MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Which of the following best describes a vulnerable database in cybersecurity?
   a. A database that has backup copies
   b. A database that can be exploited due to misconfigurations, weak access control, or unpatched software
   c. A well-secured system preventing unauthorized access
   d. A database that uses multi-factor authentication
   Answer: bsentinelone+1​
2. Which attack targets vulnerable databases by injecting malicious code into SQL queries?
   a. Phishing
   b. Brute Force
   c. SQL Injection
   d. Cross-Site Scripting
   Answer: ccycognito+1​
3. What is the primary cause of SQL injection vulnerabilities?
   a. Hardware malfunction
   b. Unsanitized user input in database queries
   c. Network misconfigurations
   d. Lack of antivirus software
   Answer: bimperva+1​
4. A database storing passwords in plain text exemplifies which type of failure?
   a. Logic Error
   b. Cryptographic Failure
   c. Privilege Escalation
   d. Buffer Overflow
   Answer: bstackhawk​
5. What can result from an unpatched database vulnerability?
   a. Improved performance
   b. Unauthorized data access and exposure
   c. Faster query execution
   d. Reduced data storage needs
   Answer: bsentinelone​
6. In blind SQL injection, attackers infer database information through what method?
   a. Direct output display
   b. Observable application behavior, such as response time
   c. Server crashes
   d. Firewall logs
   Answer: bsentinelone​
7. Which organization maintains the Common Vulnerabilities and Exposures (CVE) database?
   a. FBI
   b. MITRE
   c. OWASP
   d. ISO
   Answer: bsanfoundry​
8. Which database vulnerability involves accessing data in NoSQL systems without validation?
   a. XSS Attack
   b. NoSQL Injection
   c. URL Spoofing
   d. Session Replay
   Answer: bstackhawk​
9. An unencrypted database backup stored on a public server mainly poses what risk?
   a. DoS Attack
   b. Data Leakage
   c. Phishing
   d. Defacement
   Answer: bsecuriti​
10. Which technique helps mitigate SQL injection attacks?
    a. Disabling OS updates
    b. Using parameterized queries
    c. Using plain text credentials
    d. Allowing all network ports open
    Answer: blearn.microsoft+1​
11. Which type of SQL injection is characterized by attackers using separate channels for attack and data retrieval?
    a. Blind
    b. Out-of-Band
    c. Classic
    d. Deferred
    Answer: bimperva​
12. What vulnerability occurs when excessive database privileges are assigned to users?
    a. Privilege Escalation
    b. Buffer Overflow
    c. Insider Exploit
    d. Logic Bomb
    Answer: asentinelone​
13. The National Vulnerability Database (NVD) is maintained by:
    a. NIST
    b. WHO
    c. NASA
    d. OWASP
    Answer: asanfoundry​
14. Which SQL command is most often abused in injection attacks to delete entire data sets?
    a. SELECT
    b. JOIN
    c. DROP
    d. UNION
    Answer: ccycognito+1​
15. Storing database encryption keys in plain text is an example of:
    a. Secure practice
    b. Cryptographic mismanagement
    c. Network hardening
    d. Data minimization
    Answer: bstackhawk​
16. Which tool is commonly used to detect vulnerable databases and SQL injection flaws?
    a. Wireshark
    b. Metasploit
    c. OpenVAS
    d. Burp Suite
    Answer: dsanfoundry​
17. Time-based blind SQL injection relies on:
    a. Server wait or delay to confirm results
    b. Code response errors
    c. Packet manipulation
    d. Script inclusion
    Answer: asentinelone​
18. Poorly configured access control on a database may result in:
    a. Denial of Service
    b. Unauthorized privilege access
    c. Data normalization
    d. Bandwidth reduction
    Answer: bstackhawk​
19. What is the most effective preventive approach for injection vulnerabilities?
    a. Disabling HTTPS
    b. Input validation and sanitization
    c. Enabling guest accounts
