESS_POLICY register.",
            "C: The agent sends the transaction with any arbitrary Security Identifier as the KEY_ACCESS_POLICY register will perform a bitwise AND operation to grant access.",
            "D: The agent sends the transaction without any Security Identifier, relying on the KEY_ACCESS_POLICY register's default value to grant access."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "SecurityIdentifier"
    },
    {
        "id": "f725cb3b-8b30-45aa-bca1-681980dd839d",
        "source": "attck",
        "question": "A malware analyst observes that a particular piece of malware exhibits certain behaviors when executed in a controlled environment. The malware seems to avoid executing its payload when specific monitoring tools are detected and also includes unnecessary code to generate random activity. Additionally, the malware performs checks to ensure it is not being executed inside a virtual machine or known malware analysis sandbox environment. Which of the following techniques is the malware MOST likely using to evade virtualization and analysis environments?",
        "choices": [
            "A: User Activity Based Checks",
            "B: Time Based Evasion",
            "C: System Checks",
            "D: Static File Analysis Evasion"
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Virtualization/Sandbox Evasion"
    },
    {
        "id": "a024dc86-960f-4d35-9262-5a1bdc73d6af",
        "source": "attck",
        "question": "A penetration tester is evaluating the security of a multi-factor authentication (MFA) system. Which of the following methods could an adversary potentially use to compromise the system, and what would be the likely outcome of such an action?",
        "choices": [
            "A: Installing a keylogger to capture smart card pins, allowing the adversary to proxy authentication using the compromised system.",
            "B: Changing Windows Registry keys to disable MFA, granting unlimited access without the need for further authentication.",
            "C: Intercepting SMS-based one-time codes by compromising the messaging service, bypassing the need for the second factor.",
            "D: Physically tampering with the smart card reader hardware to bypass the card's security features and gain direct system access."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Multi-Factor Authentication"
    },
    {
        "id": "1bf1f5da-4fb3-417d-8578-c1bb8d12674b",
        "source": "owasp_wstg",
        "question": "You are tasked with security testing of a web application to ensure thorough code coverage. You must understand the application's workflow and structure. Which of the following approaches would you consider to map the execution paths through the application?",
        "choices": [
            "A: Documenting all discovered code paths and testing each path individually, including decision branches and combinatorial analysis.",
            "B: Using a single method, such as race conditions testing, to cover all possible paths and data manipulations concurrently.",
            "C: Relying solely on automatic spidering tools to document the application's links and to infer code paths indirectly.",
            "D: Conducting data flow analysis to track how data is assigned, transformed, and utilized across the application."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Code Coverage"
    },
    {
        "id": "bce31b60-9b41-4e75-924b-5608b7733dfc",
        "source": "mozilla_security",
        "question": "A web application is configured to listen on port 80 to prevent connection errors when a user types in a URL. As a security consultant, you are required to recommend an approach for redirecting users to a secure HTTPS resource. Which of the following strategies aligns with best security practices for handling this situation?",
        "choices": [
            "A: Implement a redirection from http://example.com/ to https://example.org/ directly to enforce HTTPS.",
            "B: Keep the website on HTTP and implement strong client-side security measures to compensate for the lack of HTTPS.",
            "C: Redirect from http://example.com/ to https://example.com/ and then to https://example.org/ to ensure HSTS can be set.",
            "D: Disable listening on port 80 and only allow connections over port 443 to force users to use HTTPS."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Redirections"
    },
    {
        "id": "047e3412-269c-4cc4-9a6b-c6361ecacaf6",
        "source": "owasp_wstg",
        "question": "In the context of web application security, what is the primary goal of conducting information security assessments?",
        "choices": [
            "A: To ensure compliance with all business requirements outlined in the initial project documentation.",
            "B: To identify gaps in security controls, such as the absence of basic authentication, authorization, or encryption controls.",
            "C: To verify the performance and scalability of the web application under high traffic conditions.",
            "D: To confirm that all application features function as intended from a user experience perspective."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Information Security Assessment"
    },
    {
        "id": "57ebaa99-340c-433e-9ce6-248075ff9e56",
        "source": "cs161_textbook",
        "question": "Why is it necessary to rely on higher layers of the networking model to ensure the reliability and security of communications over the internet, despite the functionality provided by the physical, link, and internetwork layers? Select all that apply.",
        "choices": [
            "A: The lower layers do not maintain a concept of a connection, which is required for two-way communication.",
            "B: Layer 3 IP protocol only offers best-effort delivery and does not handle errors or offer any security guarantees.",
            "C: The lower layers provide sufficient security through intrinsic routing mechanisms and do not require additional protocols.",
            "D: Higher layers can break up longer messages into packets and implement cryptographic protocols."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Layered Networking"
    },
    {
        "id": "aacdda17-fafb-41bf-a96e-f30e39909f0f",
        "source": "mozilla_security",
        "question": "A security consultant reviews a web application's Content-Security-Policy header and notices that it includes 'default-src https: 'unsafe-inline''. Why might the consultant recommend removing 'unsafe-inline' from the CSP directive?",
        "choices": [
            "A: It may prevent the webpage from loading any third-party images or styles, affecting the site's functionality.",
            "B: It allows the execution of inline scripts, which does not provide protection against XSS attacks.",
            "C: It forces all resources to be loaded over HTTP, which is less secure than HTTPS.",
            "D: It blocks the reporting of CSP violations, making it difficult to monitor and fix potential security issues."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "XSS protection"
    },
    {
        "id": "73ede46d-dded-4fee-97de-7bc05523e1c5",
        "source": "attck",
        "question": "As a security analyst, you are tasked with designing a monitoring system to detect potential audio capture attacks on your network. Which data sources and components should you focus on to identify activity associated with the capture of audio through peripheral devices or applications?",
        "choices": [
            "A: Monitoring API calls associated with peripheral devices and applications for audio capture.",
            "B: Analyzing network traffic for abnormal patterns indicating large data uploads.",
            "C: Reviewing system logs for unauthorized changes to firewall settings.",
            "D: Observing executed commands for actions that can leverage peripheral devices for audio capture."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Detection Mechanisms"
    },
    {
        "id": "d99bce7b-accd-401e-9cbd-66a39fff35ff",
        "source": "owasp_mastg",
        "question": "As part of a secure coding review, a developer is analyzing a C application that processes sensitive information. They observe the inclusion of the <sys/mman.h> header file. Which of the following is a valid security consideration associated with the functions provided by this header?",
        "choices": [
            "A: Functions from this header can be used to manage memory in a way that prevents buffer overflow attacks.",
            "B: Including this header automatically encrypts all data stored in memory.",
            "C: This header is known to contain deprecated functions that can lead to memory leaks.",
            "D: The functions from this header may allow direct manipulation of memory access permissions, which can pose security risks if misused."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "MemorySafety"
        ],
        "keyword": "Memory Management"
    },
    {
        "id": "359ea04f-0f1f-4b23-8ac5-87c099e58ae8",
        "source": "apple_platform_security",
        "question": "A cybersecurity specialist is evaluating security features of macOS for deployment in a corporate environment with a mix of Intel-based Macs and Macs with Apple silicon. Which of the following security capabilities are applicable to the environment described?",
        "choices": [
            "A: System Integrity Protection to restrict modifications to critical system files.",
            "B: Mandatory access controls to prevent users from overriding security policies.",
            "C: Loadable trust caches for runtime addition to the system.",
            "D: Page Protection Layer to prevent user space code from being modified post-verification."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "macOS"
    },
    {
        "id": "41c6eee1-101a-4325-9b14-2fcb68d0232d",
        "source": "owasp_wstg",
        "question": "An organization is concerned that their web application may be leaking sensitive information through search engines. As a security analyst, you are tasked with conducting a reconnaissance to discover potential leaks. Which combination of search engines and operators would you utilize to effectively search for sensitive information such as network configurations, administrator emails, and private keys?",
        "choices": [
            "A: Using Baidu with operators like 'site:', 'inurl:', and 'cache:' for a broad search.",
            "B: Limiting the search to Shodan with the 'filetype:' operator to find specific file types only.",
            "C: Applying the 'intitle:' operator exclusively on Bing to find sensitive titles.",
            "D: Employing a range of search engines like Google, DuckDuckGo, and Bing with operators like 'site:', 'inurl:', 'intext:', and 'filetype:' to perform a thorough search."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "search engine reconnaissance"
    },
    {
        "id": "4922b462-fdad-4ea8-bbc2-ef9064a6ec5d",
        "source": "owasp_wstg",
        "question": "What is a potential outcome of using an inadequately constructed wordlist during a fuzzing operation?",
        "choices": [
            "A: The fuzzing operation will be significantly faster due to the reduced number of inputs.",
            "B: The fuzzing operation may overlook existing vulnerabilities due to incomplete coverage.",
            "C: The fuzzing tool will automatically generate the necessary payloads to compensate for the inadequate wordlist.",
            "D: The fuzzing operation will prioritize high-severity vulnerabilities over less critical ones."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "wordlist"
    },
    {
        "id": "e80b794a-28f1-45c2-a20a-0d9f1d5814fc",
        "source": "attck",
        "question": "In an organization's effort to detect and prevent misuse of developer utilities for proxy execution of malicious payloads, what are the potential benefits and limitations of implementing process monitoring to observe the execution and arguments of these utilities?",
        "choices": [
            "A: Benefits: Enables real-time detection of malicious activity; Limitations: Can be resource-intensive and may generate false positives.",
            "B: Benefits: Completely prevents the execution of malicious payloads; Limitations: Hampers the performance of legitimate development activities.",
            "C: Benefits: Guarantees the traceability of all code changes; Limitations: Developers may find it intrusive and resist adoption.",
            "D: Benefits: Reduces the need for other security measures; Limitations: May lead to complacency in security practices."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Process Monitoring"
    },
    {
        "id": "f0ca971b-66cb-4c00-b938-93359cafe30c",
        "source": "cs161_textbook",
        "question": "In a case study of WPA2 security, an attacker is attempting to compromise the confidentiality of the network communications. During the WPA2 handshake process, which of the following elements, if obtained by the attacker, could allow them to decrypt messages sent over the network? (Select all that apply)",
        "choices": [
            "A: The Group Temporal Key (GTK)",
            "B: The MAC addresses of both the access point and the client",
            "C: The Pairwise Transient Key (PTK) derived from the handshake",
            "D: The order in which the handshake messages are sent"
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "WPA2"
    },
    {
        "id": "502af749-bc98-421e-88f7-81503a2410f8",
        "source": "cs161_textbook",
        "question": "Alice and Bob are using various cryptographic measures to secure their communication. Identify the measure that would not effectively counter the specified type of adversary:",
        "choices": [
            "A: Using end-to-end encryption to prevent Eve from eavesdropping on the message content.",
            "B: Implementing a public key infrastructure (PKI) to prevent Mallory from impersonating Alice or Bob.",
            "C: Relying solely on a network-level firewall to prevent Mallory from altering the messages in transit.",
            "D: Employing a secure key exchange protocol to prevent Eve from discovering the encryption keys."
        ],
        "answer": "C",
        "topics": [],
        "keyword": "Adversaries"
    },
    {
        "id": "0bd0fab8-a55e-41dc-a784-dba581b02600",
        "source": "android_sec_doc",
        "question": "A mobile device manufacturer is integrating a new security feature to protect against cold boot attacks and online attacks that can potentially leak system memory. They are implementing hardware-wrapped keys to manage storage encryption keys. Which of the following statements is true about the implementation and use of hardware-wrapped keys in this context?",
        "choices": [
            "A: The dedicated hardware must be capable of directly programming a subkey into an inline crypto engine and return a separate subkey to software.",
            "B: Software can unwrap and use the hardware-wrapped keys directly for file contents encryption and filenames encryption.",
            "C: The use of a TEE for implementing hardware-wrapped keys is highly recommended as it provides sufficient security against all types of attacks.",
            "D: Hardware-wrapped keys require the raw encryption keys to be stored in system memory to allow the encryption to be performed."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Hardware-Wrapped Keys"
    },
    {
        "id": "9ed22e92-f490-45cc-b08c-35f293b7c37a",
        "source": "cs161_textbook",
        "question": "An attacker is attempting to exploit a memory-safety vulnerability in a program that implements non-executable pages. The attacker decides to use the 'Return into libc' technique. Which of the following steps would the attacker likely take to successfully execute arbitrary code using a function from the C standard library?",
        "choices": [
            "A: Overwrite the stack pointer to redirect execution to the attacker's code in the heap.",
            "B: Overwrite the return instruction pointer (rip) with the address of a legitimate C library function.",
            "C: Place the arguments for the C library function in a non-standard register to bypass non-executable page protections.",
            "D: Carefully place the desired arguments on the stack in the correct order for the C library function to use when executed."
        ],
        "answer": "BD",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "ReturnIntoLibc"
    },
    {
        "id": "dc9f50b3-70f9-43fa-84fc-e89cf42443cd",
        "source": "owasp_mastg",
        "question": "You are tasked with enhancing the security of a mobile application that handles sensitive user data. The stakeholders emphasize the importance of ensuring data confidentiality, integrity, and authenticity. Which of the following sets of cryptographic algorithms and practices should you recommend for the application to align with modern security standards and best practices?",
        "choices": [
            "A: Use DES for encryption due to its long-standing reputation, MD5 for hashing to ensure data integrity, and RSA with 2048-bit keys for digital signatures.",
            "B: Implement AES-GCM-256 for confidentiality, SHA-256 for integrity, and ECDSA with NIST P-384 for digital signatures.",
            "C: Opt for RC4 for stream encryption as it is lightweight, SHA1 for hashing due to its speed, and Dual_EC_DRBG for random number generation.",
            "D: Choose 3DES for block encryption to leverage its triple encryption feature, BLOWFISH for hashing operations, and RSA with 1024-bit keys for key establishment."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Cryptographic Algorithms"
    },
    {
        "id": "7148ea80-6c57-4c1b-bcdd-2e0f36f31da0",
        "source": "cwe",
        "question": "You are tasked with assessing the security design of a smart thermostat. The smart thermostat is designed to provide users with real-time climate control and energy usage data. However, you notice that the smart thermostat lacks a key feature. Which of the following aspects would make the thermostat vulnerable to security risks?",
        "choices": [
            "A: The smart thermostat allows users to remotely control the temperature via an Internet-connected mobile app.",
            "B: The smart thermostat does not have the ability to update or patch its firmware.",
            "C: The design of the smart thermostat includes a hard-coded admin password that is the same for all devices.",
            "D: The device is capable of automatically adjusting the temperature based on weather forecasts retrieved online."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Firmware"
    },
    {
        "id": "543be4ac-11ce-4b02-9e3a-b2b50fd16bbd",
        "source": "cwe",
        "question": "Consider a software application where several modules need to process user information. Which of the following design approaches is the most secure and adheres to best practices to mitigate the risk of excessive reliance on global variables?",
        "choices": [
            "A: Creating a singleton UserContext class that holds the user information as static members and is accessible from any point in the application.",
            "B: Passing user information as arguments to functions and methods that require it, thereby avoiding the use of global state.",
            "C: Storing user information in a global dictionary object that is updated and accessed by various functions throughout the application.",
            "D: Utilizing a global User object that is updated in the main module and imported as needed in other parts of the application."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "GlobalVariables"
    },
    {
        "id": "a06ce85e-4c9b-4d78-91b8-a49d4ed2adac",
        "source": "owasp_mastg",
        "question": "An application developer argues that including the same header file multiple times in different parts of a large project will enhance the security of the application by reinforcing the declarations. Which counterargument best refutes this claim?",
        "choices": [
            "A: Multiple inclusions of the same header file can lead to compilation errors and does not improve security.",
            "B: Including the header file multiple times enhances the encryption strength of the application.",
            "C: Reinforcing declarations by multiple inclusions increases the application's resistance to buffer overflow attacks.",
            "D: The compiler optimizes out any redundant inclusions, so it has no effect on the application's security."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Header file inclusion"
    },
    {
        "id": "964f5529-78f6-426e-8d96-7ff40e6788d6",
        "source": "owasp_wstg",
        "question": "Which of the following server-side templating engine mechanisms could potentially mitigate the risk of Server-Side Template Injection (SSTI) vulnerabilities, but may still require additional security measures to be fully effective?",
        "choices": [
            "A: Sandboxing user-supplied templates to execute in a restricted environment.",
            "B: Disabling all dynamic HTML response features to prevent template rendering.",
            "C: Exclusively using client-side templates and avoiding server-side processing.",
            "D: Allowlisting certain template tags and expressions that users are permitted to use."
