Eccouncil Ecss Ec Council Certified Security Specialist Practice Test - Set 1
Test your knowledge with this Eccouncil Ecss Ec Council Certified Security Specialist mock exam. Get real-world IT questions and prepare for certification success.
ECSS: EC-Council Certified Security Specialist - Exam Information
Exam Information
Exam Code
Eccouncil Ecss Ec Council Certified Security Specialist
Exam Title
ECSS: EC-Council Certified Security Specialist
Vendor
EC Council
Difficulty
Intermediate
Duration
2 Hours
Question Format
Multiple Choice
Last Updated
March 8, 2025
The ECSS certification focuses on information security, network security, and computer forensics.
17. Which device filters and forwards network packets between networks?
Router
Firewall
Switch
Hub
✅ Correct Answer: Router
18. Which cyber attack floods a target system with excessive traffic?
DDoS
MITM
XSS
DNS Spoofing
✅ Correct Answer: DDoS
19. Which organization develops cybersecurity standards like ISO 27001?
ISO
NIST
FCC
OWASP
✅ Correct Answer: ISO
20. Which security policy helps prevent insider threats?
Least Privilege
Open Access
Default Allow
Full Administrative Control
✅ Correct Answer: Least Privilege
21. Which security model uses labels for access control?
Mandatory Access Control
Role-Based Access Control
Discretionary Access Control
Rule-Based Access Control
✅ Correct Answer: Mandatory Access Control
22. What does AES stand for in cryptography?
Advanced Encryption Standard
Asymmetric Encryption System
Automated Encryption Service
Applied Encryption Scheme
✅ Correct Answer: Advanced Encryption Standard
23. Which protocol provides secure shell access?
SSH
HTTP
FTP
Telnet
✅ Correct Answer: SSH
24. What is the primary purpose of a WAF?
To protect web applications
To encrypt emails
To scan networks
To authenticate users
✅ Correct Answer: To protect web applications
25. Which security principle ensures actions can be traced?
Accountability
Confidentiality
Integrity
Availability
✅ Correct Answer: Accountability
26. What does PKI stand for in cryptography?
Public Key Infrastructure
Private Key Integration
Protected Key Interface
Personal Key Identification
✅ Correct Answer: Public Key Infrastructure
27. Which attack involves malicious QR codes?
Quishing
Phishing
Vishing
Smishing
✅ Correct Answer: Quishing
28. What is the primary purpose of a SIEM system?
To correlate security events
To encrypt data
To block attacks
To authenticate users
✅ Correct Answer: To correlate security events
29. Which tool is used for network mapping?
Nmap
Metasploit
Wireshark
John the Ripper
✅ Correct Answer: Nmap
30. What does BYOD stand for in mobile security?
Bring Your Own Device
Backup Your Organizational Data
Block Youthful Online Danger
Biometric Yearly Operational Directive
✅ Correct Answer: Bring Your Own Device
31. Which security framework focuses on cloud computing?
CSA STAR
PCI DSS
HIPAA
SOX
✅ Correct Answer: CSA STAR
32. What is the purpose of hashing in cybersecurity?
To verify data integrity
To encrypt communications
To authenticate users
To filter network traffic
✅ Correct Answer: To verify data integrity
33. Which type of malware hides its presence?
Rootkit
Trojan
Worm
Spyware
✅ Correct Answer: Rootkit
34. What does PII stand for in data protection?
Personally Identifiable Information
Protected Internet Infrastructure
Public Institutional Identifier
Private Internal Investigation
✅ Correct Answer: Personally Identifiable Information
35. Which security control prevents piggybacking?
Turnstile
Firewall
Antivirus
VPN
✅ Correct Answer: Turnstile
36. What is the primary risk of shared accounts?
Lack of accountability
Data corruption
Network slowdown
Encryption failure
✅ Correct Answer: Lack of accountability
37. Which protocol is vulnerable to interception?
HTTP
HTTPS
SSH
SFTP
✅ Correct Answer: HTTP
