Google Cybersecurity

One question per exam domain, 8 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Foundations of Cybersecurity

   Royalty percentages in a book publisher's contracts database no longer match the signed agreements. An unauthorized script changed hundreds of rows two months ago, unnoticed. Which control would BEST surface a repeat sooner?

   1. ARequire multi factor authentication for everyone who signs in to the contracts database directly
   2. BEncrypt the contracts database at rest so the stored royalty values cannot be read by an outside intruder
   3. CAdd a warm standby database so contract data stays reachable during maintenance and unplanned outages
   4. DEnable change auditing on the contract tables and reconcile the records against a stored integrity check
   Show answer and explanation

   Correct answer

   Enable change auditing on the contract tables and reconcile the records against a stored integrity check

   The failure here is undetected modification, so the control has to be detective and aimed at integrity: auditing changes and reconciling against a known good check is what shortens two months down to days. Multi factor authentication is a strong preventive control and might have stopped the account misuse, but it is silent once an authorized session exists and would still not have revealed the alteration. Encryption at rest protects data from disclosure if the storage is stolen and does nothing about a legitimate application writing wrong values. A warm standby serves availability and would have faithfully replicated the altered rows.

   Source: NIST Computer Security Resource Center Glossary, Integrity

2. Question 2 · Manage Security Risks

   At 2 a.m. a junior analyst alone at Summit Grocers receives a SIEM alert for phishing targeting store managers. A written phishing playbook exists, and the on-call senior is reachable by page. What should the analyst do FIRST?

   1. ABlock the sending domain at the mail gateway based on the analyst's reading of the alert
   2. BOpen the phishing playbook and work through its documented steps in order
   3. CPage the on-call senior analyst and wait for that direction before touching anything else
   4. DDelete the suspicious messages from the affected mailboxes so no manager can open them
   Show answer and explanation

   Correct answer

   Open the phishing playbook and work through its documented steps in order

   A playbook exists so that a single analyst at 2 a.m. can take correct, consistent action without waiting for someone senior, and it will contain its own escalation criteria telling the analyst when paging is the right move. Paging first and waiting surrenders the response window even though the documented steps are available. Deleting messages destroys the evidence the team needs to determine how many mailboxes received the campaign and who clicked. Blocking the sending domain may well be a step in the playbook, but performing it from personal judgment risks blocking legitimate mail and skips whatever collection the playbook orders first.

   Source: CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

3. Question 3 · Networks and Network Security

   A junior analyst reviews a packet capture. The client's request to the server on port 8080 draws an immediate reset, while requests to other ports on that server complete a normal three step handshake. Which interpretation is BEST?

   1. AThe client and server negotiated the connection successfully and the client then closed it
   2. BA filtering device between the two hosts silently discarded the request before it arrived
   3. CThe server is overwhelmed and is shedding new connection attempts as fast as they arrive
   4. DThe server received the request but has no service listening on that port, so it refused it
   Show answer and explanation

   Correct answer

   The server received the request but has no service listening on that port, so it refused it

   An immediate reset in answer to a connection request is the transport layer's way of saying no process is listening on that port, and the fact that the packet came back at all proves the host is reachable. A device that drops traffic usually produces no answer, so the client retransmits and eventually times out rather than receiving a prompt refusal. A completed negotiation would appear in the capture as the request, the acknowledged reply, and the client's acknowledgement. Resource exhaustion normally shows as timeouts or slow answers across many ports, not a clean refusal on one.

   Source: RFC 9293: Transmission Control Protocol (TCP)

4. Question 4 · Tools of the Trade: Linux and SQL

   Every analyst account on an airline's Linux flight-data host belongs to one group that can read and modify all data. A new analyst hired to build reports overwrote a published schedule file. How should a repeat be prevented?

   1. ARequire a second analyst to review and approve every change before it is saved to the shared files
   2. BBack up the schedule files far more frequently so that any mistake can be reversed within minutes
   3. CDefine separate access roles so that report-building accounts can read the flight data but not modify it
   4. DProvide training on the file layout so that analysts learn which files are sensitive and leave them alone
   Show answer and explanation

   Correct answer

   Define separate access roles so that report-building accounts can read the flight data but not modify it

   The account had write access it never needed for its job, so matching the access to the role removes the possibility of this mistake rather than managing its consequences, and it equally prevents a compromised reporting account from altering flight data. Peer review adds friction to every change for a role that should not be making changes at all. More frequent backups shorten recovery time after damage has already occurred. Training reduces the chance of error but leaves an account able to destroy operational data whenever attention lapses.

   Source: NIST Computer Security Resource Center Glossary, Separation of Duty

5. Question 5 · Assets, Threats, and Vulnerabilities

   A parks agency uses one shared administrator login, with the password in a runbook six people use. After a batch of reservations is deleted, nobody can tell who did it. What should the analyst recommend to restore that ability?