        ],
        "answer": "AD",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "SSTI Mitigation"
    },
    {
        "id": "273890ac-8b96-488f-80cd-fab6158a182f",
        "source": "cwe",
        "question": "Consider the following scenario: You are tasked with reviewing the security of an authentication system. You encounter a function that compares a user-inputted password to a stored value to verify user identity. Which of the following code modifications would best address the security concern of storing passwords in a recoverable format?",
        "choices": [
            "A: Replace the use of a compression algorithm with a strong, non-reversible encryption method for password storage.",
            "B: Store the password in plaintext in a separate database with restricted access to limit exposure.",
            "C: Implement a password recovery mechanism that allows users to reset their passwords rather than retrieve them.",
            "D: Apply a reversible encryption algorithm to the password before storage to obfuscate it."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "PasswordProtection"
    },
    {
        "id": "d3c2665f-4c2b-481b-a530-6c5c6055af04",
        "source": "attck",
        "question": "A cybersecurity analyst observes an increase in network traffic involving large quantities of authentication requests from a single source, which is suspected to be associated with adversary reconnaissance activities. Based on this information, which of the following scenarios is the analyst most likely witnessing and what could be the adversary's potential next step?",
        "choices": [
            "A: The adversary is gathering victim identity information, potentially leading to Search Open Websites/Domains or Phishing for Information.",
            "B: The adversary is conducting a Distributed Denial of Service (DDoS) attack, likely to cause a service outage.",
            "C: The adversary is exfiltrating data, which could lead to immediate data loss and public exposure.",
            "D: The adversary is performing a routine network maintenance check, which may lead to system updates."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Reconnaissance"
    },
    {
        "id": "a17e7a95-1460-4472-ae77-d4bb6fc6ea80",
        "source": "cwe",
        "question": "Consider a hardware design scenario where a flip-flop is used to control the lock state of a test and debug interface. Which of the following Verilog code snippets correctly initializes the flip-flop to a known secure state upon reset, preventing an attacker from exploiting the indeterminate state of the flip-flop?",
        "choices": [
            "A: always @(posedge clk) begin if (en) lock_jtag <= d; end",
            "B: always @(posedge clk) begin if (~reset) lock_jtag <= 1'b1; else if (en) lock_jtag <= d; end",
            "C: always @(posedge clk) begin if (~reset) lock_jtag <= 1'b0; else if (en) lock_jtag <= d; end",
            "D: always @(posedge clk) begin if (reset) lock_jtag <= 'bX; else if (en) lock_jtag <= d; end"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Initialization"
    },
    {
        "id": "e5332d35-3662-43a5-9f0a-f415c47c56d2",
        "source": "apple_platform_security",
        "question": "In the context of mobile device management (MDM) for Apple devices, which of the following statements accurately describe the characteristics of different enrolment types?",
        "choices": [
            "A: User Enrolment is suitable for BYOD deployments and provides cryptographic separation of user and corporate data.",
            "B: Device Enrolment allows users to manually enrol devices with a limited set of payloads and restrictions.",
            "C: Automated Device Enrolment is primarily designed for personal devices and allows the user to easily remove the MDM profile.",
            "D: User Enrolment uses Managed Apple IDs and requires user authentication to complete the enrolment process."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "EnrolmentTypes"
    },
    {
        "id": "6341c473-8771-410a-b7ec-1f5236875cc1",
        "source": "windows_security",
        "question": "When configuring audit policies for a Windows system to facilitate effective event log monitoring, which of the following audit policy settings are essential to enable the events collected by both baseline and suspect subscription requirements?",
        "choices": [
            "A: Account Logon - Credential Validation set to Success and Failure.",
            "B: Account Management - User Account Management set to Failure only.",
            "C: Account Management - Security Group Management set to Success.",
            "D: System Events - System Time Changes set to No Auditing."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Audit Policy"
    },
    {
        "id": "2796d33d-a4c5-4830-8665-f5ea868b3c23",
        "source": "cs161_textbook",
        "question": "Why should a web application not rely solely on a fast cryptographic hash function like SHA256 for password hashing, despite its efficiency?",
        "choices": [
            "A: Fast hash functions like SHA256 make it easier for attackers to perform offline password guessing attacks due to their computational speed.",
            "B: SHA256 is outdated and no longer considered secure due to recent advancements in hash function design.",
            "C: Using fast hash functions like SHA256 increases the time needed for the server to authenticate users, creating a bottleneck.",
            "D: Fast cryptographic hash functions like SHA256 are incompatible with modern password storage requirements and cannot be used with salts."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "hash function speed"
    },
    {
        "id": "bcc8b032-f9e6-4d27-86f0-dc9299a709c0",
        "source": "apple_platform_security",
        "question": "Consider the scenario where Apple's XProtect detects known malware on a Mac system. Which of the following actions are triggered by this detection? Select all that apply.",
        "choices": [
            "A: The associated Developer ID certificates of the malware are immediately revoked.",
            "B: XProtect automatically reboots the Mac to prevent further execution of the malware.",
            "C: Notarisation revocation tickets are issued for all files associated with the malware.",
            "D: XProtect signatures are updated to include the newly identified malware."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "XProtect"
    },
    {
        "id": "03f0350c-beac-43e6-a5b7-e222697280de",
        "source": "owasp_wstg",
        "question": "A web application uses Web SQL Database technology and manipulates the database via JavaScript API calls. The application has implemented client-side input validation, but security consultants have found that it is possible to inject SQL commands into the database queries. What would be the most effective remediation strategy to prevent this type of attack?",
        "choices": [
            "A: Implement server-side input validation and parameterization of query variables.",
            "B: Utilize CAPTCHA on all forms to deter automated injection attacks.",
            "C: Increase the encryption level of the database to prevent unauthorized access.",
            "D: Apply a strict Content Security Policy (CSP) to ensure that only trusted scripts run."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Client-side SQL Injection"
    },
    {
        "id": "e504575a-59c1-4db5-a32b-e3deb91a2664",
        "source": "apple_platform_security",
        "question": "Consider a user employing the Handoff feature across their Apple devices and between a native app and a website. Assess the security measures in place for Handoff and select the correct statements regarding how it maintains data security:",
        "choices": [
            "A: Devices use Bluetooth Low Energy (BLE) 4.2 pairing out-of-band and encrypt the BLE advertisements using a symmetric AES key stored in the keychain.",
            "B: Native apps can claim to resume activities from websites not controlled by the developer without validating control over the web domains.",
            "C: When transferring larger amounts of data, such as a mail draft with attachments, the connection switches to peer-to-peer Wi-Fi after an initial BLE payload transfer.",
            "D: The identity used in the TLS-encrypted Wi-Fi connection for larger data handoffs is not verified against the user’s identity in iCloud Keychain."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Handoff"
    },
    {
        "id": "b191c8ae-1541-4dab-9556-7fa0f0eb3f6b",
        "source": "owasp_mastg",
        "question": "A mobile application developer intends to utilize dynamic linking to load a shared library at runtime. The developer is working on a security-focused application and wants to ensure that the usage of dynamic linking does not introduce any potential vulnerabilities. Which of the following code snippets correctly demonstrates a secure method of using the 'dlfcn.h' header for dynamic linking in a mobile application?",
        "choices": [
            "A: void *handle = dlopen(\"libexample.so\", RTLD_NOW | RTLD_GLOBAL);",
            "B: void *handle = dlopen(\"libexample.so\", RTLD_LAZY);",
            "C: void *handle = dlopen(\"/absolute/path/libexample.so\", RTLD_NOW);",
            "D: void *handle = dlopen(\"libexample.so\", RTLD_LAZY | DL_DONT_LINK);"
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Dynamic Linking"
    },
    {
        "id": "434a8346-d1d9-456a-ab03-f0b1ff82cea1",
        "source": "mit6.858",
        "question": "As part of a cybersecurity team, you are tasked with enhancing the security of a company's email system. Considering the text's discussion on email security, which of the following statements are true regarding the deployment of 'hop-by-hop' and 'end-to-end' security? (Select all that apply.)",
        "choices": [
            "A: 'Hop-by-hop' security ensures that each server or user interaction is secured, but may not guarantee message integrity through all hops.",
            "B: 'End-to-end' security relies on the ultimate source and destination users and devices, potentially offering more believable security.",
            "C: The use of opportunistic encryption in 'hop-by-hop' security can compose into user-level security if all servers are properly configured.",
            "D: Adding DKIM signatures by the source organization in 'hop-by-hop' security is mostly useful for user authentication rather than as a factor in spam decision."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "EmailSecurity"
    },
    {
        "id": "7d6265b9-8848-4c2b-979b-fb55c7f578b0",
        "source": "android_sec_doc",
        "question": "In the context of Android app development, an app team argues against implementing APK Signature Scheme v3 because they believe it will cause their app to be blocked by other apps that trust the current signing certificate. What is the most appropriate counterargument to this concern?",
        "choices": [
            "A: The APK Signature Scheme v3 does not support key rotation, hence other apps will not recognize any changes to the signing certificate.",
            "B: The proof-of-rotation struct in APK Signature Scheme v3 actually allows apps to rotate their signing certificate without being blocked by other apps, ensuring trust continuity.",
            "C: Other apps will automatically trust the new signing certificate as the APK Signature Scheme v3 includes a feature that universally updates the trust stores of all Android devices.",
            "D: The APK Signature Scheme v3 requires manual intervention for every app to update their trust stores, which guarantees that no app will be automatically blocked."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "proof-of-rotation struct"
    },
    {
        "id": "de7fdad6-f0a2-4c02-8360-4f629d4148c3",
        "source": "cs161_textbook",
        "question": "Consider the scenario where a user is on an online shopping website, which has been compromised by a clickjacking attack. Which of the following actions could an attacker have implemented to carry out this attack effectively?",
        "choices": [
            "A: The attacker could have created multiple visually similar 'Checkout' buttons, where only one is legitimate, and the others submit credit card details to the attacker's server.",
            "B: The attacker could have overlaid a transparent iframe over a legitimate advertisement, causing any clicks to redirect the user to a phishing site.",
            "C: The attacker could have changed the website's privacy policy text to include hidden hyperlinks that lead to downloading malware.",
            "D: The attacker could have modified the website's CSS to hide the 'Logout' button, preventing users from securing their session."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Clickjacking"
    },
    {
        "id": "b6b860ea-e356-4122-8958-d4fdb65d8c43",
        "source": "owasp_wstg",
        "question": "An application developer is implementing a web messaging feature using the `postMessage()` method. Which of the following approaches could potentially expose the application to security risks? (Select two correct answers)",
        "choices": [
            "A: Checking that the `event.origin` matches a list of trusted domains before processing messages.",
            "B: Implementing a strict Content Security Policy (CSP) to control which domains can embed the application.",
            "C: Using `event.source` to filter messages based on their originating window without validating the origin.",
            "D: Omitting the message validation step because the application only communicates with well-known partner domains."
        ],
        "answer": "CD",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Content Security Policy"
    },
    {
        "id": "c0de31ff-12cb-4a91-b588-e3c7d9ba5cec",
        "source": "owasp_wstg",
        "question": "In the context of testing for reflected Cross-site Scripting (XSS) vulnerabilities, a security professional is selecting a tool to assist in identifying and preventing such security issues. Considering the nature of reflected XSS, which tool would provide the most comprehensive analysis for identifying variables that are reflected in responses and assessing the encoding that gets applied to inputs?",
        "choices": [
            "A: Zed Attack Proxy (ZAP), because it is an interactive HTTP/S proxy server with a built-in scanner for attacking and testing web applications.",
            "B: PHP Charset Encoder (PCE), as it encodes texts to and from various character sets for customized payloads.",
            "C: Hackvertor, given its ability to encode and obfuscate JavaScript and any string input, making it suitable for testing encoding issues.",
            "D: ratproxy, as it is a semi-automated security audit tool optimized for accurate and sensitive detection of potential problems in web 2.0 environments."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Reflected Cross-site Scripting (XSS)"
    },
    {
        "id": "2279e498-05b1-40d0-9012-c359d5443677",
        "source": "apple_platform_security",
        "question": "A security analyst is evaluating a macOS system to ensure that it is configured to defend against unauthorized direct memory access (DMA) and malicious kernel extensions (kexts). Which of the following security measures should the analyst verify as enabled and correctly functioning to prevent these attack vectors?",
        "choices": [
            "A: IOMMU is initialized early in the boot process to enable DMA remapping.",
            "B: Kernel extensions (kexts) can be loaded on demand at any time after boot.",
            "C: System Integrity Protection (SIP) is disabled to allow permissive security flows.",
            "D: Auxiliary Kernel Collection (AuxKC) requires user approval and secure boot with Reduced Security for changes."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "macOS"
    },
    {
        "id": "01adae0a-ff82-470f-bab3-827ff5ad510d",
        "source": "owasp_wstg",
        "question": "A security analyst is reviewing an application that parses XML input and constructs an XML database. The XML documents are validated against a DTD before processing. The DTD specifies that the <userid> node should occur exactly once within a <user> node. The analyst wants to inject an administrative user by ensuring that the injected <userid> node is processed by the parser, and all following nodes are ignored. Which of the following inputs, when inserted into the email field, would correctly comment out the rest of the user data, assuming the analyst has control over the preceding node values?",
        "choices": [
            "A: admin@example.com</mail><userid>0</userid><mail>admin@example.com<!--",
            "B: admin@example.com<!--</mail><userid>0</userid><mail>admin@example.com",
            "C: admin@example.com</mail><userid>0</userid><!--<mail>admin@example.com",
            "D: admin@example.com</mail><userid>0</userid><mail>admin@example.com-->"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "XML Injection"
    },
    {
        "id": "e3940fc9-00f6-477b-919d-0e9cccaa389b",
        "source": "owasp_wstg",
        "question": "A penetration tester is trying to identify all DNS names associated with a given IP address. Which technique is least likely to yield useful results due to current common configurations and practices?",
        "choices": [
            "A: Performing a reverse-IP lookup using web-based services.",
            "B: Attempting a DNS zone transfer on the given IP address.",
            "C: Querying for DNS names using the Netcraft Search DNS service.",
            "D: Making inverse DNS queries to resolve symbolic names from IP addresses."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "DNS Zone Transfer"
    },
    {
        "id": "69147b80-49f6-4772-9c1d-ab7f76a7f531",
        "source": "attck",
        "question": "A network security specialist is assessing a company's infrastructure to mitigate the risk of adversaries using traffic signaling to facilitate persistence, command and control activities. The specialist is aware that adversaries may utilize magic values or sequences to trigger responses such as opening closed ports or executing malicious tasks. Which of the following mitigation and detection combinations are the MOST effective in addressing this security concern?",
        "choices": [
            "A: Mitigation: Disable unused services. Detection: Analyze network flows for unexpected protocol standards.",
            "B: Mitigation: Increase network bandwidth. Detection: Monitor for increased traffic volume.",
            "C: Mitigation: Deploy antivirus software. Detection: Scan for known malware signatures.",
            "D: Mitigation: Implement application whitelisting. Detection: Monitor for unauthorized application executions."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Traffic Signaling"
    },
    {
        "id": "c8d44f57-1224-4c1f-b0d0-bda5cd35bcc1",
        "source": "apple_platform_security",
        "question": "An organization is considering the use of iCloud Private Relay for its employees who use Apple devices. As a cybersecurity consultant, you are asked to analyze the benefits and limitations of iCloud Private Relay. Which of the following statements accurately describe the functionalities and constraints of this service?",
        "choices": [
            "A: iCloud Private Relay can be used on any device regardless of the operating system version as long as the user is signed in to their iCloud+ account.",
            "B: iCloud Private Relay ensures that no single party can correlate the user’s IP address with their browsing activity.",
            "C: iCloud Private Relay can protect passwords by encrypting DNS name resolution requests.",
            "D: iCloud Private Relay is available exclusively for web browsing activities and does not cover other internet-based services."
        ],
        "answer": "BC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "iCloud Private Relay"
    },
    {
        "id": "87d4c8c9-9d19-4b4e-8ac8-2399ff67942b",
        "source": "attck",
        "question": "An organization's network security team has observed unusual traffic on their network. They have noticed HTTPS traffic on port 8088 and HTTP traffic on port 443. They are concerned that these might be indicators of a security breach. Based on your knowledge of adversary tactics, which of the following statements is true regarding this situation?",
        "choices": [
            "A: HTTPS traffic on port 8088 is normal, and no further action is needed.",
            "B: HTTP traffic on port 443 is an indicator of a security breach because this port is typically used for HTTPS.",
            "C: Both observed traffic patterns are normal and commonly seen in enterprise networks.",
            "D: Both HTTPS traffic on port 8088 and HTTP traffic on port 443 may indicate adversaries are attempting to bypass network filtering or analysis."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Non-Standard Port"
    },
    {
        "id": "ca517bb5-0a29-4f6f-a946-b3d0247edc90",
        "source": "apple_platform_security",
        "question": "Which of the following are NOT sources of entropy for the kernel CPRNG as described in the system security overview?",
        "choices": [
            "A: Entropy collected from user input patterns.",
            "B: The Secure Enclave hardware TRNG.",
            "C: Timing-based jitter collected during boot.",
            "D: Intel random instructions such as RDSEED and RDRAND."