38. What is the purpose of a honeynet?
To study attack methods
To block malicious traffic
To encrypt sensitive data
To authenticate users
✅ Correct Answer: To study attack methods
39. Which security principle ensures systems are reliable?
Integrity
Confidentiality
Availability
Accountability
✅ Correct Answer: Integrity
40. What does ABAC stand for in access control?
Attribute-Based Access Control
Account-Based Authentication Check
Advanced Backup and Configuration
Application-Based Assessment Criteria
✅ Correct Answer: Attribute-Based Access Control
41. Which attack involves injecting database queries?
SQL Injection
XSS
CSRF
MITM
✅ Correct Answer: SQL Injection
42. What is the purpose of a security baseline?
To establish minimum security standards
To detect intrusions
To encrypt communications
To authenticate devices
✅ Correct Answer: To establish minimum security standards
43. Which tool is used for vulnerability scanning?
Nessus
Metasploit
Wireshark
Burp Suite
✅ Correct Answer: Nessus
44. What is the primary purpose of a proxy server?
To mediate network requests
To encrypt data
To block all malware
To authenticate users
✅ Correct Answer: To mediate network requests
45. Which security control is an example of deterrent?
Warning signs
Firewall
Encryption
Backup
✅ Correct Answer: Warning signs
46. What does CSRF stand for?
Cross-Site Request Forgery
Critical Security Risk Factor
Cyber Security Response Framework
Common System Recovery File
✅ Correct Answer: Cross-Site Request Forgery
47. Which type of encryption uses the same key?
Symmetric
Asymmetric
Hashing
Steganography
✅ Correct Answer: Symmetric
48. What is the primary risk of open Wi-Fi networks?
Eavesdropping
Data corruption
System crashes
Encryption failure
✅ Correct Answer: Eavesdropping
49. Which security framework focuses on healthcare?
HIPAA
PCI DSS
GDPR
SOX
✅ Correct Answer: HIPAA
50. What is the purpose of a chain of custody?
To document evidence handling
To encrypt communications
To authenticate users
To filter network traffic
✅ Correct Answer: To document evidence handling
51. Which attack involves malicious scripts in web pages?
XSS
SQL Injection
MITM
DDoS
✅ Correct Answer: XSS
52. What is the primary purpose of a WAF?
To protect web applications
To encrypt emails
To scan for viruses
To authenticate devices
✅ Correct Answer: To protect web applications
53. Which security control is administrative?
Security policy
Firewall
Biometric scanner
Encryption
✅ Correct Answer: Security policy
54. What does BIA stand for in risk management?
Business Impact Analysis
Basic Internet Authentication
Backup Integrity Assessment
Biometric Identification Algorithm
✅ Correct Answer: Business Impact Analysis
55. Which protocol is used for secure email?
S/MIME
HTTP
FTP
SNMP
✅ Correct Answer: S/MIME
56. What is the primary purpose of a TPM?
Hardware-based security
Network monitoring
Email encryption
Vulnerability scanning
✅ Correct Answer: Hardware-based security
57. Which security principle prevents user denial of actions?
Non-repudiation
Confidentiality
Integrity
Availability
✅ Correct Answer: Non-repudiation
58. What does RTO stand for in disaster recovery?
Recovery Time Objective
Risk Tolerance Overview
Real-Time Operation
Remote Technical Office
✅ Correct Answer: Recovery Time Objective
59. Which attack involves IP address spoofing?
DDoS
Phishing
SQL Injection
XSS
✅ Correct Answer: DDoS
60. What is the purpose of a security awareness program?
To educate users
To encrypt data
To block attacks
To monitor networks
✅ Correct Answer: To educate users
61. Which security framework focuses on financial reporting?
SOX
HIPAA
PCI DSS
GDPR
✅ Correct Answer: SOX
62. What is the primary purpose of a VLAN?
To segment network traffic
To encrypt communications
To authenticate users
To block malware
✅ Correct Answer: To segment network traffic
