🛡️ Section 1: Cyber Security Fundamentals (Questions 1–15)
1. Tell us about yourself and your interest in Cyber Security.
"I am an entry-level Cyber Security / SOC Analyst with a strong foundation in network security, operating system security, threat analysis, and security incident monitoring. I enjoy analyzing security logs, identifying malicious attack vectors, and defending corporate environments as a Blue Team analyst."
2. What is Cyber Security?
Cyber Security is the practice of protecting systems, networks, programs, endpoints, and data from digital attacks, unauthorized access, theft, damage, or disruption.
3. Why is Cyber Security important for modern organizations?
Organizations store sensitive business data, customer PII, financial records, and proprietary intellectual property. Cyber Security prevents financial loss, legal liabilities, regulatory compliance penalties, operational downtime, and severe reputational damage.
4. What are the CIA Triad principles?
The fundamental model for Information Security:
- Confidentiality: Ensuring sensitive data is accessible only to authorized users.
- Integrity: Protecting data accuracy and preventing unauthorized tampering or modification.
- Availability: Ensuring critical systems and data are reliably accessible when needed by authorized users.
5. What is Confidentiality and how is it enforced?
Ensuring data is kept private and hidden from unauthorized entities. Enforced using strong data encryption (AES-256), strict Access Control Lists (ACLs), Multi-Factor Authentication (MFA), and Least Privilege policies.
6. What is Integrity and how is it maintained?
Assuring data remains accurate, complete, and unaltered during storage or transit. Maintained using cryptographic hashing algorithms (SHA-256), digital signatures, file integrity monitoring (FIM), and checksum verification.
7. What is Availability and how is it ensured?
Ensuring systems and services are operational and accessible to authorized users when needed. Maintained using redundant hardware, failover clusters, DDoS mitigation, regular backups, and Disaster Recovery (DR) sites.
8. What is Information Security vs Cyber Security?
- Information Security (InfoSec): Broad domain covering the protection of data in *all* formats (both physical paper records and digital media).
- Cyber Security: A specialized subset of InfoSec focusing specifically on protecting digital assets, networks, endpoints, and cloud data from cyber threats.
9. What is a Cyber Attack?
An intentional malicious attempt by an individual or threat actor to breach, compromise, alter, steal, or destroy data, systems, or network assets belonging to a target organization.
10. What is Cyber Crime?
Illegal criminal activity conducted using computers, networks, or digital devices as a primary tool or target (e.g., ransomware extortion, wire fraud, identity theft).
11. What is Risk in Cyber Security?
The potential probability and business impact of a financial or operational loss resulting from a threat exploiting a vulnerability. Calculated as: Risk = Threat x Vulnerability x Asset Value.
12. What is a Vulnerability?
A flaw, weak point, or security bug in software code, system hardware configuration, or administrative procedure that can be exploited by an attacker.
13. What is a Threat?
Any potential event, entity, or actor (e.g., cybercriminals, nation-state APTs, insider threats, malware, natural disasters) capable of exploiting a vulnerability to cause harm.
14. What is an Exploit?
A specific piece of malicious code, script, sequence of commands, or proof-of-concept tool designed to take advantage of a specific vulnerability to gain unauthorized access or execute payload commands.
15. What is Security Awareness?
An ongoing employee educational program designed to train organizational staff on recognizing phishing scams, social engineering tricks, password hygiene, and corporate security policies to reduce insider risks.
🌐 Section 2: Networking for Security (Questions 16–30)
16. What is an IP Address?
An Internet Protocol (IP) address is a unique numerical label assigned to every device connected to a computer network using IP for communication, acting as a network location address.
17. Difference between IPv4 and IPv6.
- IPv4: 32-bit numerical address, dotted-decimal format (e.g.,
192.168.1.1), yields ~4.3 billion addresses. - IPv6: 128-bit alphanumeric address, colon-separated hexadecimal format (e.g.,
2001:0db8::8a2e:0370:7334), provides practically unlimited addresses.
18. What is DNS and its security significance?
Domain Name System (DNS) translates human-readable domain names (e.g., `google.com`) into computer-readable IP addresses (Port 53). Critical in security because attackers abuse DNS for command-and-control (C2) tunneling, phishing domains, and DNS spoofing.