        ],
        "answer": "A",
        "topics": [
            "Cryptography"
        ],
        "keyword": "entropy"
    },
    {
        "id": "3a3f0ea4-c1ae-4944-94c5-0bdcb2aea4a0",
        "source": "cs161_textbook",
        "question": "A security team is reviewing the intrusion detection measures of their company's software. They argue that using specification-based detection will be highly effective because it reduces the false positive rate to near-zero levels. What might be a valid counterargument to consider in this context?",
        "choices": [
            "A: False positives are entirely eliminated in specification-based detection, hence no counterargument is needed.",
            "B: The low false positive rate is contingent on the specifications being very well-defined, which may not be feasible for all aspects of the application.",
            "C: Specification-based detection will automatically update the specifications as the software evolves, leading to potential security lapses.",
            "D: Manually written specifications are less time-consuming than maintaining a database of known attack signatures."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SpecificationBasedDetection"
    },
    {
        "id": "611136b8-e015-4b5a-bb30-af22fa67f28f",
        "source": "attck",
        "question": "A security team is tasked with protecting an organization's network against potential exploitation of software vulnerabilities within their office productivity suite. They are considering the implementation of application isolation and sandboxing, as well as exploit protection tools like Windows Defender Exploit Guard (WDEG). Which of the following statements accurately reflect the considerations the team should make regarding these mitigation strategies?",
        "choices": [
            "A: While application isolation and sandboxing can mitigate the impact of exploitation, there may still be sandbox escape techniques that could be leveraged by an attacker.",
            "B: Exploit protection tools that monitor exploitation behavior, such as WDEG or EMET, are guaranteed to stop all attempts of software exploitation without any compatibility issues.",
            "C: Application isolation can completely eliminate the risk of client-side exploitation without the possibility of additional exploits being identified.",
            "D: Employing control flow integrity checking can potentially identify and prevent software exploits, but the effectiveness depends on the architecture and compatibility with the target application."
        ],
        "answer": "AD",
        "topics": [
            "SystemSecurity",
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Application Isolation"
    },
    {
        "id": "38594237-f78d-404f-9960-ae0e13f1f1d5",
        "source": "cs161_textbook",
        "question": "Consider a scenario where an application requires the transmission of small amounts of data with minimal overhead and latency. Which of the following characteristics of the UDP protocol are advantageous and which could be potentially disadvantageous for this application?",
        "choices": [
            "A: UDP's lack of guaranteed delivery might lead to data loss, which is disadvantageous for applications that require reliable communication.",
            "B: The use of checksums in UDP headers to detect corrupted packets is advantageous as it provides a basic level of integrity checking.",
            "C: UDP’s support for discrete packet handling can be advantageous for reducing the overhead and improving the speed of data transmission.",
            "D: The potential for datagrams to be larger than the network's packet size introduces fragmentation issues, which is disadvantageous."
        ],
        "answer": "ABCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "UDP"
    },
    {
        "id": "3b78cf27-1a4f-49f4-9f11-31d7813115f7",
        "source": "mit6.858",
        "question": "As a security analyst, you are reviewing the security implications of browser behaviors as they relate to web security and the Same-Origin Policy. Considering the potential benefits and drawbacks, which of the following statements accurately describe the security implications of these behaviors?",
        "choices": [
            "A: Strict enforcement of SOP prevents cross-site request forgery (CSRF) attacks by disallowing any cross-origin requests, including image fetches and links.",
            "B: Cookies that are labeled as 'SameSite=Strict' are not sent with requests originating from another site, which mitigates the risk of CSRF attacks but could disrupt the user experience when navigating across sites.",
            "C: Allowing inter-domain <IMG> tags benefits content sharing and reduces server load but may expose the application to CSRF risks if cookies are sent along with these image requests.",
            "D: Setting cookies with a 'Domain' attribute that is a suffix of the site's DNS name enhances the flexibility of cookie use across subdomains but could heighten the risk of cookie interception or misuse."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cookie Security"
    },
    {
        "id": "fe3b6cd4-a709-4521-8324-2129a00552a1",
        "source": "cwe",
        "question": "When reviewing a peer's code, you notice several functions with deep nesting levels. Your peer argues that flat structures can be more confusing and less expressive in certain contexts. Which of the following points could be a valid counterargument supporting the use of deep nesting in some scenarios?",
        "choices": [
            "A: Deep nesting can make the code more readable by clearly separating logical blocks that depend on different conditions.",
            "B: Flat structures prevent the use of control structures such as loops and conditional statements, which are essential for any non-trivial program.",
            "C: Excessive use of deep nesting is always detrimental, and all logic should be expressed in a linear fashion without any nesting for maximum clarity.",
            "D: Deep nesting is a poor practice because it invariably leads to code that is difficult to test and debug."
        ],
        "answer": "A",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "DeepNestingTradeOffs"
    },
    {
        "id": "93cc9970-b41a-49d1-bad6-a20b40a88f1f",
        "source": "owasp_wstg",
        "question": "A web application for processing online transactions does not implement any active defenses against misuse. Which of the following scenarios is a possible consequence of this oversight?",
        "choices": [
            "A: The application will automatically log out users who make repeated input errors, increasing security.",
            "B: Attackers may use automated tools to exploit the application faster than a normal user, without being detected.",
            "C: Users who change their passwords frequently will be flagged as potential attackers.",
            "D: The application will redirect malicious requests to a honeypot for further analysis."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Active Defenses"
    },
    {
        "id": "72574b19-8d65-4d92-b272-0a112bb10a10",
        "source": "attck",
        "question": "A cyber adversary is planning an operation that involves social engineering and requires establishing a believable online persona. Which of the following actions would contribute to the development of such a persona?",
        "choices": [
            "A: Creating a LinkedIn profile with extensive work history and recommendations.",
            "B: Setting up a GitHub account with no repositories or contributions.",
            "C: Developing a network of connections across various social media platforms.",
            "D: Registering an email account and subscribing to unrelated retail newsletters."
        ],
        "answer": "AC",
        "topics": [
            "PenTest"
        ],
        "keyword": "Persona Development"
    },
    {
        "id": "6d12c982-f6ce-4b41-becc-77ffb811a15b",
        "source": "apple_platform_security",
        "question": "When adding a key, pass, student ID card, or corporate badge to Apple Wallet, Express Mode is enabled by default to enhance user convenience. What are the potential security implications and additional measures available to users concerning the handling of these digital access keys?",
        "choices": [
            "A: Express Mode allows for interaction with terminals without requiring authentication, which may pose a risk if the device is lost or stolen.",
            "B: Users can disable Express Mode, which will then require Face ID, Touch ID, or a passcode for interactions, enhancing security.",
            "C: Digital access keys are stored on Apple's servers, so disabling Express Mode adds an extra layer of security.",
            "D: All access keys added can be remotely wiped by the user via Find My iPhone or issuing a remote wipe command."
        ],
        "answer": "ABD",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "DigitalAccessKeySecurity"
    },
    {
        "id": "6da49679-1a5e-4ea6-a85c-4156211eb190",
        "source": "cwe",
        "question": "A security consultant suggests that to mitigate XSS through IMG tags, the application should set all session cookies to be HttpOnly and always use consistent output encoding like UTF-8. Which of the following statements provide valid counterarguments to the consultant's suggestions?",
        "choices": [
            "A: Setting HttpOnly on session cookies would not prevent XSS where the script does not target the session cookie.",
            "B: Using consistent output encoding like UTF-8 does not mitigate XSS if the encoding is not properly specified to the browser.",
            "C: HttpOnly cookies require the browser to support JavaScript, which may not be available in all user environments.",
            "D: Specifying UTF-8 encoding can increase the risk of SQL Injection attacks if the database does not support this encoding."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "HttpOnly"
    },
    {
        "id": "1c256513-6323-40f4-a31a-6acd946d4e30",
        "source": "d3fend",
        "question": "A system administrator is faced with the challenge of restoring normal operations after a cyber incident that resulted in the corruption of multiple user accounts, loss of network connectivity, and alteration of the database. Which of the following actions would be the most appropriate first step to re-establish the system's functionality according to the Restore tactic?",
        "choices": [
            "A: Reconfigure the firewall to enable network traffic analysis.",
            "B: Restore Network Access to ensure users can connect to the network resources.",
            "C: Reissue a new email credential to all users to regain secure communication.",
            "D: Unlock all user accounts to regain access to the system."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Restore Network Access"
    },
    {
        "id": "87f1c1c6-5f2c-4f6e-bc02-c9607c83d3b0",
        "source": "owasp_wstg",
        "question": "When implementing a Content Security Policy (CSP) for a web application, which of the following is NOT a benefit of CSP?",
        "choices": [
            "A: Mitigates the risk of cross-site scripting (XSS) attacks.",
            "B: Prevents the browser from loading malicious resources.",
            "C: Completely eliminates the need for input validation on the server-side.",
            "D: Restricts the origins from which external resources can be loaded."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Content Security Policy (CSP)"
    },
    {
        "id": "95c1767e-cbdb-4510-b4b9-f62586fe81c1",
        "source": "cwe",
        "question": "An application is being designed to process user-supplied code securely. Which of the following statements are true regarding the use of a sandbox or jail to mitigate security risks associated with executing user-supplied code?",
        "choices": [
            "A: A sandbox can prevent all forms of vulnerabilities within the application by isolating it completely from the operating system.",
            "B: Sandboxes may restrict file access or command execution, but they do not eliminate the possibility of vulnerabilities within the application itself.",
            "C: The effectiveness of a sandbox is absolute, and it is always a feasible solution for any security concern.",
            "D: Utilizing a sandbox or jail can limit the impact of an attack by restricting access to system calls and file system."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Sandboxing"
    },
    {
        "id": "229d0b37-5030-4530-9c36-63f8f09dfd36",
        "source": "apple_platform_security",
        "question": "Consider a scenario where a Mac with Apple silicon is being secured through various policies and constraints. Which of the following statements accurately reflect the roles and properties of the LocalPolicy and RemotePolicy in ensuring the integrity of the secure boot process and policy management?",
        "choices": [
            "A: The LocalPolicy restricts the boot environment of recoveryOS to only behave as if it's booting with Full Security, leveraging the RemotePolicy constraints.",
            "B: The RemotePolicy Nonce Hash (rpnh) is subject to change only when actions such as software updates or user-initiated security settings changes occur.",
            "C: LocalPolicy for system recoveryOS includes a recoveryOS Nonce Hash (ronh), which allows for the booting of the system recoveryOS even when operating systems are disabled via Find My.",
            "D: LocalPolicy and RemotePolicy utilize the same nonce hash for all policies, ensuring uniformity and simplification of the secure boot process."
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "LocalPolicy"
    },
    {
        "id": "fcd10cc9-4de3-4fd1-837f-2eccda1e430b",
        "source": "apple_platform_security",
        "question": "Consider the following scenarios where the Secure Enclave in Apple devices is employed. Select all scenarios that correctly describe the use of the Secure Enclave's features according to the information provided:",
        "choices": [
            "A: The Secure Enclave UID is used to cryptographically tie data to a particular device, making data from the internal SSD inaccessible if moved to another device.",
            "B: UID and GID can be accessed and retrieved through Joint Test Action Group (JTAG) interfaces for debugging purposes.",
            "C: The Secure Enclave AES Engine supports both hardware and software keys, with hardware keys derived from the UID or GID and never exposed to sepOS software.",
            "D: The Public Key Accelerator (PKA) executes asymmetric cryptography operations and is designed to prevent information leakage through timing and side-channel attacks such as SPA and DPA."
        ],
        "answer": "ACD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SecureEnclave"
    },
    {
        "id": "f449e2ce-5fcc-4308-b063-10622dba5635",
        "source": "mit6.858",
        "question": "Considering the mitigations proposed for speculative execution vulnerabilities, what are some valid statements regarding the benefits and drawbacks of the strategies for Variant 1, Variant 2, and Variant 3?",
        "choices": [
            "A: Variant 1 mitigation involves modifying the code to constrain indices, which may lead to performance overheads due to additional bounds checking.",
            "B: Variant 2 mitigation through the use of retpoline introduces an infinite loop that is never executed, causing a slowdown in all indirect jumps.",
            "C: Variant 3 mitigation using Kernel page table isolation (KPTI) completely eliminates the performance overhead as it uses two separate page tables for user and kernel.",
            "D: Reducing shared resources when processing secret data by using a separate core with its own cache is an easy and straightforward solution to implement."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Mitigations"
    },
    {
        "id": "cd6619f2-4d6a-4dda-a399-bc9d097ac259",
        "source": "owasp_wstg",
        "question": "You are tasked with evaluating the security of a web application. Your current objective is to gain an understanding of the application's logic and explore it as an end user without interacting in a way that would alter its state. You are utilizing tools primarily for information gathering, such as observing HTTP(S) requests and responses through a proxy. Based on this description, what type of testing are you currently performing?",
        "choices": [
            "A: Active Testing",
            "B: Passive Testing",
            "C: White Box Testing",
            "D: Ad Hoc Testing"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Passive Testing"
    },
    {
        "id": "d9fd3d78-4e4f-44c0-8a3e-bf8151517b2a",
        "source": "owasp_mastg",
        "question": "In an Android mobile application, you are optimizing the security of data transmission to and from a remote server. Which of the following protocols should be implemented to ensure that the data remains confidential and tamper-proof during transit?",
        "choices": [
            "A: Hypertext Transfer Protocol (HTTP) with additional obfuscation techniques.",
            "B: Secure Shell (SSH) for all data transmission operations.",
            "C: Transport Layer Security (TLS) for secure communication over the internet.",
            "D: Post Office Protocol version 3 (POP3) with a proprietary encryption layer."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "TLS"
    },
    {
        "id": "ae887cc3-b90e-48df-bb34-be97fb561ab5",
        "source": "apple_platform_security",
        "question": "In designing a secure computer system, which of the following measures would likely improve the overall security posture?",
        "choices": [
            "A: Implementing a multi-factor authentication process for user access.",
            "B: Using a single administrator account for ease of system maintenance.",
            "C: Enforcing least privilege access controls.",
            "D: Relying solely on antivirus software for threat mitigation."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "SystemDesign"
    },
    {
        "id": "2ea7927f-120c-4e82-ac85-34e163ad2084",
        "source": "cs161_textbook",
        "question": "In a decentralized blockchain network like Bitcoin, achieving consensus is critical for maintaining the integrity of the transaction ledger. Which of the following scenarios present challenges to achieving consensus? Select all that apply.",
        "choices": [
            "A: A user broadcasts a valid transaction to the network, but some participants refuse to append it to their local blockchain.",
            "B: A participant initiates a double-spending attack by forking the blockchain and reversing a previously confirmed transaction.",
            "C: All participants agree to accept a new transaction without verification, relying solely on trust in the transaction's origin.",
            "D: A group of users decides to update their software to a new version that optimizes transaction validation speed."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Consensus"
    },
    {
        "id": "8e00eb0f-13c2-4cd5-9803-106be431e6ba",
        "source": "d3fend",
        "question": "An organization's IT security team has been alerted to unusual patterns in resource access by a particular user, which is not consistent with the user's typical behavior. What analysis method should the team implement to investigate whether this is an indication of unauthorized activity by the user?",
        "choices": [
            "A: Database Query String Analysis",
            "B: Process Lineage Analysis",
            "C: Resource Access Pattern Analysis",
            "D: Credential Compromise Scope Analysis"
        ],
        "answer": "C",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Resource Access Pattern Analysis"
    },
    {
        "id": "e5a8f7dc-5798-4b7a-9c4c-551530ec9e5e",
        "source": "android_sec_doc",
        "question": "You are an Android platform policy maintainer tasked with ensuring backward compatibility for vendor policies after a platform update. Given the recent update from version N to N+1, which of the following steps is essential to allow the vendor partition at version N to access new types added in the system_ext and product partitions at version N+1?",
        "choices": [
            "A: Provide mapping files from concrete types into type_N+1 attributes for the vendor partition.",
            "B: Instruct partners to copy the base mapping files from N system_ext and product partitions and install them directly without changes.",
            "C: Amend the N.cil mapping files to include the new types and install them in the N+1 system_ext and product partitions.",
            "D: Discard the use of versioned attributes and revert to using non-versioned attributes for backward compatibility."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "sepolicy versioning"
    },
    {
        "id": "799e2521-0181-4114-b16f-c7f61bc8cf61",
        "source": "owasp_wstg",
        "question": "A web server is being configured to enhance security and enforce encrypted connections. Which of the following server response headers correctly implements HTTP Strict Transport Security (HSTS) to ensure all connections are made via HTTPS, including subdomains, and specifies that the browser should convert all HTTP requests to HTTPS for the next year?",
        "choices": [
            "A: Strict-Transport-Security: max-age=31536000; includeSubDomains",
            "B: Transport-Security-Strict: max-age=31536000; enforceSubDomains",
            "C: Strict-Transport-Security: max-age=31536000",
            "D: Strict-HTTPS-Security: max-age=31536000; includeSubDomains"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HSTS"
    },
