Google Cybersecurity

One question per exam domain, 8 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Foundations of Cybersecurity

   Royalty percentages in a publisher's contracts database no longer match the signed agreements. An unauthorized script changed hundreds of rows two months ago, unnoticed. Which control would BEST catch a repeat sooner?

   1. ARequire multifactor authentication for everyone who signs in to the contracts database
   2. BEncrypt the contracts database at rest so an outside intruder cannot read the royalty values
   3. CAdd a warm standby database so contract data stays available during outages
   4. DEnable change auditing on the contract tables and reconcile them against an integrity check
   Show answer and explanation

   Correct answer

   Enable change auditing on the contract tables and reconcile them against an integrity check

   The failure here is undetected modification, so the control has to be detective and aimed at integrity: auditing changes and reconciling against a known good check is what shortens two months down to days. Multi factor authentication is a strong preventive control and might have stopped the account misuse, but it is silent once an authorized session exists and would still not have revealed the alteration. Encryption at rest protects data from disclosure if the storage is stolen and does nothing about a legitimate application writing wrong values. A warm standby serves availability and would have faithfully replicated the altered rows.

   Source: NIST Computer Security Resource Center Glossary, Integrity

2. Question 2 · Manage Security Risks

   At 2 a.m., a junior analyst working alone receives a SIEM alert for phishing that targets store managers. A written phishing playbook exists, and the on-call senior analyst can be paged. What should the analyst do FIRST?

   1. ABlock the sending domain at the gateway based on their own reading
   2. BOpen the phishing playbook and follow its documented steps in order
   3. CPage the on-call senior analyst and wait for direction before acting
   4. DDelete the suspicious messages from the affected mailboxes
   Show answer and explanation

   Correct answer

   Open the phishing playbook and follow its documented steps in order

   A playbook exists so that a single analyst at 2 a.m. can take correct, consistent action without waiting for someone senior, and it will contain its own escalation criteria telling the analyst when paging is the right move. Paging first and waiting surrenders the response window even though the documented steps are available. Deleting messages destroys the evidence the team needs to determine how many mailboxes received the campaign and who clicked. Blocking the sending domain may well be a step in the playbook, but performing it from personal judgment risks blocking legitimate mail and skips whatever collection the playbook orders first.

   Source: CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

3. Question 3 · Networks and Network Security

   A junior analyst reviews a packet capture. The client's connection request to the server on port 8080 draws an immediate reset, while requests to other ports on that server complete a normal three-way handshake. Which interpretation is BEST?

   1. AThe client and server negotiated the connection successfully and the client then closed it
   2. BA filtering device between the two hosts silently discarded the request before it arrived
   3. CThe server is overwhelmed and is shedding new connection attempts as fast as they arrive
   4. DThe server received the request but has no service listening on that port, so it refused it
   Show answer and explanation

   Correct answer

   The server received the request but has no service listening on that port, so it refused it

   An immediate reset in answer to a connection request is the transport layer's way of saying no process is listening on that port, and the fact that the packet came back at all proves the host is reachable. A device that drops traffic usually produces no answer, so the client retransmits and eventually times out rather than receiving a prompt refusal. A completed negotiation would appear in the capture as the request, the acknowledged reply, and the client's acknowledgement. Resource exhaustion normally shows as timeouts or slow answers across many ports, not a clean refusal on one.

   Source: RFC 9293: Transmission Control Protocol (TCP)

4. Question 4 · Tools of the Trade: Linux and SQL

   Every analyst account on an airline's Linux flight-data host is in one group that can read and modify all data. A new analyst hired to build reports overwrote a published schedule file. How should a repeat be prevented?

   1. ARequire a second analyst to approve every change before it is saved
   2. BBack up the schedule files more often so any mistake can be reversed in minutes
   3. CCreate separate roles so report builders can read the data but not change it
   4. DTrain analysts on the file layout so they learn which files to leave alone
   Show answer and explanation

   Correct answer

   Create separate roles so report builders can read the data but not change it

   The account had write access it never needed for its job, so matching the access to the role removes the possibility of this mistake rather than managing its consequences, and it equally prevents a compromised reporting account from altering flight data. Peer review adds friction to every change for a role that should not be making changes at all. More frequent backups shorten recovery time after damage has already occurred. Training reduces the chance of error but leaves an account able to destroy operational data whenever attention lapses.

