Practice tasks
Type the answer, don't pick it. 104 hands-on practice tasks across 26 paths — subnetting, Linux commands, CVSS scoring, log reading, web and cloud security. Free, no account, answers checked in your browser.
Every task asks you to produce an answer rather than recognise one among four options — compute a subnet, write the command, read the output and name the flaw. Answers are verified in your browser against a stored hash, so nothing you type is sent anywhere and the answers are not readable in the page.
Path 00 — Computer Basics & Security Mindset
- Read this link the way a browser does. Which domain does it actually go to?
- A backup strategy keeps 3 copies of your data, on 2 different kinds of media, with 1 copy off-site. What is this rule called? (write it as digits with dashes)
- A site shows a padlock and a valid certificate. Which one of these does that actually prove?
- A flaw is published on Monday and patched the same day. Attackers start exploiting unpatched machines on Tuesday. What is the general name for an attack against a flaw that has a patch available but not yet applied? (two words)
Path 01 — Introduction to Cybersecurity
- A ransomware attack encrypts a hospital's records. Staff cannot read them, but the attacker never copied them out and never altered them. Which single element of the CIA triad has been broken?
- Someone finds a serious flaw in a company's site without being asked, does not exploit it, and reports it to them privately. Which "hat" describes them? (one word)
- A backup service is given full administrator rights because "it needs to read everything". Which security principle does that violate? (three words)
- A company has a firewall, endpoint detection, MFA, network segmentation and backups — deliberately overlapping, so no single failure is fatal. What is this strategy called? (three words)
Path 02 — Networking Fundamentals
- How many USABLE host addresses are there in a /26 network?
- What is the broadcast address of 192.168.10.0/26?
- Which port number does DNS normally use?
- Write 255.255.255.240 in CIDR notation (include the slash).
Path 03 — Operating Systems & Linux
- Write the find command that lists every SUID binary on a system, discarding permission errors.
- A file should be readable and writable by its owner, and read-only for everyone else. What numeric chmod mode is that?
- You want the NUMBER of lines in auth.log containing "Failed password", not the lines themselves. Which single grep flag gives you that?
- You have landed on a Linux box as a normal user. Which command lists what commands you are permitted to run through sudo?
Path 04 — Programming & Python
- In Python, which operator asks "are these the same object in memory?" rather than "do these have the same value?" (write the operator only)
- What does this print?
- This code builds a query:
- Which Python keyword opens a file so it is closed automatically even if an exception is raised mid-block?
Path 05 — How the Web Works
- A server understood your request and knows who you are, but refuses to let you have the resource. Which HTTP status code is that?
- Which HTTP method should never change server state? (write the method in capitals)
- Which cookie attribute stops JavaScript from reading a session cookie, so an XSS bug cannot simply steal it? (one word)
- You are moving a page permanently and want search engines to transfer its ranking to the new URL. Which HTTP status code should the old URL return?
Path 06 — Cryptography Fundamentals
- Decode this ROT13 string:
- You find a 32-character hexadecimal hash in a database dump. Which algorithm is the most likely candidate? (name only)
- A password salt is stored in plain text right next to the hash, so it is not secret. In one word, what property must a salt have to do its job?
- A one-time pad is provably unbreakable, but only if three conditions hold: the key is truly random, it is as long as the message, and one more. What is the third? (one word — what you must never do with the key)
Path 07 — Windows Security Basics
- Which registry hive holds local user account password hashes on Windows? (three letters)
- Which Windows Security event ID records a FAILED logon attempt — the one you would count to spot a brute-force run?
- Which Windows process holds credential material in memory and is therefore the classic target for tools like Mimikatz? (process name, no extension)
- Microsoft states that UAC is a convenience feature, not a security what? (one word)
Path 08 — Cloud Computing Basics
- Which link-local IP address serves instance metadata (and temporary credentials) on AWS, Azure and GCP?