19. What is DHCP and how does the DORA process work?
Dynamic Host Configuration Protocol automatically leases dynamic IP parameters to network clients. Operates via **DORA**: **Discover → Offer → Request → Acknowledge** (UDP Ports 67/68).
20. What is a MAC Address?
Media Access Control (MAC) address is a unique 48-bit physical/hardware identifier permanently assigned to a device's Network Interface Card (NIC) at manufacture (Layer 2).
21. What is ARP and ARP Spoofing?
Address Resolution Protocol (ARP) resolves Layer 3 IP addresses to Layer 2 physical MAC addresses. **ARP Spoofing** is an attack where an adversary sends fake ARP messages onto a LAN to associate their MAC address with a legitimate gateway's IP, executing a Man-in-the-Middle (MitM) position.
22. What is TCP and the 3-Way Handshake?
Transmission Control Protocol is a reliable, connection-oriented Layer 4 protocol that guarantees packet delivery via the 3-way handshake: **SYN → SYN-ACK → ACK**.
23. What is UDP and how does it compare to TCP?
User Datagram Protocol is a lightweight, connectionless Layer 4 protocol that transfers packets without establishing a connection or guaranteeing packet delivery. Fast and low-overhead; used for DNS, VoIP, and video streaming.
24. What is HTTP vs HTTPS?
- HTTP (Port 80): Unencrypted plain-text application protocol. Vulnerable to packet sniffing.
- HTTPS (Port 443): Encrypted protocol wrapping HTTP inside SSL/TLS encryption to protect data confidentiality and integrity.
25. What is the difference between SSL and TLS?
Secure Sockets Layer (SSL) is a legacy cryptographic protocol now deprecated due to security vulnerabilities (SSL 2.0/3.0). Transport Layer Security (TLS 1.2/1.3) is its modern, secure successor.
26. What is a VPN?
Virtual Private Network creates an encrypted connection tunnel across public networks, securing user communications and granting access to internal corporate subnets.
27. What is NAT (Network Address Translation)?
A method that rewrites private, non-routable IP addresses (RFC 1918) on an internal LAN to a single public IP address at the router gateway to enable internet browsing.
28. What is a Firewall?
A network security boundary appliance or software agent that inspects incoming and outgoing network traffic, enforcing access control rules to block unauthorized connections.
29. What is the difference between a Router and a Firewall?
- Router: Layer 3 device primarily designed to route network packets between different subnets using optimal paths.
- Firewall: Security device explicitly designed to inspect traffic payloads, enforce security policies, block malicious packets, and track connection states.
30. What is Network Segmentation?
Splitting a corporate network into distinct isolated subnets or VLANs (e.g., User LAN, DMZ, PCI/Finance, Guest Wi-Fi). Restricts lateral movement of attackers if one zone is compromised.
💻 Section 3: Operating System Security (Questions 31–45)
31. What are key security differences between Windows and Linux OS?
- Windows: User-friendly GUI, uses Active Directory/GPO for domain policy management, closed-source, target of mass desktop malware attacks.
- Linux: CLI-driven, open-source, strict file permission model (User/Group/Other), granular administrative controls via `sudo`, powers enterprise cloud servers.
32. What is Active Directory?
A Microsoft directory service used in domain environments to centrally manage identity credentials, user permissions, endpoints, and security policies.
33. What is Group Policy (GPO)?
An Active Directory feature that allows administrators to centrally configure system, desktop, security, and software settings across domain-joined computers.
34. What is BitLocker Drive Encryption?
A full-disk encryption feature built into Windows Enterprise that encrypts the entire OS storage volume (using AES 128/256-bit encryption), protecting data at rest if physical hardware is lost or stolen.
35. What is Windows Defender Antivirus?
A native Windows security solution offering real-time protection against viruses, spyware, ransomware, and zero-day threats using signature scanning and heuristic cloud protection.
36. What is User Account Control (UAC) in Windows?
A Windows security feature that prevents unauthorized administrative changes by prompting users for explicit permission or admin credentials before executing software in elevated contexts.
37. What is Windows Defender Firewall?
A host-based firewall running on Windows endpoints that filters inbound and outbound TCP/UDP network connections according to defined port and application rules.
38. Explain Linux File Permission structure (rwx / 755 / 644).
Permissions assigned to three levels: **Owner**, **Group**, and **Others**. Read (4), Write (2), Execute (1).
