Cyber Security MCQs - Web Security, Malware and IT Act 2000 (Set 6)

Q1. What is the most effective primary defence against SQL injection?

a) Parameterised queries (prepared statements) that keep data separate from SQL code

b) Hiding database error messages only

c) Using HTTPS for all requests

d) Encrypting the database files on disk

Q2. A web application builds this query from a login form. Why is it dangerous?

query = "SELECT * FROM users WHERE name = '" + userInput + "'"

a) SELECT * is always slower than naming columns

b) User input is concatenated directly into the SQL statement and can alter its structure

c) String concatenation is not supported in SQL

d) The users table cannot be queried by name

Q3. Which type of XSS occurs when malicious script is saved on the server (for example, in a comment) and later served to every visitor viewing that page?

a) Reflected XSS

b) DOM-based XSS

c) Stored (persistent) XSS

d) Clickjacking

Q4. The most important general defence against cross-site scripting is:

a) Using parameterised SQL queries

b) Blocking port 80

c) Storing passwords with bcrypt

d) Context-aware output encoding of untrusted data before rendering it

Q5. Which HTTP response header can significantly reduce the impact of XSS by restricting the sources from which scripts may load?

a) Strict-Transport-Security

b) Content-Security-Policy

c) Cache-Control

d) Content-Length

Q6. Setting the HttpOnly flag on a session cookie helps because it:

a) Prevents client-side JavaScript from reading the cookie, limiting session theft via XSS

b) Encrypts the cookie value

c) Forces the cookie to be sent only over HTTPS

d) Stops the cookie from being sent on cross-site requests

Q7. CSRF attacks succeed because:

a) Servers fail to hash passwords

b) Attackers can read the victim's cookies directly

c) The victim's browser runs injected server-side code

d) Browsers automatically attach the victim's cookies to requests triggered by another site

Q8. Which measure is a standard defence against CSRF?

a) Escaping HTML output

b) Using a longer database password

c) An unpredictable anti-CSRF token tied to the user's session and verified on state-changing requests

d) Converting all POST requests to GET

Q9. A cookie attribute that instructs the browser not to send the cookie with most cross-site requests, helping mitigate CSRF, is:

a) SameSite=Strict or SameSite=Lax

b) Secure

c) HttpOnly

d) Max-Age

Q10. In the OWASP Top 10 (2021), which category ranked first?

a) Injection

b) Cryptographic Failures

c) Broken Access Control

d) Security Misconfiguration

Q11. A user changes the URL from /account?id=1001 to /account?id=1002 and sees another customer's data. This is an example of:

a) Cross-site scripting

b) Insecure direct object reference, a form of broken access control

c) SQL injection

d) Denial of service

Q12. Which malware type self-replicates across networks without needing to attach itself to a host program or require user action?

a) Virus

b) Trojan horse

c) Logic bomb

d) Worm

Q13. A program presented as a free game that secretly installs a backdoor is best classified as:

a) Worm

b) Boot sector virus

c) Trojan horse

d) Adware

Q14. Malware designed to hide its presence and that of other malicious processes, often by modifying the operating system kernel, is called:

a) A keylogger

b) Ransomware

c) A macro virus

d) A rootkit

Q15. Which control is MOST effective for recovering from a ransomware infection without paying the ransom?

a) Regular, tested, offline or immutable backups

b) Disabling the screen saver

c) Increasing RAM on servers

d) Using longer Wi-Fi passwords

Q16. A polymorphic virus is difficult for signature-based antivirus to detect because it:

a) Only infects BIOS chips

b) Changes its encrypted appearance or decryptor with each infection while keeping the same function

c) Never executes any code

d) Always deletes itself after infection

Q17. Under India's Information Technology Act 2000 (as amended), which section deals with punishment for identity theft, such as fraudulently using another person's password or electronic signature?

a) Section 43

b) Section 67

c) Section 72

d) Section 66C

Q18. Which statement about the IT Act 2000 is correct?

a) It replaced the Indian Penal Code entirely

b) It gives legal recognition to electronic records and digital signatures and provides for Certifying Authorities

c) It applies only to government websites

d) It prohibits the use of encryption in India