    {
        "id": "cf68ebda-c0ae-44b2-b1f1-08169d5f2682",
        "source": "android_sec_doc",
        "question": "A new security feature has been implemented to prevent rollback attacks on an Android device. What are the main advantages of binding cryptographic keys to the operating system and patch level of the system image, as seen in Keymaster 2 and 3?",
        "choices": [
            "A: It allows any version of the device to use keys created with a newer or older version of the system image.",
            "B: It prevents an attacker from rolling back a device to a vulnerable version to use keys created with a safer, updated version.",
            "C: It enables keys to be upgraded without invalidating the previous version, allowing for seamless downgrades if necessary.",
            "D: It ensures that each partition can be updated independently, providing greater flexibility in handling security patches."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "rollback protection"
    },
    {
        "id": "78db462f-0597-4576-a301-fadc237eb821",
        "source": "mozilla_security",
        "question": "A web application developer is implementing referrer policy directives to enhance privacy and security. The application needs to send the full URL referrer information to its own origin, but only send the origin URL without the path to external origins. Which combination of referrer policy directives should the developer implement to achieve this behavior?",
        "choices": [
            "A: `strict-origin`",
            "B: `no-referrer`",
            "C: `strict-origin-when-cross-origin`",
            "D: `same-origin`"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Referrer Policy"
    },
    {
        "id": "470aabc4-ca83-4d95-ba91-353898151e6a",
        "source": "apple_platform_security",
        "question": "When designing a device driver for macOS using the DriverKit framework, which of the following statements accurately reflect the security and system stability enhancements provided by DriverKit compared to traditional kernel extensions (kexts)?",
        "choices": [
            "A: Drivers built with DriverKit require administrator privileges to install in /System/Library or /Library.",
            "B: DriverKit allows drivers to run in user space, avoiding kernel panics and reducing the Mac's attack surface.",
            "C: DriverKit-built drivers must be bundled with installers to facilitate proper system integration.",
            "D: The DriverKit framework provides C++ classes for I/O services, device matching, and other common types, facilitating secure driver development."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "DriverKit"
    },
    {
        "id": "44cc3d85-e444-4d43-af27-88e57ce4d2b9",
        "source": "apple_platform_security",
        "question": "An independent developer has created a new audio accessory that connects via Bluetooth to iOS devices and a software application for macOS that interacts with this accessory. The accessory should provide digital audio streams and location information. For the software, the developer wants it to be distributed outside the App Store but also ensure that it adheres to macOS security standards. Select the measures that the developer must implement for both the accessory and the software to comply with Apple's security requirements.",
        "choices": [
            "A: Incorporate an Apple-provided authentication IC in the accessory to ensure it can authenticate with Apple's devices and access the desired functionalities.",
            "B: Sign the macOS software application with an Apple-issued Developer ID certificate and submit it for notarisation to Apple.",
            "C: Use a self-generated certificate for the accessory to prove to iOS devices that it's been authorized by the developer.",
            "D: Distribute the macOS software application unsigned and rely on XProtect to ensure users that the app is free from malware."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity",
            "NetworkSecurity"
        ],
        "keyword": "AppleSecurity"
    },
    {
        "id": "9ec82904-7d39-44c9-8229-70ad7f73bc99",
        "source": "cs161_textbook",
        "question": "A network administrator is reviewing the configuration of a local network that employs NAT as part of its DHCP setup. The administrator is concerned about possible vulnerabilities that could be exploited by attackers. Which of the following vulnerabilities could be a concern when using NAT in the network?",
        "choices": [
            "A: NAT may lead to IP address conflicts if it assigns the same public IP to multiple internal devices simultaneously.",
            "B: NAT could potentially expose all devices on the local network to direct attacks from the internet by mapping all internal IPs to one public IP.",
            "C: Attackers might take advantage of the predictable nature of private IP address assignments to guess the structure of the internal network.",
            "D: The use of NAT may increase the risk of man-in-the-middle attacks, as external packets are translated to internal addresses."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity",
            "NetworkSecurity"
        ],
        "keyword": "Vulnerabilities"
    },
    {
        "id": "4cc5bf48-ace1-44a5-8761-7c18abdb49a2",
        "source": "owasp_wstg",
        "question": "In the context of a balanced security testing framework, what is the most appropriate phase in the Software Development Life Cycle (SDLC) to primarily focus on manual source code review and static source code analysis?",
        "choices": [
            "A: After deployment, to ensure that the production code is reviewed for any residual vulnerabilities.",
            "B: During the early stages of development, to identify and fix vulnerabilities before they propagate through later stages.",
            "C: Immediately before penetration testing, to prepare the application for external attack simulations.",
            "D: Only during the maintenance phase, as part of the regular updates and patches process."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "SDLC"
    },
    {
        "id": "1dc19301-c704-4118-84ce-b9eba63bd2a2",
        "source": "attck",
        "question": "A penetration tester identifying vulnerabilities in a client's network notices that some applications are running with file permissions that allow writing to their executable paths, and the Registry contains keys with no associated legitimate binaries. Which of the following sub-techniques of hijack execution flow should the tester prioritize for further investigation and remediation? (Select TWO.)",
        "choices": [
            "A: DLL Search Order Hijacking",
            "B: Services Registry Permissions Weakness",
            "C: KernelCallbackTable",
            "D: Dynamic Linker Hijacking"
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Sub-techniques of Hijack Execution Flow"
    },
    {
        "id": "e63a6303-664c-4793-8b8b-694a420cc3d9",
        "source": "cs161_textbook",
        "question": "A website has a vulnerability where user input from a search query parameter 'q' is reflected directly in the response without proper sanitization. Which of the following search query inputs would NOT lead to a successful reflected XSS attack on the website?",
        "choices": [
            "A: https://www.example.com/search?q=%3Cscript%3Ealert('XSS')%3C/script%3E",
            "B: https://www.example.com/search?q=<script>alert('XSS')</script>",
            "C: https://www.example.com/search?q=cs161",
            "D: https://www.example.com/search?q=<img src=x onerror=alert('XSS')>"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Reflected XSS"
    },
    {
        "id": "c584d147-b4a4-431c-b2df-2314bdcb21fa",
        "source": "apple_platform_security",
        "question": "An organization is planning to utilize Apple's Secure Enclave in their device security architecture to enhance data protection. The security team is evaluating the benefits and limitations of Secure Enclave's features. Select the statements that correctly describe the functionalities or characteristics associated with Apple's Secure Enclave and Secure Storage Components.",
        "choices": [
            "A: The Secure Enclave's PKA has been mathematically proven to be correct in encryption implementations starting with the A13 SoCs.",
            "B: The Secure Storage Component of devices with A12, S4, and later SoCs lacks a hardware random number generator and physical tamper detection.",
            "C: Counter lockboxes, introduced with the 2nd-generation Secure Storage Component, are designed to hold the entropy needed to unlock passcode-protected user data.",
            "D: On devices without a Secure Storage Component, an EEPROM is used for secure storage services, guaranteeing exclusive access to entropy and counter lockbox functionality."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Secure Enclave"
    },
    {
        "id": "ec2f62af-94cf-4cf4-a8ae-efbc83987f7e",
        "source": "windows_security",
        "question": "As an IT professional tasked with securing a Windows 10 environment, you need to protect against memory-based attacks and ensure that the operating system and applications can handle memory correctly. Which of the following features would you enable to maximize defense against such threats, and what are the potential consequences of implementing these protections?",
        "choices": [
            "A: Enabling Data Execution Prevention (DEP) to mark memory as non-executable, which could potentially interfere with the operation of some applications.",
            "B: Configuring UEFI Secure Boot to protect the boot process from tampering, but may prevent dual-boot scenarios with non-secure operating systems.",
            "C: Implementing Control Flow Guard (CFG) in applications, requiring no configuration in the operating system, thereby providing seamless protection.",
            "D: Activating Device Health Attestation (DHA) to ensure device integrity but may block devices that do not adhere to 'healthy' boot data profiles."
        ],
        "answer": "ABCD",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Data Execution Prevention (DEP)"
    },
    {
        "id": "09405153-85ae-4cef-9bc5-75628f68e199",
        "source": "windows_security",
        "question": "In which of the following scenarios would implementing enterprise certificate pinning be least beneficial?",
        "choices": [
            "A: An enterprise has a long-term contract with a trusted certificate authority and wants to ensure that all communications with its domain are secure.",
            "B: An organization frequently changes its certificate authorities as part of its security policy to mitigate risks associated with CA compromises.",
            "C: A company requires all internal communications to be encrypted and authenticated using certificates issued by their in-house certificate authority.",
            "D: The IT department needs to prevent man-in-the-middle attacks by ensuring a specific end-entity certificate is used for their secure web portal."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Certificate Authority (CA) Flexibility"
    },
    {
        "id": "9d71d35c-e4af-433a-ae96-880e3b111035",
        "source": "attck",
        "question": "A penetration tester is evaluating a system's resilience against privilege escalation attacks. Given that adversaries often exploit software vulnerabilities to elevate privileges and circumvent restrictions such as permission levels, which of the following practices would be most effective in mitigating the risk of such attacks? Select TWO.",
        "choices": [
            "A: Use sandboxing to contain potential exploits within isolated environments.",
            "B: Increase the number of user accounts to dilute the permission scope.",
            "C: Implement execution prevention mechanisms to block known vulnerable drivers.",
            "D: Deploy an endpoint protection solution that lacks behavior-based detection capabilities."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Sandboxing"
    },
    {
        "id": "dbefc6d4-3954-4426-855f-5ab18bba0be7",
        "source": "windows_security",
        "question": "An administrator is reviewing the Security logs and encounters an event with ID 4731. This event indicates the creation of a security-enabled local group. Which of the following pieces of information would be most critical for the administrator to determine the context of this event and assess its security implications?",
        "choices": [
            "A: The SAM Account Name attribute to check against organizational naming conventions",
            "B: The Logon ID to correlate this event with the user's previous successful logon events",
            "C: The Privilege List to identify any user privileges used during the operation",
            "D: The Opcode to understand the operation that triggered the creation of the group"
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Security Event ID 4731"
    },
    {
        "id": "e1b6b9a9-2819-450b-9fc5-d7cc045457a0",
        "source": "owasp_wstg",
        "question": "A recent security audit revealed that users of your e-commerce application can bypass certain steps in the payment workflow, potentially leading to unauthorized purchases. Which of the following steps would be most effective in preventing this issue? (Select two)",
        "choices": [
            "A: Implement strict session management that invalidates user sessions after every transaction.",
            "B: Design the workflow to require server-side validation at each step before proceeding.",
            "C: Disable client-side JavaScript to prevent users from manipulating the payment process.",
            "D: Allow users to edit the payment details at any step to provide a more flexible user experience."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity"
        ],
        "keyword": "Workflow Security"
    },
    {
        "id": "094d6ee0-9f48-4e70-a8d8-1fca58b30373",
        "source": "owasp_wstg",
        "question": "In the context of application security, which of the following statements accurately reflect the role and limitations of automated security analysis and testing tools?",
        "choices": [
            "A: Automated tools can replace manual testing entirely as they are capable of discovering all security vulnerabilities within an application.",
            "B: Automated tools are most effective when used as a component of a well-balanced application security program, complementing other testing techniques.",
            "C: Automated tools, due to their generic nature, are ineffective and should not be used as part of the application security testing process.",
            "D: Automated tools are designed to replace the need for security expertise, as they can adapt to custom code and specific application logic."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Automated Security Tools"
    },
    {
        "id": "2d966865-5f98-4862-9d46-388c6e56e83e",
        "source": "owasp_wstg",
        "question": "Why is it important to identify hidden administrator interfaces in web applications? Select two reasons:",
        "choices": [
            "A: Hidden interfaces can inadvertently provide users with access to unauthorized site design alterations.",
            "B: Identified interfaces ensure that data manipulation by unauthorized users is facilitated.",
            "C: Locating these interfaces helps protect the application from unauthorized configuration changes.",
            "D: Discovering hidden interfaces is necessary for enabling user account provisioning by all users."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "Administrator Interface"
    },
    {
        "id": "48c80eee-166e-49c5-a0ba-56f01efbb10f",
        "source": "attck",
        "question": "An adversary has gained administrator rights on a corporate network and is attempting to leverage browser session hijacking to intercept information and manipulate web traffic. Given the adversary's privileges, which of the following outcomes are they likely capable of achieving? (Select two answers)",
        "choices": [
            "A: Injecting HTML code into banking sites to steal sensitive information.",
            "B: Creating new SSL client certificates to initiate authenticated sessions.",
            "C: Browsing to any intranet resource accessible through the browser, such as Sharepoint or webmail.",
            "D: Permanently altering the browser's source code to maintain persistent access."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "Browser Session Hijacking"
    },
    {
        "id": "e07b8b1f-1953-492a-b481-e72559fa6d5d",
        "source": "attck",
        "question": "An organization's security team is conducting a penetration test to assess the resilience of their systems against privilege escalation attacks. They are particularly concerned about adversaries attempting to circumvent built-in control mechanisms to escalate privileges on both Windows and Linux systems. Which combination of mitigation strategies should be prioritized to address this threat?",
        "choices": [
            "A: Enforcing the use of signed applications only and setting sudo tty_tickets to disabled.",
            "B: Monitoring file system for setuid/setgid bits and strictly editing the sudoers file to require passwords.",
            "C: Disabling User Account Control (UAC) and removing the requirement for passwords in sudoers file.",
            "D: Allowing unsigned applications to run and minimizing the number of programs with setuid/setgid bits set."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Abuse Elevation Control Mechanism"
    },
    {
        "id": "5d742c98-1f86-41b5-83a9-0fcfb935f7c3",
        "source": "apple_platform_security",
        "question": "A user enables iCloud Keychain on their new iPhone. The device establishes a circle of trust and initiates a keychain syncing process. Which of the following statements are true regarding the security and syncing mechanisms of iCloud Keychain?",
        "choices": [
            "A: The syncing identity created by the device includes a private key and a public key, with the public key being stored in the device's keychain.",
            "B: For two-factor authentication accounts, a separate syncing circle with a different set of elliptical keys is created and stored in CloudKit.",
            "C: iCloud Keychain recovery is only possible if the user has two-factor authentication enabled on their account.",
            "D: The syncing circle is signed with the private key of the syncing identity and with a key derived from the user's iCloud password."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "iCloud Keychain"
    },
    {
        "id": "62d97b99-e176-4022-bfc2-440c2a3a8f68",
        "source": "apple_platform_security",
        "question": "An iPhone user has a device that supports Express Cards with power reserve. The battery has just run low, and iOS is not active. Consider the following scenarios and identify which actions would still be possible and the type of feedback the user would receive for successful transactions:",
        "choices": [
            "A: The user can complete a transaction using their Express Travel card, and the transaction will be displayed on the screen immediately.",
            "B: The user can unlock their car with Car keys with Express Mode turned on, but will only receive haptic feedback.",
            "C: Pressing the side button will display the low-battery icon and indicate that Express Cards can still be used.",
            "D: A student can access their dorm using their Student ID card with Express Mode, and the iPhone will vibrate and show a visual confirmation."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Express Cards"
    },
    {
        "id": "8a36c3d0-dbec-4b8b-be41-7b521d18f8e7",
        "source": "owasp_wstg",
        "question": "In reviewing a web application's client-side code, you have encountered an ActionScript function that interacts with external resources. Based on security best practices, which of the following approaches would be most secure to prevent exploitation through unsafe methods like `getURL()`?",
        "choices": [
            "A: Using `getURL(_root.URI, '_targetFrame');` where `_root.URI` is a variable populated from a query string parameter.",
            "B: Implementing server-side validation of all URIs before they are passed to `getURL()`.",
            "C: Restricting the `getURL()` function to only load URIs that lead to static content hosted on the same domain.",
            "D: Replacing `getURL()` with `navigateToURL()` and using URIs provided by the client as parameters without additional validation."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Client-side validation"
    },
    {
        "id": "a12e0018-6465-426d-b6b2-d5993429caa4",
        "source": "cs161_textbook",
        "question": "In the context of memory-safety vulnerabilities, what is a benefit of implementing non-executable pages, and why are they not sufficient on their own to prevent all types of attacks?",
        "choices": [
            "A: Non-executable pages prevent the execution of attacker-injected code in data regions, but they do not stop attackers from leveraging existing executable code in memory.",
            "B: Non-executable pages encrypt the contents of memory, making it harder to execute code, but attackers can still decrypt the memory with sufficient computational resources.",
            "C: Non-executable pages can detect and alert on unusual memory access patterns, but they cannot prevent attackers from reading sensitive information.",
            "D: Non-executable pages prevent buffer overflow attacks by isolating the stack and heap, but attackers can still perform return-oriented programming (ROP) attacks."