    d. Using shared admin credentials
    Answer: blearn.microsoft+1​
20. Which vulnerability allows data extraction through inference rather than direct output?
    a. Blind SQL Injection
    b. Buffer Overflow
    c. XSS
    d. CSRF
    Answer: asentinelone​
21. The OWASP Top Ten lists SQL Injection under which risk category?
    a. Broken Cryptography
    b. Injection
    c. Insecure API
    d. XML Misconfiguration
    Answer: bowasp+1​
22. In database security, “least privilege” means:
    a. Granting minimum rights needed for user tasks
    b. Allowing admin access to all users
    c. Denying all users database access
    d. Rotating passwords daily
    Answer: asentinelone​
23. Which of the following is an example of improper error handling leaking data?
    a. Custom error pages
    b. Stack traces shown publicly
    c. Exception logging internally
    d. Code obfuscation
    Answer: bsentinelone​
24. Using dynamic SQL without parameterization increases the risk of:
    a. SQL Injection
    b. DoS Attack
    c. XSS
    d. Spoofing
    Answer: acycognito+1​
25. A vulnerable database that exposes data without encryption violates which security principle?
    a. Confidentiality
    b. Integrity
    c. Availability
    d. Auditing
    Answer: astackhawk​
26. A hacker exploits an outdated Oracle database module—this highlights which flaw?
    a. Missing input validation
    b. Unpatched vulnerability
    c. Oversized buffers
    d. URL tampering
    Answer: bbrightdefense+1​
27. What is a major consequence of a database misconfiguration?
    a. Attackers gaining admin access
    b. Reduced CPU overhead
    c. Faster database queries
    d. Enhanced encryption
    Answer: asentinelone​
28. The “1=1” clause in an SQL statement is indicative of:
    a. Data corruption
    b. SQL Injection testing
    c. Data compression
    d. Schema duplication
    Answer: bcycognito​
29. Which statement best defines the goal of database hardening?
    a. Increasing query speed
    b. Minimizing vulnerabilities
    c. Expanding user roles
    d. Allowing remote queries
    Answer: bsentinelone​
30. A successful SQL injection can result in:
    a. Unauthorized data extraction
    b. Faster indexing
    c. Secure encryption
    d. Data mirroring
    Answer: acycognito​
31. Storing sensitive keys in application code poses what risk?
    a. Reverse engineering and credential theft
    b. Improved debugging
    c. Simplified deployment
    d. Reduced memory use
    Answer: astackhawk​
32. What database privilege should be restricted to avoid mass deletions?
    a. SELECT
    b. UPDATE
    c. DROP
    d. GRANT
    Answer: ccycognito​
33. The best approach for securing database communications is:
    a. Using plaintext connections
    b. Encrypting data in transit with TLS
    c. Allowing all traffic
    d. Disabling HTTPS
    Answer: bstackhawk​
34. Shodan can be used to identify:
    a. Indexed public databases with exposed ports
    b. Malware samples
    c. Encrypted emails
    d. Mobile device rootkits
    Answer: asentinelone​
35. Why are default database credentials dangerous?
    a. They speed up setup but allow easy unauthorized access
    b. They enforce security protocols
    c. They enhance audit logs
    d. They are unique per installation
    Answer: asentinelone​
36. What prevents SQL injection effectively at coding level?
    a. String concatenation
    b. Parameterized prepared statements
    c. Direct user queries
    d. Comment-based validation
    Answer: blearn.microsoft+1​
37. The exposure of a database schema to attackers increases which risk?
    a. Query optimization
    b. Attack surface
    c. Hashing efficiency
    d. VPN performance
    Answer: bsentinelone​
38. Multi-tenancy in database systems introduces which vulnerability risk?
    a. Data leakage between tenants
    b. Faster access control
    c. Better encryption
    d. Smaller backups
    Answer: asentinelone​