63. Which security control is technical?
Firewall
Security policy
Background checks
Warning signs
✅ Correct Answer: Firewall
64. What does EDR stand for in endpoint security?
Endpoint Detection and Response
Encrypted Data Recovery
Enterprise Defense Resolution
External Device Recognition
✅ Correct Answer: Endpoint Detection and Response
65. Which protocol is used for network device management?
SNMP
HTTP
FTP
SMTP
✅ Correct Answer: SNMP
66. What is the primary risk of shadow IT?
Unmanaged security risks
Network slowdown
Data corruption
Encryption failure
✅ Correct Answer: Unmanaged security risks
67. Which security framework focuses on privacy?
GDPR
PCI DSS
HIPAA
SOX
✅ Correct Answer: GDPR
68. What is the purpose of a security token?
To authenticate users
To encrypt data
To scan networks
To block attacks
✅ Correct Answer: To authenticate users
69. Which attack involves session token theft?
Session Hijacking
Phishing
SQL Injection
DDoS
✅ Correct Answer: Session Hijacking
70. What does RPO stand for in disaster recovery?
Recovery Point Objective
Risk Probability Overview
Real-time Protection Order
Remote Procedure Operation
✅ Correct Answer: Recovery Point Objective
71. Which security control is physical?
Security guards
Firewall
Encryption
Access control lists
✅ Correct Answer: Security guards
72. What is the purpose of a security assessment?
To evaluate security posture
To block attacks
To encrypt data
To authenticate users
✅ Correct Answer: To evaluate security posture
73. Which protocol is used for secure file transfer?
SFTP
HTTP
FTP
SMTP
✅ Correct Answer: SFTP
74. What does IAM stand for in security?
Identity and Access Management
Internet Authentication Module
Intrusion Alert Mechanism
Internal Audit Management
✅ Correct Answer: Identity and Access Management
75. Which attack involves bypassing authentication?
Credential Stuffing
XSS
CSRF
MITM
✅ Correct Answer: Credential Stuffing
76. What is the purpose of a security operations center?
To monitor security events
To develop software
To manage HR policies
To conduct marketing
✅ Correct Answer: To monitor security events
77. Which security framework focuses on industrial systems?
NIST SP 800-82
PCI DSS
HIPAA
GDPR
✅ Correct Answer: NIST SP 800-82
78. What does DDoS stand for?
Distributed Denial of Service
Data Deletion on System
Direct Disk Overwrite
Digital Document Security
✅ Correct Answer: Distributed Denial of Service
79. Which security control is compensating?
Manual monitoring
Firewall
Encryption
Biometrics
✅ Correct Answer: Manual monitoring
80. What is the purpose of a security questionnaire?
To assess vendor security
To encrypt data
To block attacks
To authenticate users
✅ Correct Answer: To assess vendor security
81. Which protocol is used for secure DNS?
DNSSEC
HTTP
FTP
SMTP
✅ Correct Answer: DNSSEC
82. What does APT stand for in cybersecurity?
Advanced Persistent Threat
Automated Penetration Test
Application Protection Technology
Authorized Personnel Tracker
✅ Correct Answer: Advanced Persistent Threat
83. Which attack involves forced browsing?
Directory Traversal
XSS
CSRF
MITM
✅ Correct Answer: Directory Traversal
84. What is the purpose of a security baseline?
To establish minimum security standards
To detect intrusions
To encrypt communications
To authenticate devices
✅ Correct Answer: To establish minimum security standards
85. Which security framework focuses on cloud computing?
CSA STAR
PCI DSS
HIPAA
SOX
✅ Correct Answer: CSA STAR
86. What does NAC stand for in network security?
Network Access Control
Network Authentication Certificate
New Application Configuration
Node Authorization Check
✅ Correct Answer: Network Access Control
87. Which attack involves cookie manipulation?
Session Fixation
Phishing
SQL Injection
DDoS
✅ Correct Answer: Session Fixation
88. What is the purpose of a security audit log?