        ],
        "answer": "A",
        "topics": [
            "MemorySafety"
        ],
        "keyword": "NonExecutablePages"
    },
    {
        "id": "da18a277-6e52-4e25-82a5-8bd0d852a352",
        "source": "cwe",
        "question": "Review the following code snippets and choose the one that illustrates a function with an insufficient behavioral summary, as described in the vulnerability context.",
        "choices": [
            "A: function calculateInterest(principal, rate) {\n  /* Calculates interest over a period of one year. */\n  return principal * rate;\n}",
            "B: function authenticateUser(username, password) {\n  /* Takes a username and password, returns true if authentication succeeds. */\n  // Authentication logic...\n}",
            "C: function processData(data) {\n  // Process the data.\n  // ...additional processing code...\n  return processedData;\n}",
            "D: function sendEmail(recipient, subject, body) {\n  /* Sends an email to the specified recipient with the given subject and body. */\n  // Email sending logic...\n}"
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "Documentation"
    },
    {
        "id": "a6ff87ab-6c6e-4b71-90e2-5ac43fab00b4",
        "source": "windows_security",
        "question": "An IT auditor is reviewing the logs of an Active Directory domain controller. Which of the following log entries is NOT consistent with the schema of an event where a lingering object has been properly removed from a replica?",
        "choices": [
            "A: Destination DRA: XYZ, Source DRA: ABC, Object: GroupObject456, Options: Remove, Status Code: 202",
            "B: Destination DRA: XYZ, Source DRA: ABC, Object: UserObject123, Options: Delete, Status Code: 203",
            "C: Destination DRA: XYZ, Source DRA: ABC, Object: UserObject123, Options: Cleanup, Status Code: 200",
            "D: Replica Target: XYZ, Replica Source: ABC, Object: UserObject123, Options: Purge, Status Code: 201"
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Event Schema"
    },
    {
        "id": "2fce283e-4f8a-47bd-ba69-aaf029785beb",
        "source": "android_sec_doc",
        "question": "In the process of developing SELinux policies for an Android device, you set the kernel_cmdline parameter to 'androidboot.selinux=permissive' for initial policy development. What is the impact of this action and what subsequent steps should be taken before the device can be considered secure and compliant?",
        "choices": [
            "A: The device will be more secure because all SELinux policies are enforced in permissive mode.",
            "B: The parameter allows policies to be logged but not enforced, which aids in debugging, but it should be removed before shipping to enforce policies and pass CTS.",
            "C: Setting the parameter has no impact on SELinux policy enforcement as it is only a development tool.",
            "D: The device will fail CTS because setting the parameter permanently disables SELinux enforcement."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "kernel_cmdline"
    },
    {
        "id": "92c7ba50-5c82-4976-9f5f-b681e77dcc88",
        "source": "cs161_textbook",
        "question": "You are a network administrator responsible for securing a company's WiFi network. To mitigate security risks, you evaluate the current network configuration. Considering the information about WiFi networks and their vulnerabilities, which of the following configurations would potentially allow unauthorized access or data interception?",
        "choices": [
            "A: A WiFi network with WPA2 encryption and hidden SSID.",
            "B: A WiFi network that uses an open system authentication without any encryption.",
            "C: A WiFi network with MAC address filtering and WPA2 encryption.",
            "D: A WiFi network that broadcasts beacon packets with a non-default SSID."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "WiFi_Security"
    },
    {
        "id": "71e44c60-c40b-41d8-a9cc-47444ff4a6c5",
        "source": "cs161_textbook",
        "question": "A cybersecurity analyst is tasked with designing a defense mechanism to counteract malware employing polymorphic and metamorphic techniques. Which of the following strategies should the analyst consider implementing to enhance the detection and prevention of such malware?",
        "choices": [
            "A: Employ signature-based detection to identify decryption keys within the malware code.",
            "B: Use behavior-based detection systems to analyze the effects of the code, regardless of its syntax.",
            "C: Implement a whitelist of approved software and block any code that has not been previously encountered.",
            "D: Rely on static code analysis tools to detect patterns in the source code of the malware."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Malware"
    },
    {
        "id": "61244f9b-bb5d-40f2-94a0-a6ea54f5abd4",
        "source": "apple_platform_security",
        "question": "Consider you are a system administrator implementing the Bootstrap Token feature in a macOS environment. Select the statements that accurately describe the requirements and potential uses of the Bootstrap Token feature in macOS versions 10.15 and later.",
        "choices": [
            "A: Bootstrap Token requires enrolment in an MDM using Apple School Manager or Apple Business Manager, which supervises the Mac.",
            "B: A Bootstrap Token can be used to authorize the installation of kernel extensions on Macs with Apple silicon when managed using MDM.",
            "C: Bootstrap Token is exclusively used for generating and escrowing secure tokens to mobile accounts and managed administrator accounts.",
            "D: In macOS 11, Bootstrap Token can also be used to authorize software updates without the need for user approval."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Bootstrap Token"
    },
    {
        "id": "42f4f666-d479-4749-ac95-ec0db099aabb",
        "source": "cs161_textbook",
        "question": "You are encrypting a message that ends with the binary sequence `1011100` using a block cipher with a block size of 128 bits. You decide to use CBC mode for encryption. To ensure integrity and proper decryption, you need to pad the message to make it a multiple of the block size. According to best practices for padding in CBC mode, how should you pad the end of this message?",
        "choices": [
            "A: Pad the message with zeros until it reaches 128 bits in total length.",
            "B: Pad the message with a sequence of bits that corresponds to the number of padding bits needed.",
            "C: Append a new block of 128 bits that contains a pattern unique to the padding process.",
            "D: No padding is necessary; proceed with encryption using only the provided binary sequence."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Padding"
    },
    {
        "id": "cdfdf2ba-977a-4852-982c-b50e8913c803",
        "source": "owasp_wstg",
        "question": "A company is deploying a new web application that must be secure by design. As part of the security measures, they need to address the risk of default credentials. Which of the following practices should they implement to mitigate the risk associated with default credentials?",
        "choices": [
            "A: Use a standard default password for all administrative accounts to streamline the support process.",
            "B: Implement a system that requires administrative accounts to change their password upon first login.",
            "C: Randomly generate default passwords for new user accounts but keep them simple for ease of use.",
            "D: Avoid creating predefined passwords for new users and require a secure password creation process."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Default Credentials"
    },
    {
        "id": "4fbb4e01-e069-4a74-9b23-70010557232e",
        "source": "apple_platform_security",
        "question": "In the context of the iOS and iPadOS pairing model, what are the security implications of the mechanisms in place when a device is paired with a host computer?",
        "choices": [
            "A: The device must be unlocked by the user before pairing services can be started.",
            "B: A 256-bit key is provided to the host to unlock an escrow keybag stored on the device after the pairing process.",
            "C: Pairing requires the user to unlock the device and enter their passcode for a public key exchange.",
            "D: Pairing over Wi-Fi is sufficient for the device to establish a trust relationship with the host."
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Pairing Model"
    },
    {
        "id": "d49176db-65dc-4603-b3ab-cc661ebec53a",
        "source": "windows_security",
        "question": "As an IT professional, you are reviewing the security policies of a Windows-based organization. Which of the following practices can enhance the security posture of the environment when configuring the built-in administrator account?",
        "choices": [
            "A: Enabling the administrator account and setting a strong password for it.",
            "B: Renaming the administrator account to a less predictable name.",
            "C: Disabling the administrator account to prevent any use.",
            "D: Configuring the administrator account to have limited privileges."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Administrator Account Security"
    },
    {
        "id": "7f98ff62-e714-4c9c-ac67-0195b51a9bbf",
        "source": "apple_platform_security",
        "question": "An organization is planning to implement a secure communication system using Bluetooth technology for its Apple devices. They require a system that ensures confidentiality, integrity, and authentication, along with resistance to eavesdropping and man-in-the-middle attacks. Given that the organization's devices support Bluetooth 4.1 and later, which of the following security features should be included in the system's design to meet these requirements?",
        "choices": [
            "A: Pairing using P-256 elliptic curve and AES-CMAC algorithms",
            "B: Bonding with pairing information stored in a secure location on iOS, iPadOS, macOS, tvOS, and watchOS devices",
            "C: Message integrity ensured by AES-CCM cryptography",
            "D: Use of RSA_AES ciphers for encryption to disable forward secrecy"
        ],
        "answer": "ABC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Bluetooth"
    },
    {
        "id": "6421b110-3119-45b2-9f2a-84053042be05",
        "source": "owasp_mastg",
        "question": "You are tasked with performing security testing on a mobile application. During testing, you encounter SSL pinning which prevents you from intercepting traffic with a proxy. To proceed with dynamic analysis, you need to deactivate this defense. Which of the following approaches would be most appropriate to address this challenge?",
        "choices": [
            "A: Implementing a multi-threaded anti-debugging control within the application to bypass SSL pinning.",
            "B: Utilizing code injection techniques to modify the SSL pinning logic at runtime.",
            "C: Applying a cryptographic white-box to encrypt traffic and circumvent SSL pinning.",
            "D: Reconfiguring the operating system's sandboxing features to ignore SSL pinning."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SSL pinning"
    },
    {
        "id": "8f8fa77b-6cb0-4952-9c78-135731a8b672",
        "source": "cwe",
        "question": "In an incident response investigation, it was discovered that sensitive customer information was leaked from a company's web application. What could be the most likely cause of this security breach, given that the company recently implemented new features? (Select the best answer)",
        "choices": [
            "A: The web application used strong encryption for data at rest, which was bypassed by the attacker.",
            "B: The access control checks were not aligned with the business logic, allowing unauthorized access to sensitive data.",
            "C: The intrusion detection system was temporarily offline during a maintenance window when the breach occurred.",
            "D: A third-party analytics service used by the web application was compromised, leading to the data leak."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity",
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "DataLeak"
    },
    {
        "id": "d481f375-329d-4985-9b59-b71887c09777",
        "source": "owasp_mastg",
        "question": "A software company is designing a new Android application that needs to support backwards compatibility for signature verification across various Android versions and provide enhanced security against APK modification. Which APK Signature Scheme should the company implement, and what are the benefits and drawbacks of this choice?",
        "choices": [
            "A: APK Signature Scheme v2, as it offers faster verification and more comprehensive protection against modification but doesn't support proof-of-rotation for backward compatibility.",
            "B: APK Signature Scheme v3, as it adds support for SDK version information and proof-of-rotation structure for backward compatibility but requires the old signing certificates to sign the new set.",
            "C: APK Signature Scheme v4, as it provides extremely efficient file hash calculation through fs-verity but requires an additional v2 or v3 signature and is only supported on Android 11 and up.",
            "D: APK Signature Scheme v1, because it is the oldest and most widely supported scheme but has slower verification times and less comprehensive protection against modification."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "APK Signature Scheme"
    },
    {
        "id": "982f78dd-1d2d-4256-b6ce-69991b9b0f26",
        "source": "attck",
        "question": "During a digital forensic investigation, it was determined that an adversary had captured the screen contents of a compromised host. Which of the following methods would not be an expected technique utilized by the adversary for this purpose?",
        "choices": [
            "A: Using a command in a RAT to periodically capture the desktop",
            "B: Exploiting a vulnerability in the system's screen saver to capture the screen",
            "C: Implementing a keylogger to capture keystrokes and infer on-screen activity",
            "D: Calling APIs designed for screen capturing such as `CopyFromScreen`"
        ],
        "answer": "B",
        "topics": [
            "PenTest"
        ],
        "keyword": "Screen Capture"
    },
    {
        "id": "bee78eaf-1989-4827-add0-52024c735220",
        "source": "cs161_textbook",
        "question": "Why is it generally a poor security practice to derive cryptographic keys from human-memorable passwords or passphrases?",
        "choices": [
            "A: Human-memorable passwords often lack sufficient entropy and can be vulnerable to statistical guessing attacks.",
            "B: Cryptographic hash functions such as SHA256 are too slow and computationally intensive, making the system prone to denial of service attacks.",
            "C: Deriving keys from passwords requires too much storage space to maintain a secure mapping of passwords to keys.",
            "D: Password-based keys are usually very long and complex, making it difficult for users to remember without compromising security."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "KeyDerivationSecurity"
    },
    {
        "id": "af9d5c93-474f-4542-9ed5-8eaffcfa2128",
        "source": "windows_security",
        "question": "In a security audit of an organization, the auditor finds that the Interactive logon Machine inactivity limit is set to 1 hour. Which of the following are likely reasons for the auditor to flag this as a potential security issue?",
        "choices": [
            "A: The long inactivity limit increases the risk of unauthorized access due to extended periods of unattended workstations.",
            "B: The long inactivity limit decreases the risk of data leakage as users have ample time to secure their workstations.",
            "C: The long inactivity limit optimizes system performance by reducing the frequency of re-authentication.",
            "D: The long inactivity limit improves user satisfaction by not requiring frequent logins, which enhances security through better user compliance."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Security Audit"
    },
    {
        "id": "37184c78-86e0-4b5e-a40f-9ced28f66674",
        "source": "cwe",
        "question": "An application is being designed to process user input for dynamic content generation. Which of the following architectural choices could potentially mitigate the risk of code injection vulnerabilities, and what are their limitations?",
        "choices": [
            "A: Refactoring the application to avoid dynamic generation of code, which might limit functionality or flexibility.",
            "B: Running code in a sandbox environment like a Unix chroot jail, which might not be feasible and does not protect the application itself from compromise.",
            "C: Using an 'allowlist' input validation strategy to accept only known good input, which may not catch all undesirable inputs if the environment changes.",
            "D: Employing dynamic analysis tools during testing, which may not achieve 100% accuracy and coverage."
        ],
        "answer": "ABCD",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "DesignMitigationLimitations"
    },
    {
        "id": "620739d0-8c54-40cd-9bca-0210d07497d0",
        "source": "attck",
        "question": "An adversary has embedded a malicious payload within a seemingly benign file to avoid detection by network intrusion detection systems. Which technique might they use next to prepare the payload for execution on a compromised Windows host, while maintaining stealth?",
        "choices": [
            "A: Use the Windows Disk Cleanup utility to securely erase the benign file’s traces after deploying the malicious payload.",
            "B: Execute a Windows 'copy /b' command to reassemble binary fragments of the payload.",
            "C: Employ a phishing email with a macro that, when enabled, will trigger the download of additional malicious components.",
            "D: Leverage the Windows 'certutil -decode' command to decode contents of a .txt file storing the base64 encoded payload."
        ],
        "answer": "BD",
        "topics": [
            "PenTest"
        ],
        "keyword": "Deobfuscation Techniques"
    },
    {
        "id": "5b9c9cdf-5a75-4684-9a56-dfea6a62c619",
        "source": "cs161_textbook",
        "question": "Given the principle that 'security is economics,' which of the following scenarios best illustrates a sound application of this principle in the context of securing a network infrastructure?",
        "choices": [
            "A: Implementing expensive, top-of-the-line firewalls on all network segments, regardless of the sensitivity of the data passing through them.",
            "B: Using a basic firewall for a public-facing website that only hosts publicly available information.",
            "C: Investing in advanced intrusion detection systems for the network segment that handles sensitive customer data transactions.",
            "D: Applying costly encryption methods uniformly across all stored data, including non-sensitive publicly released data."
        ],
        "answer": "BC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "EconomicPrinciples"
    },
    {
        "id": "bd810d4b-bb20-4739-8b75-6b4ef9241878",
        "source": "attck",
        "question": "A company has recently suffered from an attack where adversaries gained direct write access to disks, leading to significant data loss. Which of the following would be the most effective combination of mitigation and detection strategies to prevent and identify such an attack in the future?",
        "choices": [
            "A: Implement regular data backups stored off-system and monitor for direct read/write access attempts using '\\.\\' notation.",
            "B: Upgrade the firewall to prevent external access and scan for any disk defragmentation activities.",
            "C: Restrict user permissions on all files and monitor for unusual network traffic patterns.",
            "D: Install anti-virus software on all endpoints and monitor for the installation of new applications."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Disk Wipe"
    },
    {
        "id": "cbd8c37c-b209-4f52-b74e-7c38c85ef57b",
        "source": "cwe",
        "question": "Consider a software module designed to aggregate customer profiles. The module includes an object that represents a customer profile with the following sub-elements: Personal Information, Account Details, Preferences, Transaction History, and Related Accounts. Each sub-element is a complex data type containing additional structures. What are the potential implications of this design on the software's performance and security?",
        "choices": [
            "A: The design may lead to performance issues due to the complexity and size of the customer profile object.",
            "B: The design simplifies the data model and is likely to enhance the overall performance of the software.",
            "C: If an attacker can interact with the code handling the customer profiles, the performance issues could be exploited to introduce vulnerabilities.",
            "D: The use of complex data types for sub-elements ensures faster data retrieval and processing, thus improving the software's security."
        ],
        "answer": "AC",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "DataElement"
    },
    {
        "id": "2b123151-a786-4f89-b376-d8f08814bb60",
        "source": "cs161_textbook",
        "question": "When performing a DNS lookup for 'eecs.berkeley.edu' using the `dig` command with the +norecurse flag, which statements are accurate regarding the process and its outcome?",
        "choices": [
            "A: The root server directly provides the IP address of 'eecs.berkeley.edu' in the answer section of the DNS response.",
            "B: The authority section of the DNS response lists potential name servers that could be queried next, with the corresponding IP addresses provided in the additional section.",
            "C: The recursive resolver optimizes the DNS lookup process by using cached records, which eliminates the need to query root servers for frequently accessed domains.",
            "D: The TTL value in the DNS response indicates the record's validity in the cache, with a typical value for 'edu' domain records being 172,800 seconds."
        ],
        "answer": "BCD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNS"
    },
    {
        "id": "4fdd543a-2174-49ac-80ea-5b1e135604e1",
        "source": "cs161_textbook",
        "question": "An attacker is attempting to exploit a buffer overflow vulnerability in a program that implements stack canaries. Which of the following methods could the attacker use to potentially subvert the stack canary protection? (Select all that apply)",
        "choices": [
            "A: Exploiting format string vulnerabilities to overwrite the return instruction pointer (rip) without altering the canary.",
            "B: Running the program multiple times to brute force guess the canary's value on a 32-bit architecture.",
            "C: Using an unrelated vulnerability to leak the canary value and reuse it in the overflow exploit.",
            "D: Injecting a large amount of data to overflow the stack canary and crash the program, thus bypassing the canary."