- Under the shared responsibility model for IaaS, who is responsible for patching the operating system on a virtual machine you launched — the cloud provider, or the customer? (one word)
- A storage bucket holding customer records is readable by anyone with the URL. In one word, what is the class of failure? (not the technology — the mistake)
- Within a cloud region, what is the name for an isolated group of data centres with independent power and cooling, used so one failure does not take down a whole region? (two words)
Path 09 — Digital Privacy & Personal Security
- Which second factor is resistant to real-time phishing because it is cryptographically bound to the site's domain? (one word)
- A VPN moves the point where your traffic enters the internet. Who can now see your browsing that could not before? (one word — the party you are now trusting)
- A site identifies you across visits without any cookie, by combining your screen size, fonts, timezone, GPU and extensions into a near-unique signature. What is this technique called? (one word)
- A messaging app is end-to-end encrypted, so the provider cannot read message content. What can they still see? (one word)
Path 10 — Cybersecurity Fundamentals
- A flaw is reachable over the internet, needs no privileges, needs no user interaction, is easy to exploit, does not change scope, and fully compromises confidentiality, integrity and availability. Write the CVSS 3.1 base vector string.
- A vulnerability scores 7.5 on CVSS 3.1. Which severity band is that? (one word)
- On a 5x5 risk matrix, a risk is scored likelihood 4 and impact 5. What is its risk score?
- An unpatched server is one thing; a ransomware group that exploits it is another. Which of the two is the THREAT? (one word from: server, group)
Path 11 — Web Security & Hacking
- A login builds its query as:
- Which HTTP response header, properly configured, can turn many XSS bugs from exploitable into harmless by controlling what the browser is allowed to execute?
- GET /api/invoice/1042 returns someone else's invoice when you change the number. Switching to a UUID makes it harder to guess. Is that a fix? (yes or no)
- A CSRF token works because a malicious page on another origin cannot do what with it? (one word)
Path 12 — Network Security
- Which single nmap flag performs a TCP SYN ("half-open") scan?
- Which nmap flag scans ALL 65535 TCP ports rather than the default top 1000?
- One system watches traffic and alerts; the other sits inline and can drop the packet. Which is the IPS — the one that alerts, or the one that drops? (one word: alerts or drops)
- An attacker compromises a receptionist's laptop and finds the payment servers reachable from it. Which network control was missing? (one word)
Path 13 — Mobile App Security
- An Android app package is really a ZIP archive with a different extension. Which file inside it declares the app's permissions? (full filename)
- An app refuses to work when you route it through an intercepting proxy, even after installing your CA. Which defence is the app using? (two words)
- On a rooted or jailbroken device, which app storage location should never hold an authentication token in plain text? (one word — the general term for app-private on-device storage)
- In AndroidManifest.xml, which attribute set to true lets other apps on the device launch a component directly? (one word, the attribute name)
Path 14 — Ethical Hacking
- In the five-phase ethical hacking methodology, which phase comes immediately before Gaining Access? (one or two words)
- Before any testing begins, what single document defines what you may test, when, and how — and is your legal protection? (three words, or its common abbreviation)
- Reading a company's public DNS records versus port-scanning their servers: which of these two is ACTIVE reconnaissance? (answer: dns or portscan)
- You have compromised one machine and use it as a route to reach systems you could not touch directly. What is this movement through the network called? (two words)
Path 15 — Bug Bounty
- A triager will downgrade a report that describes the bug but not its consequence. In one word, what is the section that turns "reflected XSS" into "an attacker steals any user's session"?
- You submit a valid, well-written report and receive no bounty because someone reported the same bug two days earlier. What status will the report be closed as? (one word)
- A program's policy lists *.example.com as in scope, and explicitly excludes blog.example.com. You find a critical flaw on blog.example.com. Should you exploit it further to prove impact? (yes or no)
- A triager cannot reproduce your finding from your report. What is the most likely outcome? (one word)
Path 16 — Advanced Cyber Topics
- Kerberoasting only works against accounts that have one particular attribute set. What is that attribute called? (three letters)
- Forging a Golden Ticket requires the password hash of one specific account. Which account? (one word)
- An attacker authenticates as a user without ever knowing or cracking their password, by presenting the NTLM hash directly. What is this attack called? (three words)
- BloodHound treats Active Directory as which mathematical structure, so it can compute shortest paths to Domain Admin? (one word)
Path 17 — Malware & Reverse Engineering
- Shannon entropy is measured in bits per byte. What is the maximum possible value for a byte, and therefore the value that packed or encrypted data approaches?