39. Which of the following is an example of a database logic flaw?
    a. Incorrect user role validation allowing unauthorized write access
    b. Missing firewall
    c. Low network latency
    d. High storage usage
    Answer: astackhawk​
40. Index corruption leading to unauthorized access can occur due to:
    a. Improper input handling
    b. Secure hashing
    c. Redundant indexing
    d. B-tree storage optimization
    Answer: asentinelone​
41. Which attack involves manipulating non-relational queries?
    a. XSS
    b. NoSQL Injection
    c. SSRF
    d. CSRF
    Answer: bstackhawk​
42. The principle of defense-in-depth means:
    a. Using multiple layers of security for databases
    b. Applying one protection mechanism
    c. Reducing all logs
    d. Limiting access temporarily
    Answer: astackhawk​
43. What type of database vulnerability does weak session management cause?
    a. Session Hijacking
    b. DoS
    c. SQL Error Handling
    d. Cross-Domain Access
    Answer: asentinelone​
44. Which data breach in 2025 showed flaws in database management systems?
    a. Oracle Cloud breach affecting millions
    b. NASA hack
    c. Netflix outage
    d. Yahoo leak
    Answer: abrightdefense​
45. The use of outdated database software versions often leads to:
    a. Known exploits being reused by attackers
    b. Higher security
    c. Less patch availability
    d. Buffer isolation
    Answer: asentinelone​
46. Insider misuse of database credentials is an example of a:
    a. Human vulnerability
    b. Network malware
    c. Logic overflow
    d. Encryption algorithm flaw
    Answer: asentinelone​
47. What measure ensures database transaction integrity?
    a. Atomicity and commit controls
    b. SQL concatenation
    c. Weak encryption
    d. Inline scripting
    Answer: asentinelone​
48. A successful privilege escalation in a database can lead to:
    a. Administrative access by attackers
    b. Better indexing
    c. Secure password management
    d. Schema optimization
    Answer: asentinelone​
49. Which practice strengthens database authentication?
    a. Use of multi-factor authentication
    b. Shared account access
    c. Default credentials
    d. No password encryption
    Answer: astackhawk​
50. An attacker manipulating user-defined functions in SQL to execute OS commands is performing:
    a. Command Injection
    b. File Inclusion
    c. Cache Poisoning
    d. Session Hijacking
    Answer: asentinelone+1​

1. https://www.sentinelone.com/cybersecurity-101/cybersecurity/types-of-sql-injection/
2. https://www.stackhawk.com/blog/10-web-application-security-threats-and-how-to-mitigate-them/
3. https://www.cycognito.com/learn/cyber-attack/sql-injection.php
4. https://www.imperva.com/learn/application-security/sql-injection-sqli/
5. https://www.sentinelone.com/cybersecurity-101/data-and-ai/data-security-risks/
6. https://www.sanfoundry.com/cyber-security-questions-answers-exploits-exploitation/
7. https://securiti.ai/data-security-risks/
8. https://learn.microsoft.com/en-us/sql/relational-databases/security/sql-injection?view=sql-server-ver17
9. https://owasp.org/www-community/attacks/SQL_Injection
10. https://www.brightdefense.com/resources/recent-data-breaches/
11. https://insights.integrity360.com/5-of-the-biggest-cyber-attacks-of-2025-so-far
12. https://www.igmguru.com/blog/cyber-security-mcqs
13. https://www.sanfoundry.com/1000-cyber-security-questions-answers/
14. https://automationcommunity.com/100-mcqs-mastery-on-cybersecurity/
15. https://boisestate.pressbooks.pub/cybersecurityriskquantification/chapter/sample-quiz-questions/
16. https://interviewkickstart.com/blogs/articles/cyber-security-mcqs-answers
17. https://www.scribd.com/document/647946667/MCQ-Questions-cybersecurity
18. https://www.interviewbit.com/cyber-security-mcq/
19. https://onlinedegrees.sandiego.edu/top-cyber-security-threats/
20. https://www.aikido.dev/blog/the-state-of-sql-injections