        ],
        "answer": "ABC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Stack Canaries"
    },
    {
        "id": "a039eb66-5d6b-4353-9dd5-0fb5a901d99e",
        "source": "windows_security",
        "question": "Which of the following statements is INCORRECT regarding the functionality of Remote Credential Guard in a supported Windows environment?",
        "choices": [
            "A: It helps to secure Remote Desktop credentials by never sending them to the target device.",
            "B: It encrypts credentials stored on the local machine using Windows Defender.",
            "C: It requires compatible Windows versions to function properly.",
            "D: It allows users to take advantage of single sign-on capabilities."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Remote Credential Guard"
    },
    {
        "id": "0dcdeb41-433d-4de6-889a-215b4a127e25",
        "source": "apple_platform_security",
        "question": "An iOS device in your corporate network has been compromised, and you need to perform a remote wipe. Under which of the following circumstances would you be unable to execute a remote wipe on the device?",
        "choices": [
            "A: The device is enrolled with User Enrolment.",
            "B: The device is supervised and enrolled with Microsoft Exchange ActiveSync.",
            "C: The device has not been configured to use FileVault.",
            "D: The device is part of a BYOD programme and has a separate APFS volume for enterprise data."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "RemoteWipe"
    },
    {
        "id": "7b178d5c-fc1a-4b75-84a1-b7e48f784615",
        "source": "owasp_wstg",
        "question": "If you are planning to assess a web application for SQL injection vulnerabilities, which of the following tools would be most effective?",
        "choices": [
            "A: sqlmap",
            "B: wget",
            "C: Find Security Bugs",
            "D: OWASP O-Saft"
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "SQL Injection"
    },
    {
        "id": "185dea13-e8a6-42fe-9180-7d81103a8529",
        "source": "cs161_textbook",
        "question": "In an effort to prevent man-in-the-middle attacks, a new messaging app uses an algorithm that requires users to directly input each other's public keys manually before initiating a secure communication. What are the potential drawbacks of this approach? Select all that apply.",
        "choices": [
            "A: It is not scalable for a large number of users due to the manual entry of public keys.",
            "B: Users may inadvertently input incorrect public keys, leading to communication failures.",
            "C: It relies on an out-of-band method which is immune to man-in-the-middle attacks.",
            "D: Manual key entry is vulnerable to human error, which could be exploited by an attacker to insert their own public key."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "KeyManagement"
    },
    {
        "id": "b31a2b2a-15a2-4db5-aeb0-f6b644793e8c",
        "source": "owasp_mastg",
        "question": "When developing an iOS application in Swift, a developer is considering the implications of data mutability on security for storing confidential user information. Which of the following statements correctly addresses the handling of such data to minimize security risks?",
        "choices": [
            "A: Using 'NSData' or 'let' keyword ensures that the data is immutable and can be easily removed from memory.",
            "B: Storing data as mutable using 'NSMutableData' increases security by allowing the data to be overwritten when no longer needed.",
            "C: Immutable data types like 'NSData' or those declared with the 'let' keyword in Swift cannot be easily removed from memory.",
            "D: Confidential information should be stored with Codable protocol and JSON encoding to ensure automatic data immutability."
        ],
        "answer": "C",
        "topics": [
            "ApplicationSecurity"
        ],
        "keyword": "Data Immutability"
    },
    {
        "id": "4a7569a8-4ca6-4615-a83f-e9815088c88c",
        "source": "attck",
        "question": "An organization has recently experienced a security breach where an adversary gained unauthorized access to the network using legitimate user credentials. The adversary was able to move laterally within the network and exfiltrate sensitive data. Which of the following actions would be the least effective in preventing such a security breach?",
        "choices": [
            "A: Implementing multi-factor authentication on all remote access services.",
            "B: Regularly reviewing account activity logs for detecting anomalous behavior.",
            "C: Disabling all user accounts that are not currently used by active employees.",
            "D: Ensuring that all network communication is encrypted using TLS."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Credential Abuse"
    },
    {
        "id": "fc21522c-a186-45b3-b0af-91534a0c305c",
        "source": "cs161_textbook",
        "question": "In the context of Bitcoin, if Alice wishes to prove her identity to another user, Charlie, which of the following actions should she take to effectively demonstrate that she is the rightful owner of her public key, and why would other actions fail to do so?",
        "choices": [
            "A: Alice should send a message signed with her private key, and Charlie can verify this using her public key.",
            "B: Alice should disclose her private key to Charlie for direct verification.",
            "C: Alice should send her public key to Charlie without any additional information.",
            "D: Alice should ask a centralized authority to confirm her identity to Charlie."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "IdentityVerification"
    },
    {
        "id": "2d45e791-e6f9-4cd9-8e63-affe493a9c3b",
        "source": "owasp_mastg",
        "question": "In Android development, if an Activity is not declared in the AndroidManifest.xml file, which of the following outcomes would occur when attempting to launch that Activity?",
        "choices": [
            "A: The Activity will launch with limited functionality.",
            "B: The attempt to launch the Activity will raise an exception.",
            "C: The app's user interface will revert to the last valid state.",
            "D: The Android operating system will create a default declaration."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity"
        ],
        "keyword": "AndroidManifest.xml"
    },
    {
        "id": "c317c92e-d6c7-4ed9-bcff-530cedcef542",
        "source": "cwe",
        "question": "You are working on a legacy system where you have to introduce new features and maintain existing code. You need to decide on the appropriate compiler settings that will aid you in detecting potential bugs or quality issues in your codebase. Which of the following compiler settings options will best serve your purpose?",
        "choices": [
            "A: Enabling all warnings, including those related to style and portability, and treating them as errors to ensure thorough code review.",
            "B: Using the default warning settings provided by the compiler without any additional flags to speed up the compilation process.",
            "C: Disabling all warnings to clean up the build output for easier reading and interpretation during development.",
            "D: Enabling a specific set of warnings that target known common issues and security vulnerabilities within your code's context."
        ],
        "answer": "AD",
        "topics": [
            "SoftwareSecurity",
            "ApplicationSecurity",
            "Vulnerability"
        ],
        "keyword": "CompilerSettings"
    },
    {
        "id": "675b519a-713c-444d-af34-d127ee549cf0",
        "source": "cwe",
        "question": "What could be a potential consequence of utilizing the same invokable control element in multiple architectural layers of a software product?",
        "choices": [
            "A: Increased code maintainability due to the reuse of control elements.",
            "B: Improved performance because of reduced overhead from duplicated controls.",
            "C: Higher risk of security breaches if the control element is compromised.",
            "D: Simplified testing procedures due to a decrease in the number of unique control elements."
        ],
        "answer": "C",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "Consequence"
    },
    {
        "id": "56cc3621-aafb-47cc-a864-e3d53f8b08a7",
        "source": "owasp_wstg",
        "question": "A web application uses MongoDB as its NoSQL database and exposes a JSON API for data retrieval. A penetration tester is evaluating the application for potential security vulnerabilities. Given that NoSQL databases like MongoDB can be prone to injection attacks due to their custom API calls and looser consistency restrictions, which of the following areas should the tester MOST likely focus on to detect NoSQL injection vulnerabilities?",
        "choices": [
            "A: The areas where the application's API calls are parsed and evaluated for JSON syntax correctness.",
            "B: The areas where the application sanitizes user inputs to filter out HTML special characters such as < > & ;",
            "C: The areas where the application's front-end JavaScript code interacts with CSS properties.",
            "D: The areas where the NoSQL database performs concurrency checks and transactional operations."
        ],
        "answer": "A",
        "topics": [
            "WebSecurity",
            "PenTest"
        ],
        "keyword": "NoSQL Injection"
    },
    {
        "id": "1e3c312c-0a9c-48af-9e51-5c352cc94e7a",
        "source": "cwe",
        "question": "Consider the following code snippets. Which of the following code snippets correctly manage memory to prevent the vulnerability associated with freeing memory not on the heap?",
        "choices": [
            "A: void processRecords() { \n  int recordCount = 10; \n  record_t records[recordCount]; \n  /* Process records */ \n  ... \n  free(records); \n}",
            "B: void allocateRecords() { \n  record_t *records = (record_t*)malloc(sizeof(record_t) * MAX_SIZE); \n  /* Use the allocated records */ \n  ... \n  free(records); \n}",
            "C: record_t *globalRecords; \nvoid initRecords() { \n  globalRecords = (record_t*)malloc(sizeof(record_t) * MAX_SIZE); \n} \nvoid clearRecords() { \n  free(globalRecords); \n}",
            "D: void createRecords() { \n  record_t *records = new record_t[MAX_SIZE]; \n  /* Populate records */ \n  ... \n  delete[] records; \n}"
        ],
        "answer": "BC",
        "topics": [
            "SoftwareSecurity",
            "MemorySafety",
            "Vulnerability"
        ],
        "keyword": "MemoryManagement"
    },
    {
        "id": "557a081e-448c-4f7b-a1d1-9c3df4247710",
        "source": "android_sec_doc",
        "question": "A security analyst is reviewing the attribute changes introduced in Android 9. The analyst is particularly focused on the attributes related to domain interaction and execution of binaries. Which of the following is a correct reason for introducing the `system_executes_vendor_violators` attribute and its associated recommendation?",
        "choices": [
            "A: To encourage the execution of vendor binaries by system domains to ensure better integration between vendor and platform components.",
            "B: To prevent system domains from executing vendor binaries due to the unstable API and to promote the use of HIDL HALs for platform dependencies on vendor binaries.",
            "C: To allow vendor binaries to be executed by any domain without restrictions, promoting a unified security policy across all system components.",
            "D: To mandate that all system domains, including `init` and `shell domains`, are required to execute vendor binaries for maintaining system stability."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Vendor Binaries Execution"
    },
    {
        "id": "d507c7ff-d501-4aa8-b7a6-0ca29fa32f70",
        "source": "apple_platform_security",
        "question": "A security administrator is configuring the built-in firewall on a macOS system. Which of the following configurations can the administrator apply? Select all that apply.",
        "choices": [
            "A: Block all incoming connections indiscriminately.",
            "B: Only allow software that is downloaded and digitally signed to receive incoming connections.",
            "C: Enable the Mac to reply to all ICMP probing and portscan requests.",
            "D: Automatically permit all software, regardless of origin, to receive incoming connections."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Firewall"
    },
    {
        "id": "a3097ed3-d514-4c35-8dd3-4edd98881ef3",
        "source": "apple_platform_security",
        "question": "Which of the following components are part of Apple's hardware security architecture and what are their respective functions? Select all that apply.",
        "choices": [
            "A: Boot ROM - acts as a hardware root of trust for secure boot and prevents software tampering at the lower levels.",
            "B: Secure Enclave - executes general purpose computations and manages the system kernel.",
            "C: AES engine - performs fast inline encryption and decryption, protecting cryptographic keying relationships.",
            "D: Application Processor - provides keying material to the AES engine and directly manages data protection protocols."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "HardwareSecurity"
    },
    {
        "id": "bf6e65a3-3ebf-4206-8e7a-183be3727db3",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing logs and observes repeated execution of a command associated with clipboard data theft on a compromised Windows system. Which command could indicate that an adversary is attempting to access clipboard data as part of their collection process?",
        "choices": [
            "A: clip.exe or Get-Clipboard",
            "B: pbpaste or pbcopy",
            "C: Set-Clipboard",
            "D: Copy-Item -Path"
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Clipboard Data Theft"
    },
    {
        "id": "1f320f90-ee9f-42d0-80f2-a7eb3d8ab3a3",
        "source": "cs161_textbook",
        "question": "What are potential drawbacks of the DNS message format being very lightweight with the use of UDP?",
        "choices": [
            "A: It can lead to increased latency due to the need for retransmissions.",
            "B: It may result in higher overhead due to complex message parsing.",
            "C: It lacks built-in security features, potentially making DNS spoofing easier.",
            "D: It ensures reliable delivery of messages, which may slow down the process."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "DNSMessageFormat"
    },
    {
        "id": "a488fe1b-638a-4e02-84c3-270e5740cbc7",
        "source": "attck",
        "question": "A cybersecurity analyst is investigating a potential data breach in a company's cloud infrastructure. The analyst notices unusual activity involving the creation of new cloud instances and the transfer of large volumes of data to these instances. Which of the following is the MOST likely reason for an adversary to engage in such behavior?",
        "choices": [
            "A: To prepare for a Distributed Denial of Service (DDoS) attack using the cloud instances as amplifiers.",
            "B: To stage collected data in a central location within the cloud before exfiltration.",
            "C: To distribute malware payloads across multiple cloud instances for redundancy.",
            "D: To create backups of stolen data within the cloud infrastructure for data loss prevention."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Data Staging"
    },
    {
        "id": "f2479590-b8fd-4387-9716-efec881d61d0",
        "source": "mozilla_security",
        "question": "A web application is susceptible to clickjacking attacks, where an attacker tricks a user into clicking on something different from what the user perceives. As a security engineer, you are tasked to implement a mitigation strategy using HTTP response headers. Which combination of headers would effectively mitigate this risk?",
        "choices": [
            "A: Setting the 'Content-Security-Policy' header with the 'frame-ancestors' directive",
            "B: Enabling 'X-Frame-Options' header with the 'SAMEORIGIN' or 'DENY' value",
            "C: Implementing 'X-XSS-Protection' header with the '1; mode=block' value",
            "D: Using 'X-Content-Type-Options' header with the 'nosniff' value"
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HTTP Security Headers"
    },
    {
        "id": "53e320b0-895d-408e-8865-c97e7d40aa04",
        "source": "cs161_textbook",
        "question": "You are a software developer tasked with improving the memory safety of your code. Which of the following strategies would be beneficial to apply? Select all that apply.",
        "choices": [
            "A: Implementing run-time checks for automatic bound-checking and directing failed checks towards a controlled crash.",
            "B: Hiring a memory safety expert to review your code, despite the potentially high cost.",
            "C: Exclusively relying on manual code reviews to catch all memory safety errors.",
            "D: Conducting fuzz testing, testing corner cases, and using tools like Valgrind for memory leak detection."
        ],
        "answer": "ABD",
        "topics": [
            "MemorySafety",
            "SoftwareSecurity"
        ],
        "keyword": "MemorySafety"
    },
    {
        "id": "824d520a-018a-42b6-b447-b63af9f37e0d",
        "source": "attck",
        "question": "An adversary is attempting to evade detection by a cybersecurity team that is actively using debuggers to analyze malware behavior. The adversary's malware is designed to perform checks for debugging artifacts and alter its behavior upon detection. As a cybersecurity analyst, which of the following techniques would you consider monitoring to detect the adversary's evasion attempts?",
        "choices": [
            "A: Monitoring for the execution of API calls such as 'IsDebuggerPresent()' and 'NtQueryInformationProcess()'.",
            "B: Checking for the constant presence of the 'COR_ENABLE_PROFILING' environment variable on all system processes.",
            "C: Inspecting the system for any looping calls to 'OutputDebugStringW()' that may flood debug logs.",
            "D: Observing for the use of 'PTRACE_DENY_ATTACH' flag with 'ptrace' command to prevent debugger attachment."
        ],
        "answer": "ACD",
        "topics": [
            "PenTest",
            "SystemSecurity"
        ],
        "keyword": "Debugger Evasion Techniques"
    },
    {
        "id": "9ce2f2a2-7887-4067-ba18-d84c3b0c3ee0",
        "source": "attck",
        "question": "An adversary is using a sophisticated method of traffic signaling that involves sending a special string to any port for triggering a reverse shell. Which of the following detection techniques would be the MOST effective in identifying this specific traffic signaling method?",
        "choices": [
            "A: Monitoring for unusual outbound traffic patterns.",
            "B: Analyzing packet contents for specific strings in any port's traffic.",
            "C: Inspecting SSL/TLS encrypted traffic for anomalies.",
            "D: Reviewing system logs for unauthorized access attempts."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "PenTest"
        ],
        "keyword": "Packet Analysis"
    },
    {
        "id": "bf6c6991-9108-49fb-a530-8b7b04a12d46",
        "source": "owasp_mastg",
        "question": "A developer is reviewing a C/C++ code snippet for potential security and maintenance issues. Identify the issue present in the following code:\n\n#include <sys/wait.h>\n#include <sys/wait.h>\n\nWhat should the developer do to improve the code quality?",
        "choices": [
            "A: Replace both instances with #include <sys/waitpid.h> for better process control.",
            "B: Remove one of the #include <sys/wait.h> directives as it is redundant.",
            "C: Add #include <unistd.h> to ensure compatibility with POSIX systems.",
            "D: Encapsulate the #include directives within an #ifdef guard to prevent multiple inclusions."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SoftwareSecurity"
        ],
        "keyword": "Redundant Code"
    },
    {
        "id": "b291fa81-ebe9-4d58-b3d6-bce303838e9c",
        "source": "cwe",
        "question": "When discussing the risks of initializing network resource configurations with hard-coded values, which of the following consequences could potentially arise?",
        "choices": [
            "A: The software becomes more flexible as it can be easily updated to target new environments.",
            "B: Hard-coded values can lead to a lack of reliability when the software is deployed in different environments.",
            "C: If attackers can reach the relevant code, the use of hard-coded values might introduce security vulnerabilities.",
            "D: The product's performance is enhanced as hard-coded values reduce the need for runtime resolution of resources."