To record security events
To encrypt data
To block attacks
To authenticate users
✅ Correct Answer: To record security events
89. Which security framework focuses on US federal systems?
FISMA
PCI DSS
HIPAA
GDPR
✅ Correct Answer: FISMA
90. What does CVE stand for in vulnerability management?
Common Vulnerabilities and Exposures
Critical Vulnerability Evaluation
Computer Virus Encyclopedia
Cybersecurity Verification Engine
✅ Correct Answer: Common Vulnerabilities and Exposures
91. Which attack involves LDAP injection?
Directory Traversal
XSS
CSRF
MITM
✅ Correct Answer: Directory Traversal
92. What is the purpose of a security policy exception?
To allow temporary deviations
To encrypt data
To block all access
To authenticate devices
✅ Correct Answer: To allow temporary deviations
93. Which security framework focuses on critical infrastructure?
NIST CSF
PCI DSS
HIPAA
GDPR
✅ Correct Answer: NIST CSF
94. What does BYOD stand for in mobile security?
Bring Your Own Device
Backup Your Organizational Data
Block Youthful Online Danger
Biometric Yearly Operational Directive
✅ Correct Answer: Bring Your Own Device
95. Which attack involves XML injection?
XXE
XSS
CSRF
MITM
✅ Correct Answer: XXE
96. What is the purpose of a security awareness training?
To educate users
To encrypt data
To block attacks
To monitor networks
✅ Correct Answer: To educate users
97. Which security framework focuses on risk management?
ISO 27005
PCI DSS
HIPAA
GDPR
✅ Correct Answer: ISO 27005
98. What does PII stand for in data protection?
Personally Identifiable Information
Protected Internet Infrastructure
Public Institutional Identifier
Private Internal Investigation
✅ Correct Answer: Personally Identifiable Information
99. Which attack involves HTTP header manipulation?
HTTP Response Splitting
XSS
CSRF
MITM
✅ Correct Answer: HTTP Response Splitting
100. What is the purpose of a security assessment?
To evaluate security posture
To block attacks
To encrypt data
To authenticate users
✅ Correct Answer: To evaluate security posture
101. Which security framework focuses on payment systems?
PCI DSS
HIPAA
GDPR
SOX
✅ Correct Answer: PCI DSS
102. What does RTO stand for in disaster recovery?
Recovery Time Objective
Risk Tolerance Overview
Real-Time Operation
Remote Technical Office
✅ Correct Answer: Recovery Time Objective
103. Which attack involves malicious macros?
Macro Virus
XSS
CSRF
MITM
✅ Correct Answer: Macro Virus
104. What is the purpose of a security baseline?
To establish minimum security standards
To detect intrusions
To encrypt communications
To authenticate devices
✅ Correct Answer: To establish minimum security standards
105. Which security framework focuses on healthcare?
HIPAA
PCI DSS
GDPR
SOX
✅ Correct Answer: HIPAA
106. What does DLP stand for in data security?
Data Loss Prevention
Digital License Protection
Direct Login Protocol
Dynamic Layer Protection
✅ Correct Answer: Data Loss Prevention
107. Which attack involves malicious USB devices?
BadUSB
XSS
CSRF
MITM
✅ Correct Answer: BadUSB
108. What is the purpose of a security operations center?
To monitor security events
To develop software
To manage HR policies
To conduct marketing
✅ Correct Answer: To monitor security events
109. Which security framework focuses on financial reporting?
SOX
HIPAA
PCI DSS
GDPR
✅ Correct Answer: SOX
110. What does BYOD stand for in mobile security?
Bring Your Own Device
Backup Your Organizational Data
Block Youthful Online Danger
Biometric Yearly Operational Directive
✅ Correct Answer: Bring Your Own Device
The Eccouncil Ecss Ec Council Certified Security Specialist certification is a globally recognized credential for IT professionals.
This practice test helps you prepare by covering key topics like hardware, networking, troubleshooting, and security.
Want more practice? Check out our other mock exams: