Free CyberSec First Responder® Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CyberSec First Responder® practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An analyst inventories devices on a sensitive network by observing their existing communications without transmitting discovery probes. Which limitation must the analyst account for?

   1. A. Devices using dynamic addresses cannot appear in the inventory.
   2. B. Devices silent throughout the observation period may be missed.
   3. C. Devices communicating across subnets are always counted twice.
   4. D. Devices with open ports must respond before they can be observed.

   Answer: B

   Explanation: NIST states, "Passive discovery takes more time to gather information than does active discovery, and hosts that do not send or receive traffic during the monitoring period might not be reported." A silent device produces no traffic for this passive inventory. Dynamic addressing does not inherently prevent observation, and passive discovery neither requires probe responses nor necessarily double-counts cross-subnet traffic.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 4.1, Network Discovery, p. 4-1

2. 2A security manager uses NIST CSF 2.0 to report how existing cybersecurity capabilities differ from desired capabilities. Which comparison directly identifies improvement gaps?

   1. A. The Current Profile against the Target Profile.
   2. B. The Current Profile against an inventory of newly purchased tools.
   3. C. The Target Profile against a list of last year's incident counts.
   4. D. The Target Profile against the total annual cybersecurity budget.

   Answer: A

   Explanation: NIST directs organizations to "Analyze the gaps between the Current and Target Profiles, and create an action plan." Current and desired outcomes are comparable posture descriptions. Purchases, incident totals, and budget alone do not describe the gap between achieved and desired outcomes.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, step 4, p. 7

3. 3Authentication telemetry shows the same common password attempted against hundreds of user accounts, with only a few attempts per account. Which attack pattern does this most closely match?

   1. A. Credential stuffing using many previously stolen username-password pairs.
   2. B. Offline password cracking against a copied password-hash database.
   3. C. A dictionary attack trying many candidate passwords against one account.
   4. D. Password spraying using a small password set across many accounts.

   Answer: D

   Explanation: MITRE describes using "a single or small list of commonly used passwords against many different accounts." This matches spraying. Credential stuffing reuses stolen pairs; offline cracking attacks hashes; a single-account dictionary attack has the opposite distribution.

   Reference: MITRE ATT&CK: Password Spraying (T1110.003) — T1110.003, Description

4. 4A confirmed infected endpoint is actively spreading malware. Responders are authorized to move it to an isolated remediation network while preserving needed connectivity for response tools. What is the immediate purpose of this action?

   1. A. To prove which individual launched the initial attack.
   2. B. To prevent further expansion and damage from the incident.
   3. C. To certify that all persistence mechanisms have been removed.
   4. D. To declare the original endpoint ready for normal operations.

   Answer: B

   Explanation: NIST states, "Containment refers to preventing the expansion of an incident." Isolation limits spread. It does not by itself attribute the attacker, eradicate persistence, or verify readiness for restoration.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile — Table 3, RS.MI-01, N1, p. 32

5. 5A backup completed successfully before a ransomware incident was detected. What should responders establish before using that backup for restoration?

   1. A. That the backup job finished, without inspecting the backup contents.
   2. B. That integrity and compromise checks support using the backup.
   3. C. That the backup is recent, without checking for existing malware.
   4. D. That the backup file is readable, without checking for corruption.

   Answer: B

   Explanation: NIST recommends, "Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use." Completion, recency, and basic readability alone do not establish the cleanliness and integrity needed for restoration.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile — Table 3, RC.RP-03, R1, p. 34

6. 6An authorized asset-discovery task requires Nmap to identify responding hosts without following discovery with a port scan. Which option provides this behavior?

   1. A. -sV
   2. B. -O
   3. C. -Pn
   4. D. -sn

   Answer: D

   Explanation: Under -sn, the Nmap guide states, "This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes." In contrast, -Pn skips host discovery, -O requests OS detection, and -sV requests service version detection.

   Reference: Nmap Reference Guide: Host Discovery — Host Discovery, -sn (No port scan)

7. 7Two systems receive the same scanner severity label, but one supports a critical business process and has much greater exposure. How should an analyst prioritize the remediation report?

   1. A. Treat matching labels as proof that organizational risks are equal.
   2. B. Evaluate organizational risk rather than relying only on scanner labels.
   3. C. Give the older scanner result priority regardless of system context.
   4. D. Select the system with fewer ports regardless of business consequences.

   Answer: B

   Explanation: NIST states, "Assessors should determine the appropriate risk level for each vulnerability and not simply accept the risk levels assigned by vulnerability scanners." Business impact and exposure can distinguish risks despite matching labels. Finding age and raw port counts do not override that context.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 4.3, p. 4-6

8. 8An analyst finds an unauthorized executable in a Windows Startup folder. Which behavior makes this finding a potential persistence indicator?

   1. A. It is configured to execute when the affected user logs in.
   2. B. It executes when an analyst merely opens the Startup folder.
   3. C. It executes whenever the host receives a new network address.
   4. D. It waits for the user to launch the program directly each time.

   Answer: A

   Explanation: MITRE states, "Placing a program within a startup folder will also cause that program to execute when a user logs in." This autostart trigger supports persistence. Merely viewing the folder or receiving an IP address is not that trigger, and direct manual launching is not required by the Startup mechanism.

   Reference: MITRE ATT&CK: Registry Run Keys / Startup Folder (T1547.001) — T1547.001, Description, Startup folders

9. 9After containing a compromise, responders remove malicious persistence, disable breached accounts, and correct exploited vulnerabilities. Which response activity do these actions represent?

   1. A. Detection of an unverified adverse event.
   2. B. Collection of initial incident reports.
   3. C. Eradication of the incident's footholds and effects.
   4. D. Notification of external stakeholders.

   Answer: C

   Explanation: NIST explains that "eradication may be necessary to eliminate persistence mechanisms and entry points" and gives malware removal, breached-account disabling, and exploited-vulnerability mitigation as examples. Detection, report collection, and notification do not describe this removal work.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile — Table 3, RS.MI-02, N1, p. 33

10. 10A recovery plan identifies authentication and name-resolution services as dependencies of a critical business application. How should this dependency information affect restoration?

    1. A. Restore services in arbitrary order and investigate failures afterward.
    2. B. Restore the largest application first regardless of its dependencies.
    3. C. Restore essential dependencies in the order required for the application to work.
    4. D. Bring the application online before restoring any supporting services.

    Answer: C

    Explanation: NIST recommends, "Validate that essential services are restored in the appropriate order." The stated dependencies must be available for the application to function. Arbitrary, size-based, or application-before-dependency restoration ignores that relationship.

    Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile — Table 3, RC.RP-04, R1, p. 34