755 (rwxr-xr-x): Owner full access (7); Group/Others read+execute (5).644 (rw-r--r--): Owner read+write (6); Group/Others read-only (4).
39. Explain the Linux chmod command with an example.
`chmod` changes file permissions. Example: chmod 700 script.sh sets executable script permissions so *only* the file owner can read, write, and execute it.
40. Explain sudo in Linux.
`sudo` (SuperUser DO) allows authorized non-root users to execute administrative commands with temporary root privileges while logging actions for audit purposes.
41. What is the Root User in Linux?
The superuser administrative account in Linux with unrestricted access rights to all system files, binaries, system configurations, and administrative commands.
42. What is the Windows Registry and why is it monitored by security analysts?
A hierarchical database storing low-level system and app settings. Monitored closely because malware frequently modifies registry keys (e.g., `HKLM\... Run` keys) to achieve reboot persistence.
43. What is Event Viewer in Windows?
A native Windows diagnostic snap-in (`eventvwr.msc`) that displays log records generated by OS services, security auditing, and applications.
44. What is Task Manager and how is it used during initial incident triage?
A system monitoring utility used to view active running processes, CPU/RAM utilization spikes, and identify suspicious process executable paths or abnormal startup applications.
45. What are Windows Security Logs?
A system event log container that records security-related events like successful/failed user logons, privilege usage, file access audits, and user account modifications.
🛠️ Section 4: Security Tools & Technologies (Questions 46–60)
46. What is Antivirus software?
Traditional endpoint security software designed to detect, block, and remove known malicious software using static signature files and basic heuristic scanning.
47. What is EDR (Endpoint Detection and Response)?
An advanced endpoint security platform that continuously records host system telemetry (processes, registry, network sockets) to detect behavioral Indicators of Attack (IOAs) and perform remote host isolation.
48. Difference between Antivirus and EDR.
- Antivirus: Focuses on pre-execution prevention using static signature matches.
- EDR: Focuses on post-execution detection, continuous 24/7 process telemetry, behavioral analysis, and automated response capabilities.
49. What is a SIEM (Security Information and Event Management)?
A centralized security platform that aggregates, normalizes, and correlates event log data across firewalls, servers, EDRs, and cloud workloads to trigger real-time security alerts (e.g., Splunk, Microsoft Sentinel).
50. What is a SOC (Security Operations Center)?
A centralized command center unit consisting of security analysts, engineers, and processes that monitor, detect, analyze, and respond to cyber security incidents 24/7.
51. What is an IDS (Intrusion Detection System)?
A passive network or host security monitoring tool that inspects traffic payloads against known threat signatures to generate security alerts without blocking traffic.
52. What is an IPS (Intrusion Prevention System)?
An active inline security technology that inspects network traffic streams and automatically drops packets or blocks connections when malicious activity is identified.
53. Difference between IDS and IPS.
- IDS: Passive alert-only system (places copy of traffic via network TAP/SPAN port).
- IPS: Active inline blocking system positioned directly in the traffic flow.
54. What is Data Loss Prevention (DLP)?
A security solution that detects and blocks unauthorized transmission or copying of sensitive data (credit cards, SSNs, IP) across endpoints, email, web uploads, and cloud storage.
55. What is Email Security Gateway?
A security gateway filtering incoming and outgoing email traffic for spam, phishing links, malicious attachments, and enforcing DKIM/DMARC authentication before mailbox delivery.
56. What is Web Security / Secure Web Gateway (SWG)?
A security solution filtering outbound web traffic to block access to malicious, malicious C2, or policy-violating websites using URL filtering and SSL inspection.
57. What is a Proxy Server?
An intermediary server positioned between client workstations and the Internet that forwards connection requests, caches web content, and anonymizes or filters traffic.
58. What is Multi-Factor Authentication (MFA)?
A security mechanism requiring users to present two or more independent authentication factors (Something you know [Password], Something you have [Authenticator App/Token], Something you are [Biometrics]) before access is granted.
59. What is a Password Manager?
An encrypted software application that securely stores, generates, and retrieves unique complex passwords for multiple user accounts inside a master-password-protected vault.
60. What is Encryption (Symmetric vs Asymmetric)?
The process of scrambling plain text into unreadable ciphertext using mathematical algorithms.
- Symmetric: Same secret key used for encryption and decryption (e.g., AES-256).