- Malware creates a named mutex on startup and exits if it already exists. What is it preventing? (one word)
- Running strings and reading the PE headers without executing the sample: is that static or dynamic analysis? (one word)
- Implanted malware periodically contacts its operator to fetch instructions. What is the regular, timed nature of that callback called? (one word)
Path 18 — AI & AI Security
- Prompt injection is hard to eliminate because a language model receives instructions and data through the same what? (one word)
- An assistant summarises a web page that contains hidden instructions, and follows them. Is this direct or indirect prompt injection? (one word)
- Since prompt injection cannot be reliably prevented at the model, where must the durable control live — at the model's input, or at what the model is permitted to DO? (answer: input or actions)
- An attacker contributes crafted examples to a dataset so the resulting model behaves incorrectly on chosen inputs. What is this attack called? (two words)
Path 19 — CTF Challenges
- Decode this Base64 string:
- Decode this hex string to ASCII:
- Decode this ROT13 flag:
- A file named image.png will not open. Its first bytes are:
Path 20 — Career Prep
- Which four-letter framework structures a behavioural interview answer as Situation, Task, Action, Result?
- Which CV bullet is stronger?
- Which role is the most common entry point into cybersecurity, monitoring alerts and triaging incidents? (three words, or the common short form)
- You have no professional experience. Which is better evidence to an interviewer: a certificate of course completion, or a written-up project showing what you tried, what failed and what you concluded? (answer: certificate or writeup)
Path 21 — API Security
- On the OWASP API Security Top 10, what position does Broken Object Level Authorization (BOLA) hold?
- A PATCH /profile endpoint binds the whole JSON body onto the user object, so sending {"isAdmin":true} works. Should the fix blocklist dangerous fields, or allowlist writable ones? (one word)
- A rate limiter behind a proxy identifies clients by a request header the client itself can set. Which header is it almost always? (the header name)
- A GraphQL query nests related fields into each other repeatedly until the server exhausts its resources. Which limit stops this class of attack? (one word — the property being limited)
Path 22 — DevSecOps & AppSec Program
- Name one of the two widely used machine-readable SBOM formats. (one word)
- Moving security testing earlier — into design and the developer's editor rather than a pre-release gate — is known as shifting security which direction? (one word)
- An API key was committed and pushed to a public repository an hour ago. What is the FIRST action — rewrite git history, or rotate the key? (answer: history or rotate)
- One tool reads source code without running it; the other attacks the running application from outside. Which one is DAST? (answer: source or running)
Path 23 — GRC & Compliance
- The four risk treatment options are Mitigate, Transfer, Avoid and one more — the one where you knowingly do nothing, with a named owner and a review date. Which is it? (one word)
- One SOC 2 report assesses controls at a single point in time; the other assesses their operating effectiveness across a period of months. Which is the more rigorous — Type 1 or Type 2? (answer with the number)
- An auditor is shown a well-written access review policy that nobody has ever actually run. Does the control pass? (yes or no)
- What is the name for the risk that remains after your controls are in place — the number that should actually be accepted or escalated? (two words)
Path 24 — Zero Trust Architecture
- Zero Trust replaces the network perimeter with a different primary control plane. What is it? (one word)
- A VPN grants access to a network; ZTNA grants access to something narrower. What is it? (one word)
- Traditional network security grants trust based on one property of a request that Zero Trust explicitly refuses to treat as meaningful. What is that property? (one word)
- Beyond verifying WHO is asking, Zero Trust also verifies the state of the machine they are asking from — patch level, disk encryption, EDR presence. What is this check called? (two words)
Path 25 — OT/ICS & Critical Infrastructure Security
- In the Purdue Model, which level is the DMZ that separates the enterprise IT network from the OT network? (a number, which may include a decimal)
- In IT the CIA triad is usually ordered Confidentiality, Integrity, Availability. In OT it is commonly reversed. Which element comes FIRST in OT? (one word)
- Modbus, designed in 1979, has no built-in authentication or encryption. What did its designers assume would provide security? (one word — a property of the network it ran on)
- Stuxnet was notable for crossing an air gap and then manipulating a specific class of industrial device while reporting normal readings to operators. Which class of device? (one word, or its abbreviation)
Related
- Timed mock exam — sit a full paper under a clock
- All 26 learning paths
- Interactive labs