        ],
        "answer": "BC",
        "topics": [
            "SystemSecurity",
            "Vulnerability"
        ],
        "keyword": "Hard-Coding"
    },
    {
        "id": "28298af7-2079-43c3-9382-bc28acee615d",
        "source": "mozilla_security",
        "question": "A web application developer wants to ensure that when users click on external links, only the origin of the page is sent to the new page, and not the full URL path or query string, to enhance privacy. However, when navigating within the same origin, they want the full referrer information to be available. Which Referrer-Policy should the developer implement to meet these requirements?",
        "choices": [
            "A: Referrer-Policy: same-origin",
            "B: Referrer-Policy: strict-origin-when-cross-origin",
            "C: Referrer-Policy: no-referrer",
            "D: Referrer-Policy: no-referrer, same-origin"
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Referrer-Policy"
    },
    {
        "id": "e4e39cd2-6596-49e8-8e9b-74665a611e4a",
        "source": "attck",
        "question": "An adversary gains access to a corporate network and decides to perform software discovery to shape their follow-on behaviors. Which of the following actions aligns with this adversary behavior and why might the adversary choose NOT to perform the other actions?",
        "choices": [
            "A: Enumerating installed software versions to identify vulnerable applications for exploitation.",
            "B: Scanning for open network ports to exploit known network service vulnerabilities.",
            "C: Deploying ransomware immediately to encrypt files for economic gain.",
            "D: Exfiltrating confidential documents to analyze for sensitive information."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Software Discovery"
    },
    {
        "id": "c7781c90-20cb-4b5a-bec3-9fc0efe060e6",
        "source": "windows_security",
        "question": "An IT security consultant is reviewing a company's use of Windows cloud security features. Which of the following should the consultant identify as not being a native feature of the Windows operating system's cloud security?",
        "choices": [
            "A: Encryption of data at rest and in transit",
            "B: Identity and access management controls",
            "C: Continuous compliance monitoring",
            "D: Automated vulnerability scanning of the physical network layer"
        ],
        "answer": "",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cloud Security Features"
    },
    {
        "id": "9ebe21a7-e012-456d-a23b-f65a1e28e9dd",
        "source": "owasp_wstg",
        "question": "In a secure web application, which of the following design choices for an account provisioning system should be considered a poor practice and why?",
        "choices": [
            "A: Allowing only administrators to provision and de-provision accounts, ensuring a high level of control over user access.",
            "B: Requiring multi-factor authentication for all provisioning requests to enhance the security of account creation.",
            "C: Permitting users to provision accounts with elevated privileges without oversight from a higher-level administrator.",
            "D: Implementing an audit trail that logs all provisioning and de-provisioning actions taken by users and administrators."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Privilege Escalation"
    },
    {
        "id": "f0311682-4c9a-488e-bed6-b7de7cd6d92a",
        "source": "apple_platform_security",
        "question": "As an administrator, you are handling a case where an organization's iPad has been reported lost. You decide to utilize the features available to secure the device and protect its data. Which of the following actions can you perform? (Select all that apply)",
        "choices": [
            "A: Enable Managed Lost Mode to lock the device and display a custom message with a contact number.",
            "B: Perform a remote wipe by securely discarding the media key from Effaceable Storage if FileVault is enabled.",
            "C: Use Microsoft Exchange ActiveSync to perform a remote wipe on a device supervised with User Enrolment.",
            "D: Sign in to the device using a federated Managed Apple ID to disable Managed Lost Mode."
        ],
        "answer": "AB",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "device security"
    },
    {
        "id": "8f8c8cfa-4afe-4cfd-ab38-df862c4f28d7",
        "source": "attck",
        "question": "Why would an adversary be interested in enumerating local device drivers on a victim host? Select the BEST counterargument to the claim that device driver discovery has negligible value for an adversary.",
        "choices": [
            "A: Enumerating device drivers only provides general system information that is not actionable for further attacks.",
            "B: Discovering device drivers can reveal security tools and potential vulnerabilities for exploitation.",
            "C: Device drivers are uniform across systems, offering no strategic advantage.",
            "D: Enumerating device drivers is a time-consuming process with little to no payoff in understanding the host's purpose or defenses."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Security Software Discovery"
    },
    {
        "id": "6cc05540-0579-495e-a750-2eab7b7aec28",
        "source": "cs161_textbook",
        "question": "Your organization is considering upgrading its security devices and is comparing Type II and Type III devices as defined by the Federal Information Processing Standard (FIPS). The finance department argues that Type III devices, being the most secure option should be chosen, regardless of cost. Which of the following statements provides the best counterargument to the finance department's claim?",
        "choices": [
            "A: Type III devices are tamper-resistant, making them the only suitable option for high-security requirements.",
            "B: Type II devices are designed to be tamper-evident, which allows for detection of security breaches and is a cost-effective solution for a broader array of applications.",
            "C: Implementing Type II devices would be irresponsible as they do not provide any form of security against tampering.",
            "D: The organization should focus solely on preventive measures and not invest in detection or response capabilities."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "counterargument"
    },
    {
        "id": "8c12a5b7-8620-4ea1-9481-efe84d1b99da",
        "source": "cwe",
        "question": "Considering the historical use of the Wired Equivalent Privacy (WEP) protocol in wireless security, which of the following factors contributed to the vulnerability of its encryption scheme?",
        "choices": [
            "A: The IVs were included in plaintext as part of the packet, making them directly observable to attackers.",
            "B: The WEP protocol supported excessively long IVs, which made encryption keys more vulnerable to brute-force attacks.",
            "C: WEP used a key generation algorithm that was inherently flawed, producing weak keys that could be easily cracked.",
            "D: Some implementations would reuse the same IV for each packet, which simplified the process of plaintext recovery."
        ],
        "answer": "AD",
        "topics": [
            "NetworkSecurity",
            "Vulnerability"
        ],
        "keyword": "WEP Vulnerability"
    },
    {
        "id": "8f13bd2d-4889-4773-85a2-85ec2d119fb3",
        "source": "cwe",
        "question": "A development team is working on a Java-based web application that collects various types of user input through forms. The team is implementing input validation mechanisms to prevent common vulnerabilities such as cross-site scripting and SQL injection. Given the following code snippets, which of them correctly implement the Struts Validator framework to mitigate these security risks?",
        "choices": [
            "A: public class UserForm extends org.apache.struts.validator.ValidatorForm { private String username; public UserForm() { super(); } public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) { ... } }",
            "B: public class UserForm extends org.apache.struts.action.ActionForm { private String username; public UserForm() { super(); } public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) { ... } }",
            "C: <struts-config> <form-beans> <form-bean name=\"UserForm\" type=\"UserForm\"/> </form-beans> <plug-in className=\"org.apache.struts.validator.ValidatorPlugIn\"> <set-property property=\"pathnames\" value=\"/WEB-INF/validator-rules.xml,/WEB-INF/validation.xml\"/> </plug-in> </struts-config>",
            "D: public class UserForm { private String username; public UserForm() { super(); } public ActionErrors validate(String username) { ... } }"
        ],
        "answer": "AC",
        "topics": [
            "ApplicationSecurity",
            "WebSecurity",
            "Vulnerability"
        ],
        "keyword": "StrutsValidator"
    },
    {
        "id": "cae780f6-1084-4539-908e-c1cb35c27c0e",
        "source": "attck",
        "question": "An adversary is seeking to maintain persistence on a compromised system with elevated privileges. Which of the following methods could they use to ensure the malware is executed during system boot or user logon, and why would this be advantageous?",
        "choices": [
            "A: Modifying the kernel to include a new module that executes their malware, leveraging potential higher privileges.",
            "B: Regularly rewriting the crontab to execute their malware at specified intervals, ensuring consistent system access.",
            "C: Sending phishing emails to users to rerun the malware, relying on user action to maintain access.",
            "D: Creating a new, standard user account, which runs the malware script at logon without elevated privileges."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Persistence"
    },
    {
        "id": "72363b25-516d-4e3d-8a5d-c59896a4a715",
        "source": "windows_security",
        "question": "A colleague asserts that securing the Windows operating system is solely about installing the latest antivirus software. Identify the counterargument that best explains why this assertion is not sufficient for comprehensive security.",
        "choices": [
            "A: Antivirus software is the only necessary measure because all other security features are inherently built into the Windows operating system.",
            "B: While antivirus is important, it must be complemented with regular system updates and patch management to address vulnerabilities.",
            "C: Antivirus solutions are outdated and should be replaced with a single firewall for both network and system security.",
            "D: Encryption is unnecessary if antivirus software is kept up-to-date, as it prevents any security breaches that would compromise data."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity"
        ],
        "keyword": "Patch Management"
    },
    {
        "id": "6cf887e4-064f-4ca8-a88b-20485555e636",
        "source": "attck",
        "question": "Why would an adversary choose to perform vulnerability scanning during the active scanning phase of reconnaissance?",
        "choices": [
            "A: To map out the topography of the network and understand the data flow between systems.",
            "B: To identify security weaknesses such as outdated software and misconfigurations that can be exploited.",
            "C: To collect large volumes of data for cryptanalysis and decryption of encrypted network traffic.",
            "D: To generate a list of employee names and email addresses for a social engineering campaign."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Vulnerability Scanning"
    },
    {
        "id": "6b91f5be-5700-464e-90db-c7adc842f649",
        "source": "attck",
        "question": "In the aftermath of a security breach where a third-party service provider's credentials were used to exploit a company's network, which detection method would be LEAST effective in identifying this type of unauthorized access?",
        "choices": [
            "A: Monitoring and analyzing traffic patterns that do not follow expected protocol standards and correlate with anomalous process execution.",
            "B: Monitoring application logs for unexpected actions taken by any delegated administrator accounts.",
            "C: Deploying an Intrusion Detection System (IDS) to flag all incoming traffic from external sources as potential threats.",
            "D: Correlating other security systems with login information to detect inconsistencies such as active login sessions without physical or VPN access."
        ],
        "answer": "C",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Intrusion Detection System (IDS)"
    },
    {
        "id": "8782efe8-09d1-4b04-a939-bad2324eef2c",
        "source": "cwe",
        "question": "A high-traffic web server uses assert statements to validate user sessions. An attacker discovers that by sending specially crafted requests, they can trigger the assert, causing the server to drop all active connections. As a software architect, you are tasked with redesigning the system to handle such assertions more gracefully. Which design change would mitigate the issue while minimizing negative side effects?",
        "choices": [
            "A: Implementing a separate assertion handler that queues failed assertions for review and allows the server to continue serving other connections.",
            "B: Removal of all assert() statements from the server code to prevent any possibility of assertions being triggered.",
            "C: Isolating each user session in a separate process so that a failed assert in one does not affect the others.",
            "D: Rate limiting incoming requests to reduce the chance of an assert being triggered by an attacker."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "SystemDesign"
    },
    {
        "id": "42aa3f04-53f3-420f-90f3-6b24e60c4c8f",
        "source": "cs161_textbook",
        "question": "A developer claims that setting the 'HttpOnly' attribute on a session cookie is unnecessary if the website already employs robust server-side security measures. What is the best argument against this claim?",
        "choices": [
            "A: The 'HttpOnly' attribute is redundant because server-side security can prevent all types of cross-site scripting (XSS) attacks.",
            "B: The 'HttpOnly' attribute is necessary because it provides an additional layer of defense in depth, potentially mitigating the impact of an XSS attack that bypasses server-side protections.",
            "C: The 'expires' attribute is more important than 'HttpOnly' because it dictates how long the cookie is valid and thus impacts security more directly.",
            "D: The 'Domain' attribute is crucial as it ensures the cookie is sent to the correct domain, making 'HttpOnly' irrelevant."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HttpOnlyAttribute"
    },
    {
        "id": "62312ba4-3ba5-4461-8586-98db64c5e1b8",
        "source": "owasp_wstg",
        "question": "In a review of an organization's web server infrastructure, you find that the authentication systems are configured with complex password requirements and support multi-factor authentication. However, you also discover that they permit unlimited login attempts without any account lockout policy. Which of the following statements is a valid reason why this configuration does not adequately secure the authentication systems?",
        "choices": [
            "A: Complex passwords and multi-factor authentication increase the time needed for user authentication, leading to a higher chance of denial-of-service attacks.",
            "B: Unlimited login attempts without an account lockout policy could allow a brute force attack, undermining the effectiveness of complex passwords and multi-factor authentication.",
            "C: Multi-factor authentication is incompatible with web applications that require high availability.",
            "D: Complex password requirements might cause users to write down passwords, which is a less significant risk than brute force attacks."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Brute Force Attack"
    },
    {
        "id": "a6c18124-c36d-4c31-ba09-aa0b675944de",
        "source": "cs161_textbook",
        "question": "As a security analyst for a multinational company, you are tasked with implementing measures to mitigate the risk of NSA surveillance under FISA section 702. Which of the following actions could potentially reduce the likelihood of data collection by the NSA? (Select all that apply)",
        "choices": [
            "A: Restricting the use of U.S.-based service providers for company communications.",
            "B: Ensuring all employees are U.S. citizens or permanent residents.",
            "C: Implementing robust end-to-end encryption for all company communications.",
            "D: Regularly changing the metadata contained within communications to avoid detection."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity"
        ],
        "keyword": "Surveillance"
    },
    {
        "id": "ae5a93c3-a4c4-4eb7-b888-304d007318da",
        "source": "cwe",
        "question": "Which of the following system behaviors would NOT contribute to an observable behavioral discrepancy that could facilitate an attack?",
        "choices": [
            "A: The system emits varying levels of heat depending on the computational effort required to process requests.",
            "B: The system utilizes a constant-time algorithm to compare user input to stored secrets.",
            "C: The system's LED lights blink in patterns correlating to data processing activities.",
            "D: The system returns a 'user not found' message only when the username does not exist in the database."
        ],
        "answer": "B",
        "topics": [
            "SoftwareSecurity",
            "Vulnerability"
        ],
        "keyword": "BehavioralDiscrepancyPrevention"
    },
    {
        "id": "356b6b22-af9c-498b-8232-ac030e45a6e7",
        "source": "windows_security",
        "question": "A system administrator is configuring a Windows Server that acts as a domain controller. They aim to improve security by mitigating the risk of man-in-the-middle attacks on LDAP traffic. Which policy setting should the administrator enforce to ensure LDAP clients must negotiate data signing, while also considering the potential impact on clients that do not support LDAP signing?",
        "choices": [
            "A: Set the Domain controller: LDAP server signing requirements policy to None, as it supports data signing requests from clients.",
            "B: Set the Domain controller: LDAP server signing requirements policy to Require signature, to enforce LDAP data-signing negotiation.",
            "C: Set the Domain controller: LDAP server signing requirements policy to Not defined, to allow the system to use default settings for flexibility.",
            "D: Implement IPsec Authentication Header mode without changing the LDAP server signing requirements, as it alone sufficiently counters man-in-the-middle attacks."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity"
        ],
        "keyword": "LDAP server signing"
    },
    {
        "id": "d96618c7-1161-4384-83b1-a28e0f8e866b",
        "source": "owasp_wstg",
        "question": "A security audit at your organization has revealed that the server's security logs directory is set to 755 permissions, allowing group and others to read and execute files. A colleague argues that this is acceptable since it allows the IT support staff to easily access logs for troubleshooting. Which of the following is the most valid counterargument to this claim?",
        "choices": [
            "A: Allowing execute permissions on log files is necessary for IT support staff to run diagnostic tools.",
            "B: Setting logs to be world-readable does not pose a security risk since logs do not contain sensitive information.",
            "C: Log files should be strictly confidential and only accessible by authorized personnel to prevent potential leak of sensitive data.",
            "D: Reducing permissions may prevent the web server from writing new entries to the logs, undermining their purpose."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "File Permissions"
    },
    {
        "id": "55f1e2e3-461d-4349-94b9-8d63734aa94d",
        "source": "attck",
        "question": "An adversary has gained initial access to a corporate network and is looking to enumerate valid accounts to facilitate further attacks such as privilege escalation and lateral movement. Which of the following actions would the adversary most likely take to perform account discovery, and which mitigation could an organization implement to impede this activity?",
        "choices": [
            "A: The adversary may use built-in PowerShell commands to list user accounts, and the organization can prevent enumeration of administrator accounts during UAC elevation by configuring a specific registry key.",
            "B: The adversary might attempt to discover accounts by physically inspecting network hardware, and the organization can mitigate this by implementing 24/7 surveillance of server rooms.",
            "C: The adversary could rely on social engineering to deceive employees into revealing account details, and the organization can counter this by implementing strict email content filtering.",
            "D: The adversary may exploit software vulnerabilities to bypass authentication mechanisms, and the organization can mitigate by deploying antivirus software on all endpoints."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "PowerShell"
    },
    {
        "id": "4b7eb121-2a4a-4ce9-b619-ff7739bc3b8c",
        "source": "cs161_textbook",
        "question": "Consider an implementation of the AES-EMAC algorithm for message authentication. If the key \\(K\\) and message \\(M\\) are given as described in the AES-EMAC process, what steps will correctly result in the computation of the tag \\(T\\) for message \\(M\\), and what would likely occur if one of the steps is modified?",
        "choices": [
            "A: The message \\(M\\) is divided into 128-bit blocks and an initial state \\(S_0 = 0\\) is set. Then, each block is combined with the previous state and encrypted with key \\(K_1\\) to compute the sequence \\(S_i\\). Altering the initial state to a non-zero value might lead to an incorrect tag that cannot be verified.",
            "B: Two keys \\(K_1\\) and \\(K_2\\) are derived from the main key \\(K\\). The final tag \\(T\\) is calculated by encrypting the last state \\(S_n\\) with \\(K_1\\), and modifying the key derivation process could result in a security breach allowing tag forgery.",
            "C: Each 128-bit block of the message \\(M\\) is directly encrypted with key \\(K_2\\) without the XOR operation with the previous state, and the final tag is the result of the encryption of the last block. Skipping the XOR step and using the wrong key may lead to predictable tags that can be forged.",
            "D: The message \\(M\\) is processed in blocks, XORed with a cumulative state encrypted by \\(K_1\\), and the final tag is produced by encrypting the cumulative state \\(S_n\\) with \\(K_2\\). Deviating from this block processing method could compromise the integrity of the tag, enabling an attacker to manipulate message authentication."