- Asymmetric: Public key encrypts data, private key decrypts data (e.g., RSA).
☣️ Section 5: Cyber Attacks (Questions 61–75)
61. What is Malware?
An umbrella term for any intrusive software program specifically engineered to damage, disrupt, compromise, or gain unauthorized access to computer systems.
62. What is a Virus?
A type of malware that attaches itself to legitimate host executable files and requires human intervention (e.g., running an infected file) to execute and spread.
63. What is a Worm?
A standalone self-replicating malware program that actively scans networks to exploit vulnerabilities and spread automatically to other systems without user interaction.
64. What is a Trojan Horse?
Malicious software disguised as a legitimate, useful program (e.g., a free utility or game) that trick users into running it to establish a backdoor payload.
65. What is Ransomware?
A form of malware that encrypts files on a target machine or network share and demands a ransom payment (usually in cryptocurrency) to provide a decryption key.
66. What is Spyware?
Malware designed to covertly monitor user activity, log keystrokes (Keyloggers), record browser history, and steal credentials without consent.
67. What is Adware?
Software that automatically displays unwanted advertisements, pop-ups, or redirects browser requests to revenue-generating ad websites.
68. What is Phishing?
A social engineering attack where bad actors send deceptive email or messaging communications masquerading as trustworthy entities to trick targets into revealing sensitive credentials or clicking malicious links.
69. What is Spear Phishing?
A highly targeted phishing attack customized with personal information (name, job title, department) directed at a specific individual or organization.
70. What is Whaling?
A specialized form of spear phishing specifically targeting high-profile corporate executives (CEOs, CFOs, Board Members) to authorize fraudulent wire transfers or disclose sensitive corporate data.
71. What is a Brute Force Attack?
An automated trial-and-error attack method submitting every possible combination of characters to guess a user's password.
72. What is Password Spraying?
An attack vector trying a few common passwords (e.g., `Password123!`) against a large number of usernames to evade account lockout thresholds.
73. What is SQL Injection (SQLi)?
A web application vulnerability where an attacker inserts malicious SQL code into input fields, manipulating backend database queries to view or alter data.
74. What is Cross-Site Scripting (XSS)?
A vulnerability where an attacker injects malicious client-side JavaScript code into a vulnerable web page, executing scripts inside another victim's browser session.
75. What is a Denial of Service (DoS / DDoS) attack?
An attack attempting to overwhelm a server, service, or network infrastructure with excessive traffic streams to render it unavailable to legitimate users. A **DDoS** uses a botnet of multiple compromised machines.
📊 Section 6: Monitoring & Incident Response (Questions 76–90)
76. What is a Security Incident?
An event or series of events that actually compromises the confidentiality, integrity, or availability of an information asset or violates security policies.
77. What is a Security Alert?
A notification generated by a security monitoring system (SIEM, EDR, IDS) indicating that a potential threat or policy violation has occurred.
78. What is a Security Event?
Any observable change or occurrence within a computer system, application, or network log (e.g., user logon, service start, firewall rule hit).
79. What is Incident Response (IR)?
A structured operational methodology executed by security teams to handle, contain, eradicate, and recover from a cyber attack.
80. What are the 6 phases of Incident Response (NIST SP 800-61)?
- Preparation: Establishing tools, policies, and IR playbooks.
- Detection & Analysis: Identifying and triaging alerts.
- Containment: Isolating affected hosts to stop spread.
- Eradication: Removing malware and attacker persistence.
- Recovery: Restoring systems to production safely.
- Lessons Learned: Post-incident analysis to improve security.
81. What is an Indicator of Compromise (IOC)?
Artifacts or technical clues indicating a system has been infected or compromised (e.g., malicious file SHA-256 hash, C2 IP address, bad domain URL).
82. What is the difference between IOC and IOA?
- IOC (Indicator of Compromise): Static forensic evidence of past infection (e.g., file hash, IP address).
- IOA (Indicator of Attack): Dynamic behavioral patterns indicating an active attack sequence in progress (e.g., LSASS memory dump attempt).
83. What is Log Analysis?
The process of reviewing, parsing, and interpreting event logs generated by endpoints, firewalls, and applications to detect anomalies or trace incident footprints.