   Source: NIST Computer Security Resource Center Glossary, Separation of Duty

5. Question 5 · Assets, Threats, and Vulnerabilities

   A parks agency uses one shared administrator login whose password is in a runbook six people use. After reservations are deleted, nobody can tell who did it. What should the analyst recommend to restore that ability?

   1. AAdd multifactor authentication to the shared admin account
   2. BRotate the shared password after each use so old copies expire
   3. CIssue named admin accounts so each action ties to one person
   4. DKeep the reservation system's nightly backups for much longer
   Show answer and explanation

   Correct answer

   Issue named admin accounts so each action ties to one person

   Individual named accounts are what make actions attributable, which is the accounting element of authentication, authorization, and accounting, and without them logs can only record that one shared identity acted. Longer backup retention improves recovery but never identifies the actor. Rotating the shared password after each use still attributes every action to the same identity. Multifactor on the shared account strengthens access control without restoring any attribution.

   Source: NIST SP 800-92, Guide to Computer Security Log Management

6. Question 6 · Detection and Response

   An airline deploys an inline IPS in front of its booking site. Within an hour a SQL injection rule is dropping legitimate itinerary searches containing apostrophes, and bookings fail. What is the best response?

   1. APut the whole IPS into monitor-only mode until the vendor ships a corrected rule set
   2. BAdd the booking servers to a global bypass so no rules apply to their traffic
   3. CSet the rule to alert only, verify the traffic is legitimate, tune it, then re-block
   4. DDelete the rule, since a signature that blocks paying customers has no value
   Show answer and explanation

   Correct answer

   Set the rule to alert only, verify the traffic is legitimate, tune it, then re-block

   The fix is scoped to the smallest unit causing harm: the one rule stops dropping traffic, visibility is retained while the pattern is studied, and blocking returns once the rule distinguishes injection from ordinary punctuation. Dropping the whole system to monitor mode does restore service and is a defensible emergency lever, but it removes prevention for every other threat over a single rule. Deleting the rule discards coverage for a common and serious attack class rather than correcting it. A global bypass for the booking servers is the widest exception of all and leaves the most exposed application in the environment uninspected.

   Source: NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)

7. Question 7 · Automate Cybersecurity Tasks with Python

   A syslog parsing automation silently skips any line it cannot parse, dropping about 2% of lines nightly with no error. What is the greatest risk in that behavior?

   1. ADuplicates may build up in the table, since the parser cannot detect repeats among skipped lines.
   2. BThe job runs longer than needed, since it fully parses each malformed line before discarding it.
   3. CThe dropped lines waste storage on the source devices, since they are collected but never used.
   4. DAttacker activity often produces malformed entries, and dropping them silently leaves no trace.
   Show answer and explanation

   Correct answer

   Attacker activity often produces malformed entries, and dropping them silently leaves no trace.

   Silent discarding is the dangerous part. Records that do not match an expected pattern are disproportionately likely to be the interesting ones, produced by unusual commands, injected content, malformed traffic or attempts to disrupt logging, and dropping them without a count or an error leaves analysts confident in a data set that is quietly incomplete. Storage on the devices, parse time and duplicate handling are efficiency and hygiene concerns that cost resources rather than visibility. The corrective practice is to route unparsed lines to an exception stream and alert when their volume changes.

   Source: OWASP Top 10:2021 A09 Security Logging and Monitoring Failures

8. Question 8 · Put It to Work: Prepare for Cybersecurity Jobs

   Two analysts are working a live intrusion across shifts at a startup with a ticket system but no formal handoff procedure. The outgoing analyst blocks a domain, pulls a memory image, and resets an account. How should these actions be documented for the handoff?

   1. AWrite a narrative summary from memory at shift end, since detailed notes slow active response
   2. BKeep detailed personal notes and hand over only conclusions, so the ticket stays readable
   3. CLog each action in the ticket as it happens, with time, systems touched, and who did it
   4. DSave screenshots of every console used, since images are harder to dispute than typed notes
   Show answer and explanation

   Correct answer

   Log each action in the ticket as it happens, with time, systems touched, and who did it

   Contemporaneous, attributed, timestamped entries in the shared case record are what let a second analyst reconstruct the state of the response and what keep evidence handling defensible afterward. End-of-shift narratives drift because memory compresses and reorders events, and the details lost are usually the timing ones that matter most. Screenshots supplement a record but cannot show sequence, actor, or intent on their own. Private notes with only conclusions handed over strand the reasoning with one person, which defeats the purpose of a handoff and leaves gaps if that analyst is unavailable.

   Source: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response