        ],
        "answer": "AD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "AES-EMAC"
    },
    {
        "id": "1e2bc5b0-4fca-4180-845f-3fafdd870632",
        "source": "android_sec_doc",
        "question": "In the context of Android security, what is a valid counterargument to the claim that using a separate SELinux domain `vendor_init` to run vendor-specific commands may be unnecessary?",
        "choices": [
            "A: The vendor init process can restrict access to the system partition, preventing vendors from customizing their devices.",
            "B: A separate domain for vendor-specific commands prevents vendor scripts from instructing init to access files outside of the stable system-vendor ABI.",
            "C: Using the `vendor_init` domain adds complexity to the boot process and can potentially lead to longer boot times.",
            "D: The vendor init subprocess can potentially override the default init context, thereby weakening the system's security posture."
        ],
        "answer": "B",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "SELinux domain"
    },
    {
        "id": "1f5ddf6f-f9da-450a-9b99-f9ecaec53051",
        "source": "cs161_textbook",
        "question": "In the context of signature-based detection systems for computer viruses, what are the potential advantages and disadvantages of this method, considering the ongoing arms race with attackers?",
        "choices": [
            "A: Advantage: The system is effective against zero-day attacks. Disadvantage: Requires constant updates to maintain effectiveness.",
            "B: Advantage: Can quickly identify and isolate known viruses. Disadvantage: Struggles with polymorphic viruses that alter their appearance.",
            "C: Advantage: Does not require updates once set up. Disadvantage: May cause significant system performance degradation.",
            "D: Advantage: Can preemptively block viruses before they infect systems. Disadvantage: Attackers cannot anticipate and adapt to the detection methods."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "SignatureDetection"
    },
    {
        "id": "c8fab6b9-9334-46eb-b81d-de87b4abde96",
        "source": "windows_security",
        "question": "A company's security audit reveals that an unauthorized application was able to execute code through an optional subsystem. Which of the following measures could have most effectively mitigated this risk had it been implemented?",
        "choices": [
            "A: Setting up a whitelist of approved optional subsystems and blocking all others.",
            "B: Implementing mandatory user training for all employees on the dangers of unauthorized software.",
            "C: Increasing the frequency of system backups to ensure quick recovery from any potential breaches.",
            "D: Upgrading all optional subsystems to their latest versions to patch known vulnerabilities."
        ],
        "answer": "A",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "Whitelist security policy"
    },
    {
        "id": "c3612d50-86ec-4bf0-b9a1-604615ad9243",
        "source": "owasp_mastg",
        "question": "An iOS application developer decides to use the 'Network' framework for all HTTP and HTTPS communications in their app due to its low-level networking capabilities. Considering Apple's recommended practices, evaluate the developer's decision and select the most accurate statement.",
        "choices": [
            "A: The decision is optimal because the 'Network' framework offers better performance for all network communications.",
            "B: The decision is not recommended because 'URLSession' is the native and optimized choice for HTTP and HTTPS connections.",
            "C: The decision is justified because the 'Network' framework is the only API supporting TLS 1.3 for secure connections.",
            "D: The decision is advisable as the 'Network' framework requires less boilerplate code, reducing the possibility for errors."
        ],
        "answer": "B",
        "topics": [
            "ApplicationSecurity",
            "SystemSecurity"
        ],
        "keyword": "iOS Network APIs"
    },
    {
        "id": "a2050d82-0ca3-45da-969f-a2f6fd811481",
        "source": "attck",
        "question": "An adversary is considering the use of compromised infrastructure for an upcoming cyber operation. Which of the following reasons is LEAST likely to be a factor in their decision to use such infrastructure?",
        "choices": [
            "A: Compromised infrastructure can allow operations to blend in with normal traffic, making detection harder.",
            "B: Using compromised infrastructure can make it difficult to attribute the actions back to the adversary.",
            "C: Compromised infrastructure is always cheaper than using legitimately owned infrastructure.",
            "D: Adversaries may compromise the infrastructure of other adversaries to use in their operations."
        ],
        "answer": "C",
        "topics": [
            "PenTest"
        ],
        "keyword": "Compromise Infrastructure"
    },
    {
        "id": "26c0e656-58a5-41f6-8015-9208e1cdacb0",
        "source": "apple_platform_security",
        "question": "A user is concerned about the level of data protection on their iOS device. They want to ensure that their health data and Medical ID information are secure in case the device is lost or stolen. Given that the user has already set up a strong alphanumeric passcode, which of the following statements correctly describe the security measures in place for their health data and Medical ID? (Select all that apply)",
        "choices": [
            "A: Health data shared with other users via Health sharing in iOS 15 is protected by end-to-end iCloud encryption, and Apple cannot access the data.",
            "B: Medical ID information is stored with Data Protection class No Protection to ensure accessibility without a device passcode on the Lock Screen.",
            "C: Health data is backed up to iCloud Backup with the same encryption characteristics regardless of the iOS version in use.",
            "D: A strong alphanumeric passcode provides additional entropy for encryption keys, enhancing the security of data within certain protection classes."
        ],
        "answer": "ABD",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "DataProtection"
    },
    {
        "id": "eb3b8bfd-ec9c-41b4-a10d-730354570b29",
        "source": "cs161_textbook",
        "question": "Why does the DNS protocol use UDP and have a simple message format for queries?",
        "choices": [
            "A: To ensure data integrity and prevent message tampering.",
            "B: To provide a secure, encrypted channel for query transmission.",
            "C: To be lightweight and fast by avoiding TCP handshakes and reducing overhead.",
            "D: To guarantee delivery and order of DNS query responses."
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DNS"
    },
    {
        "id": "756dc305-18bf-40b3-a9ef-08f9d84dd2ec",
        "source": "cs161_textbook",
        "question": "Consider a network where a malicious actor has successfully performed a DHCP spoofing attack. Which of the following could be potential outcomes of this attack, and what might the attacker have manipulated to achieve these results?",
        "choices": [
            "A: The attacker could intercept traffic by offering their IP as the gateway, allowing them to modify packets.",
            "B: The attacker could redirect users to malicious websites by altering the DNS server address in the DHCP offer.",
            "C: The attacker could prevent users from connecting to the network by sending invalid subnet mask configurations.",
            "D: The attacker could gain access to user credentials by providing a false SSH server in the DHCP options."
        ],
        "answer": "AB",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "DHCP"
    },
    {
        "id": "dfaae8ce-4158-49ef-84d6-e3570ccbef67",
        "source": "attck",
        "question": "A cybersecurity analyst notices unusual access patterns in the file access logs of a corporate network. The logs indicate repeated access to local browser storage files such as `%APPDATA%/Google/Chrome`. Given the scenario, which of the following are potential implications of this activity? (Select TWO.)",
        "choices": [
            "A: It may indicate an adversary's attempt to gather browser information such as bookmarks and browsing history.",
            "B: The access patterns could suggest routine software updates to the browser application.",
            "C: Repeated access may be a sign of a user consolidating their browser data for migration to a new device.",
            "D: Such activity might represent an adversary leveraging browser information to identify additional targets within the network."
        ],
        "answer": "AD",
        "topics": [
            "PenTest",
            "SystemSecurity",
            "WebSecurity"
        ],
        "keyword": "Browser Information Discovery"
    },
    {
        "id": "9aee8f43-cdb1-4142-a70b-ff7166837d61",
        "source": "attck",
        "question": "A cybersecurity team is tasked with enhancing the monitoring of their network to better detect potential adversarial activities regarding Group Policy Discovery. Based on best practices for detecting such activities, which of the following monitoring strategies would be LEAST effective in identifying unauthorized access to group policy settings?",
        "choices": [
            "A: Monitoring for the execution of the 'gpresult' command and associated processes.",
            "B: Setting up alerts for high volumes of LDAP traffic to domain controllers.",
            "C: Analyzing traffic patterns that deviate from expected protocol standards and packet inspection.",
            "D: Monitoring for increased use of common user applications like web browsers or email clients."
        ],
        "answer": "D",
        "topics": [
            "SystemSecurity",
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Group Policy Discovery"
    },
    {
        "id": "74edd7b5-7d19-44ca-b1aa-c7801bd360c8",
        "source": "attck",
        "question": "A cybersecurity analyst claims that monitoring application layer protocols alone is sufficient for detecting adversary C2 communications within a network. Which of the following statements provides the best counterargument to this claim? (Select TWO.)",
        "choices": [
            "A: Adversaries may use non-application layer protocols, which are less commonly monitored, to evade detection.",
            "B: Monitoring only application layer protocols is adequate since all C2 communications occur over HTTP and HTTPS.",
            "C: Non-application layer protocols like ICMP and UDP can be used by adversaries for C2 communications and are not typically scrutinized.",
            "D: Application layer protocols are the only protocols that need to be implemented by all IP-compatible hosts, so others can be ignored."
        ],
        "answer": "AC",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Non-Application Layer Protocol"
    },
    {
        "id": "541e1e69-6c15-4f58-b976-96969f221c45",
        "source": "windows_security",
        "question": "In a recent security audit, it was found that the lock screens of the company's Windows clients displayed too much personal information about the users. As a security consultant, which recommendations would you make to enhance security without significantly impacting user experience?",
        "choices": [
            "A: Recommend removing all personal identifiers from the lock screen, including names and photos, to prevent any chance of social engineering.",
            "B: Suggest configuring the lock screen to display the user's full name and photo for easier identification by colleagues.",
            "C: Advise displaying a generic message such as 'This workstation is locked' instead of any user-specific information.",
            "D: Propose to display the user's department and job title to allow for quick identification while reducing the risk of personal information misuse."
        ],
        "answer": "AC",
        "topics": [
            "SystemSecurity",
            "ApplicationSecurity"
        ],
        "keyword": "security audit"
    },
    {
        "id": "1e292fe4-7a00-4afc-9e7f-6b38e24065c0",
        "source": "attck",
        "question": "A security analyst notices an unusual activity in the system logs where a trusted script is being executed at odd hours. To identify potential misuse and gather evidence for further investigation, which data sources should the analyst monitor for signs of script proxy execution of malicious files?",
        "choices": [
            "A: Network traffic patterns and external IP addresses to track the source of the script execution.",
            "B: Executed commands and arguments for scripts like PubPrn.vbs that may proxy execution of malicious files.",
            "C: User login attempts and privilege escalation events to check for unauthorized access.",
            "D: Script processes, such as `cscript`, and attempts to enable scripts running on the system."
        ],
        "answer": "BD",
        "topics": [
            "SystemSecurity",
            "PenTest"
        ],
        "keyword": "Script Proxy Execution"
    },
    {
        "id": "97ec2aa6-2db5-41b4-a943-324ebe6f64fe",
        "source": "attck",
        "question": "A cybersecurity analyst is reviewing network traffic logs and observes an increase in data being sent to previously known web services. Which of the following would be an appropriate method to distinguish between legitimate use and potential exfiltration of data to these web services?",
        "choices": [
            "A: Monitoring for network connections initiated by non-browser processes to web services.",
            "B: Blocking all traffic to known web services to prevent data exfiltration.",
            "C: Ignoring SSL/TLS encrypted traffic to web services as it is generally secure.",
            "D: Assuming all increased traffic to web services is malicious and alerting accordingly."
        ],
        "answer": "A",
        "topics": [
            "NetworkSecurity",
            "PenTest"
        ],
        "keyword": "Network Traffic Analysis"
    },
    {
        "id": "513f71f5-0808-418c-9e54-92612caf881c",
        "source": "owasp_wstg",
        "question": "A web application uses Cross Origin Resource Sharing (CORS) to allow certain cross-domain requests. Which of the following CORS configurations could potentially introduce security vulnerabilities?",
        "choices": [
            "A: The application sets the Access-Control-Allow-Origin header to a specific domain that the application expects to receive requests from.",
            "B: The application uses a wildcard in the Access-Control-Allow-Origin header indicating all domains are allowed.",
            "C: The application includes the Access-Control-Allow-Credentials header with a value of 'true' and sets the Access-Control-Allow-Origin header to the requesting domain, not a wildcard.",
            "D: The server implements a check to validate the Origin request header against a list of allowed domains before sending the Access-Control-Allow-Origin header."
        ],
        "answer": "B",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "CORS Misconfiguration"
    },
    {
        "id": "e252852e-3b32-4e82-80ed-734038ac80c9",
        "source": "cs161_textbook",
        "question": "Imagine a digital cryptocurrency named CryptoX, which aims to have the same properties as physical currency. Which of the following scenarios would indicate that CryptoX is achieving the basic properties of a functioning currency system as described by the simplified model in the context of a decentralized system such as Bitcoin?",
        "choices": [
            "A: CryptoX allows Alice to send Bob a certain number of units without requiring a centralized authority to validate the transaction.",
            "B: CryptoX users must rely on a centralized CryptoX bank to confirm their identities before they can engage in transactions.",
            "C: The CryptoX system prevents Alice from spending more units of currency than she has in her account, without relying on a traditional bank.",
            "D: CryptoX requires a trusted third-party to keep an accurate list of account holders with their balances and ensure transactions are legitimate."
        ],
        "answer": "AC",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Cryptocurrency"
    },
    {
        "id": "b98abfa0-e6e5-4f4c-a84b-6c640dcd554c",
        "source": "cs161_textbook",
        "question": "Alice wants to send a sensitive document to Bob over an insecure channel. She desires to ensure that the document remains private, is not tampered with, and that Bob can confirm the document was indeed sent by her. Which set of cryptographic properties should Alice ensure are implemented to achieve her goals?",
        "choices": [
            "A: Confidentiality to prevent Eve from reading the document, and integrity to ensure that the document is not altered during transmission.",
            "B: Authenticity to confirm the sender's identity, and deniability to prevent Bob from proving the origin of the document to others.",
            "C: Integrity to prevent tampering with the document, and authenticity to verify the sender's identity to Bob.",
            "D: Confidentiality to keep the document secret, integrity to detect any tampering, and authenticity to confirm Alice as the sender."
        ],
        "answer": "D",
        "topics": [],
        "keyword": "CryptographyProperties"
    },
    {
        "id": "51ac5666-51c4-487e-ab88-e6c0abd22a85",
        "source": "cs161_textbook",
        "question": "Alice wants to communicate securely with David Wagner and has a digital certificate claiming to be his public key, signed by Jerry Brown. Assuming Alice has verified the certificate's signature using Jerry's public key and trusts Jerry, which of the following statements are true regarding the security of Alice's communication with David?",
        "choices": [
            "A: Alice needs to contact a trusted directory service to ensure the certificate's validity.",
            "B: Alice can trust the validity of David Wagner's public key if she believes in Jerry's ability to manage key associations competently.",
            "C: Alice must obtain the certificate directly from David Wagner for it to be considered valid.",
            "D: The certificate can be considered self-validating, and Alice can use it to communicate with David even if obtained from an untrustworthy source."
        ],
        "answer": "BD",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "Digital Certificates"
    },
    {
        "id": "f9eff502-86e2-4783-a98c-b11fb760bd66",
        "source": "attck",
        "question": "A large retail company has experienced a website defacement attack where offensive images were displayed on their e-commerce platform. As a cybersecurity consultant, what mitigation strategies would you recommend to the company to prepare for and recover from such incidents?",
        "choices": [
            "A: Implement IT disaster recovery plans that involve regular data backups stored off-system.",
            "B: Advise the use of strong passwords for all user accounts to prevent website defacement.",
            "C: Recommend the deployment of antivirus software on all company devices.",
            "D: Suggest the installation of an intrusion detection system that specializes in preventing defacement attacks."
        ],
        "answer": "A",
        "topics": [
            "PenTest"
        ],
        "keyword": "Data Backup"
    },
    {
        "id": "b08d6547-c24b-4e53-b6ef-b425e4e71547",
        "source": "owasp_wstg",
        "question": "A security analyst is evaluating a web application that persists user session data. Which of the following storage mechanisms would generally be considered the safest for storing a user's session identifiers?",
        "choices": [
            "A: Local Storage",
            "B: Session Storage",
            "C: Cookies with the HttpOnly and Secure flags",
            "D: IndexedDB"
        ],
        "answer": "C",
        "topics": [
            "WebSecurity"
        ],
        "keyword": "HttpOnly and Secure flags"
    }
]