84. What are essential Windows Security Event IDs every SOC Analyst should know?
Event ID 4624: Successful User Logon.Event ID 4625: Failed User Logon Attempt.Event ID 4720: User Account Created.Event ID 4740: User Account Locked Out.Event ID 1102: Audit Log Cleared (suspicious activity).
85. What is Threat Intelligence?
Evidence-based knowledge, context, mechanism indicators, and actionable insights regarding emerging cyber threats and threat actors (e.g., MISP, AlienVault OTX).
86. What is the MITRE ATT&CK Framework?
A globally accessible knowledge base of adversary Tactics, Techniques, and Procedures (TTPs) based on real-world threat observations, helping analysts categorize attacker behaviors.
87. What is the Cyber Kill Chain?
A framework developed by Lockheed Martin outlining the 7 stages of a cyber attack: **Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives**.
88. What is a False Positive in security monitoring?
A security alert triggered on benign, legitimate activity incorrectly flagged as malicious (e.g., a legitimate admin tool flagged as malware).
89. What is a False Negative in security monitoring?
A dangerous situation where malicious attack activity successfully bypasses security controls without generating any alert.
90. What is Security Monitoring?
The continuous real-time collection, correlation, and analysis of log telemetry across an enterprise to maintain situational awareness and detect threats.
📜 Section 7: Compliance & Best Practices (Questions 91–100)
91. What is ISO 27001?
An international framework standard establishing requirements for constructing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
92. What is PCI DSS?
Payment Card Industry Data Security Standard is a compliance framework mandating strict technical controls for organizations that process, store, or transmit credit card data.
93. What is GDPR?
General Data Protection Regulation is a European Union data privacy law regulating how personal data must be collected, processed, protected, and deleted.
94. What is Data Classification?
Categorizing data into sensitivity tiers (e.g., Public, Internal, Confidential, Restricted) to apply appropriate encryption and handling policies.
95. What is the Principle of Least Privilege (PoLP)?
A core security concept ensuring users and processes are granted only the minimum essential access rights needed to perform their explicit job duties.
96. What is Zero Trust Architecture?
A modern security framework based on the core mantra **"Never Trust, Always Verify."** Requires explicit identity, device compliance, and authorization checks for every request.
97. What is an Information Security Policy?
A formal executive document defining organizational security goals, roles, responsibilities, acceptable boundaries, and enforcement rules.
98. What is an Acceptable Use Policy (AUP)?
A document signed by employees defining acceptable and prohibited uses of company-owned IT hardware, internet access, email, and digital assets.
99. What is an Enterprise Backup Strategy (3-2-1 Rule)?
A data protection policy: Maintain **3** total copies of data, across **2** different media types, with **1** copy stored securely off-site or in the cloud.
100. What is Disaster Recovery (DR) and RTO/RPO?
Disaster Recovery involves procedures to restore IT infrastructure following a major outage.
- RTO (Recovery Time Objective): Target time frame to bring systems back online.
- RPO (Recovery Point Objective): Maximum acceptable age of unrecovered data/backups lost during an outage.
Scenario 1: A user reports receiving an email asking them to reset their Microsoft 365 password through a suspicious link. How would you investigate and respond?
- Inspect full email headers in Message Header Analyzer to evaluate SPF, DKIM, and DMARC authentication failures.
- Extract the target URL safely inside a sandbox environment (e.g., VirusTotal, URLScan.io) to analyze the phishing page.
- Run an Exchange Online Message Trace / Compliance Search to identify if other tenant users received the same message and soft-delete those emails.
- If the user clicked the link, immediately reset their password, revoke active refresh tokens, and verify MFA methods.
Scenario 2: Microsoft Defender reports malware on an employee's laptop. What steps would you take to contain and resolve the incident?
- Trigger Host Isolation via Defender/EDR console immediately or instruct user to disconnect Ethernet/Wi-Fi.
- Review EDR telemetry to analyze parent process creation tree and affected file paths.
- Trigger an automated full antivirus/EDR scan to quarantine the malicious binary.
- Check for persistent registry keys (`Run` keys, Scheduled Tasks, or newly added local user accounts).
- Verify endpoint health before re-connecting host to network.
Scenario 3: Several users report that all their files have suddenly been renamed and cannot be opened. What type of attack do you suspect, and what are your immediate actions?
- Suspect Attack: Ransomware infection outbreak.