   1. AEnable multifactor authentication on the shared administrator account so logins are verified
   2. BRotate the shared administrator password after each use of the runbook so old copies expire
   3. CIssue individual named administrator accounts so each logged action ties to one person
   4. DIncrease the retention period of the reservation system's nightly database backups substantially
   Show answer and explanation

   Correct answer

   Issue individual named administrator accounts so each logged action ties to one person

   Individual named accounts are what make actions attributable, which is the accounting element of authentication, authorization, and accounting, and without them logs can only record that one shared identity acted. Longer backup retention improves recovery but never identifies the actor. Rotating the shared password after each use still attributes every action to the same identity. Multifactor on the shared account strengthens access control without restoring any attribution.

   Source: NIST SP 800-92, Guide to Computer Security Log Management

6. Question 6 · Detection and Response

   An airline deploys an inline intrusion prevention system in front of its booking site. Within an hour a SQL injection rule is dropping legitimate itinerary searches containing apostrophes, and bookings fail. What is the best response?

   1. APut the entire intrusion prevention system into monitor-only mode until the vendor ships a corrected rule set
   2. BAdd the booking application's servers to a global bypass so that no rules are applied to that traffic
   3. CSet that rule to alert only, confirm the matching traffic is legitimate, then tune it before restoring blocking
   4. DDelete the rule outright, since a signature that blocks paying customers provides no value to the airline
   Show answer and explanation

   Correct answer

   Set that rule to alert only, confirm the matching traffic is legitimate, then tune it before restoring blocking

   The fix is scoped to the smallest unit causing harm: the one rule stops dropping traffic, visibility is retained while the pattern is studied, and blocking returns once the rule distinguishes injection from ordinary punctuation. Dropping the whole system to monitor mode does restore service and is a defensible emergency lever, but it removes prevention for every other threat over a single rule. Deleting the rule discards coverage for a common and serious attack class rather than correcting it. A global bypass for the booking servers is the widest exception of all and leaves the most exposed application in the environment uninspected.

   Source: NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)

7. Question 7 · Automate Cybersecurity Tasks with Python

   A telecom provider's syslog parsing automation silently skips any line it cannot parse, dropping about two percent of lines every night with no error. What is the greatest risk in that behavior?

   1. ADuplicate entries may accumulate in the structured table, because the parser cannot detect repeats among the lines that it skips.
   2. BThe job takes longer than it needs to, since it attempts to parse each malformed line in full before finally discarding it.
   3. CThe dropped lines waste storage on the source devices, since they are collected and retained every night but never actually used.
   4. DAttacker activity tends to produce unusual or malformed entries, and discarding them silently leaves no record of the loss.
   Show answer and explanation

   Correct answer

   Attacker activity tends to produce unusual or malformed entries, and discarding them silently leaves no record of the loss.

   Silent discarding is the dangerous part. Records that do not match an expected pattern are disproportionately likely to be the interesting ones, produced by unusual commands, injected content, malformed traffic or attempts to disrupt logging, and dropping them without a count or an error leaves analysts confident in a data set that is quietly incomplete. Storage on the devices, parse time and duplicate handling are efficiency and hygiene concerns that cost resources rather than visibility. The corrective practice is to route unparsed lines to an exception stream and alert when their volume changes.

   Source: OWASP Top 10:2021 A09 Security Logging and Monitoring Failures

8. Question 8 · Put It to Work: Prepare for Cybersecurity Jobs

   Two analysts are working a live intrusion across shifts at a logistics startup with a lightweight ticket system but no formal handoff procedure. The outgoing analyst blocked a domain, pulled a memory image, and reset an account. What is the best way to document the handoff?

   1. AWrite a narrative summary at the end of the shift from memory, since detailed notes slow active response
   2. BKeep detailed personal notes and transfer only the conclusions, so the ticket stays readable for management
   3. CRecord each action in the case ticket as it happens with timestamps, systems touched, and who performed it
   4. DSave screenshots of every console used, because images are harder to dispute than typed notes later
   Show answer and explanation

   Correct answer

   Record each action in the case ticket as it happens with timestamps, systems touched, and who performed it

   Contemporaneous, attributed, timestamped entries in the shared case record are what let a second analyst reconstruct the state of the response and what keep evidence handling defensible afterward. End-of-shift narratives drift because memory compresses and reorders events, and the details lost are usually the timing ones that matter most. Screenshots supplement a record but cannot show sequence, actor, or intent on their own. Private notes with only conclusions handed over strand the reasoning with one person, which defeats the purpose of a handoff and leaves gaps if that analyst is unavailable.

   Source: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response