- Immediate Containment: Execute Host Isolation on affected devices via EDR and sever local network switch connections immediately to block SMB lateral movement.
- Alert IR Team: Notify CISO/SOC Lead immediately. Preserve unencrypted log files and minidumps for forensics.
- Scope Check: Inspect shared network drives and domain controller logs to locate patient zero host.
- Eradication & Recovery: Re-image infected hosts and restore files from clean cloud backups.
Scenario 4: A user's Microsoft 365 account shows multiple failed login attempts from another country. How would you investigate and secure the account?
- Inspect Microsoft Entra ID Sign-in logs: Check client IP, user agent, authentication method, and failure error codes.
- Check if login attempts are using legacy protocols (IMAP/POP3) or triggering impossible travel flags.
- Revoke all active user sign-in sessions immediately (`Revoke-MgUserSignOutSession`).
- Reset user password and re-register MFA methods.
- Enforce Conditional Access policy blocking sign-ins from non-business geographic countries.
Scenario 5: The SOC receives an alert that a USB storage device was connected to a sensitive workstation. How would you validate whether this activity is legitimate?
- Check SIEM/EDR alert logs for USB serial number, vendor ID, mount time, and local user context.
- Cross-reference hardware inventory in CMDB and check if a approved IT ticket exists for USB usage.
- Contact the logged-in user and their department manager out-of-band to verify business justification.
- Inspect EDR file-write telemetry to check if sensitive files were copied to the external storage volume.
Scenario 6: Your SIEM generates hundreds of alerts for failed login attempts against a single server. How would you determine whether this is a brute-force attack or a false positive?
- Inspect Windows Security Event Log: Filter for **Event ID 4625** (Failed Logon).
- Check Source IP address: Is it coming from an external unknown IP (Brute Force) or an internal IP (misconfigured service)?
- If internal, check if a service account, scheduled task, or mapped drive is attempting connection using a stale cached password.
- If external, block the offending IP address at the firewall/gateway level and enforce account lockout rules.
Scenario 7: A user accidentally downloads software from an untrusted website, and the endpoint begins behaving abnormally. What is your response process?
- Isolate endpoint from local network via EDR console or unplug physical network cable.
- Run EDR/Defender full scan to detect and remove malicious files.
- Use Process Explorer / Autoruns to check for unusual running processes and unapproved startup entries.
- Inspect browser extension directories and clear temporary internet cache files.
- If the system exhibits persistent anomalies, back up user data and re-image the operating system.
Scenario 8: During log review, you notice repeated administrator logins outside business hours. What information would you collect before escalating the incident?
- Collect Event ID 4624 (Logon) and Event ID 4672 (Special Privileges Assigned) logs.
- Note exact logon timestamps, source IP address, workstation name, and logon type (Interactive [Type 2] vs RDP [Type 10]).
- Check if a scheduled change request or emergency ticket was approved for that maintenance window.
- Verify if the source IP belongs to corporate VPN pools or an unauthorized external IP before escalating to SOC Lead.
Scenario 9: A web browser displays a certificate warning when users access the company website. What are the possible causes, and how would you investigate?
- Inspect browser certificate details: Check Expiration Date, Issuer CA, and Subject Alternative Name (SAN).
- Possible Causes: 1. Expired SSL/TLS Certificate, 2. Self-signed certificate missing trusted root CA, 3. Domain mismatch, 4. Man-in-the-Middle (MitM) interception.
- Verify DNS resolution (`nslookup`) to ensure traffic is hitting the legitimate web server IP rather than a spoofed IP.
- Coordinate with Web/PKI admin team to deploy a valid, updated certificate from a trusted public/internal CA.
Scenario 10: A manager asks whether it is safe to disable MFA because users find it inconvenient. How would you explain the security risks and recommend a secure alternative?
- Explain Risk: Over 99% of password-based account compromises occur on accounts lacking MFA protection. Disabling MFA exposes the tenant to brute-force and phishing attacks.
- Explain Compliance Impact: Disabling MFA violates security policy baselines and frameworks (ISO 27001, PCI DSS).
- Recommend Alternative: Introduce **Passwordless Authentication** or **Microsoft Authenticator Number Matching** to streamline user experience while retaining strong security.
Complete the 25 cyber security assessment questions below. Enter your full name and submit to calculate your score, view detailed explanations, and receive your official technical evaluation badge from Bora Academy.