Cyber-security MCQs recycle familiar words, but one changed verb separates a threat from a control, passive listening from active interception, or a worm from a Trojan horse. Before choosing, classify the stem's verb and decide whether every option names a mechanism, an impact, or a defence. Firewalls, sandboxes and access rules are defences; disclosure, alteration and destruction are impacts; phishing, spoofing, eavesdropping and flooding are mechanisms. Attempt each question before reading its explanation. KnowledgeGate's question bank carries 25+ questions on Cyber Threats and Attacks, while GATE Guidance by Sanchit Sir provides a structured Computer Networks route inside the GATE preparation hub.
The attack map: security goals, threats, controls and impacts
Start with the three security goals:
Goal | What it protects | Typical exam wording |
|---|---|---|
Confidentiality | Prevents unauthorised disclosure | Information release |
Integrity | Prevents unauthorised alteration | Information alteration |
Availability | Keeps systems and services usable | Information destruction or service flooding |
Destruction can damage integrity, but availability comes first when information is unusable. A threat or attack harms, a control reduces risk, an impact names the loss, and a malware family describes code behaviour.
Copying 2,000 customer records breaks confidentiality. Changing role=user to role=admin breaks integrity. Deleting 40 required configuration files so a service cannot start breaks availability.
Security goals and the threat-versus-control trap (Q1-Q3)
Q1. UPLT 2018
Which of the following is possible security threat?
(a) Information destruction
(b) Information alteration
(c) Information release
(d) All of the above
Answer: (d) All of the above.
Destruction harms availability, alteration integrity, and release confidentiality. Each is a threat, so all of the above is complete. Practise this question on KnowledgeGate.
Q2. BPSC 2023
Which one of the following would breach the integrity of a system?
(a) Locking the room to prevent theft
(b) Full access rights for all users
(c) Fitting the system with an anti-theft device
(d) More than one of the above
(e) None of the above
Answer: (b) Full access rights for all users.
Integrity requires restricting who may change data. Full access removes that restriction, while locking the room and fitting an anti-theft device are controls that prevent theft rather than alteration, so only one option qualifies and (d) does not apply. Practise this question on KnowledgeGate.
Q3. RSSB 2025
Which of the following is NOT a cyber security threat?
(a) Firewall
(b) Trojan Horse
(c) Phishing
(d) Denial of Service
Answer: (a) Firewall.
A firewall enforces traffic rules, so it reduces risk rather than causing harm. A Trojan horse hides malicious code, phishing deceives a user into disclosing data, and denial of service exhausts a resource, so each of those three is a threat. Practise this question on KnowledgeGate.
Deception attacks: watering holes, phishing and spoofing (Q4-Q6)
Q4. IBPS 2025
Which option best describes a Watering Hole Attack?
(a) Infecting software on a user's local system through email attachments
(b) Redirecting traffic from secure websites to fake login pages
(c) Infecting a commonly visited website to target a specific group of users
(d) Sending mass phishing emails to unknown users
(e) Encrypting files and demanding ransom for access
Answer: (c) Infecting a commonly visited website to target a specific group of users.
The attacker compromises a site the intended group visits, bringing victims to the trap. "Commonly visited website" is decisive; the alternatives describe other mechanisms. Practise this question on KnowledgeGate.
Q5. ISRO 2025
In which of the following cases, a user is persuaded to reveal personal data by hackers/cyber criminals?
(a) Eavesdropping attack
(b) SQL Injection attack
(c) Phishing
(d) Website Defacement
Answer: (c) Phishing.
Phishing uses deception to persuade a victim to reveal data. Eavesdropping observes communication, SQL injection targets queries, and defacement changes site content. Practise this question on KnowledgeGate.
Q6. DSSSB 2021
_____ is an act of disguising a communication from an unknown source as being a trusted source.
(a) Spoofing
(b) Bullying
(c) Stealing
(d) Sandboxing
Answer: (a) Spoofing.
Spoofing makes an unknown source look trusted. Sandboxing is defensive isolation; the other terms do not name this mechanism, so focus on "disguising". Practise this question on KnowledgeGate.
Interception and service disruption (Q7-Q9)
Q7. RSSB 2023
An unauthorised real time interception or monitoring of private communication between two entities over a network is called-
(a) Eavesdropping
(b) Snooping
(c) Phishing
(d) Virus
Answer: (a) Eavesdropping.
Eavesdropping monitors communication in transit without authorisation, breaking confidentiality. Phishing deceives, a virus is malware, and "snooping" is not the requested network term. Practise this question on KnowledgeGate.
Q8. Deloitte 2025
What is a "man-in-the-middle" attack?
(a) An attack that floods a network with traffic to disrupt services
(b) An attack that exploits vulnerabilities in software to gain unauthorized access
(c) An attack where an attacker intercepts communication between two parties
(d) An attack that uses malicious emails to trick users into revealing sensitive information
Answer: (c) An attack where an attacker intercepts communication between two parties.
The attacker sits between endpoints and can read or alter relayed traffic. Options (a) and (d) are DoS and phishing; option (b) misses this defining position. Practise this question on KnowledgeGate.
Q9. Deloitte 2025
What is a "denial-of-service (DoS)" attack?
(a) An attack that intercepts communication between two parties
(b) An attack that exploits vulnerabilities in software to gain unauthorized access
(c) An attack that floods a network with traffic to disrupt services
(d) An attack that uses malicious emails to trick users into revealing sensitive information
Answer: (c) An attack that floods a network with traffic to disrupt services.
DoS breaks availability by exhausting a finite resource. "Floods" separates it from interception, generic exploitation and phishing. Practise this question on KnowledgeGate.
Revise traffic with TCP and UDP MCQs: 12 Solved Transport Layer Questions.
Malware behaviour: worm, Trojan horse and ransomware (Q10-Q12)
Q10. UGC NET 2024
Which of the following is an independent malicious program that propagates itself across a network by exploiting security flaws in widely-used services?
(a) Computer Worm
(b) Computer Virus
(c) Trojan Horse
(d) Logic Bomb
Answer: (a) Computer Worm.
A worm is standalone code that self-propagates, matching both clues. A virus needs a host, a Trojan uses disguise, and a logic bomb waits for a trigger. Practise this question on KnowledgeGate.
Q11. UGC NET 2014
A Trojan horse is
(a) A program that performs a legitimate function that is known to an operating system or its user and also has a hidden component that can be used for nefarious purposes like attacks on message security or impersonation.
(b) A piece of code that can attach itself to other programs in the system and spread to other systems when programs are copied or transferred.
(c) A program that spreads to other computer systems by exploiting security holes like weaknesses in facilities for creation of remote processes
(d) All of the above
Answer: (a) A program that performs a legitimate function that is known to an operating system or its user and also has a hidden component that can be used for nefarious purposes like attacks on message security or impersonation.
A Trojan horse hides a malicious component beneath a legitimate-looking surface. Options (b) and (c) describe a virus and worm, so (d) is wrong. Practise this question on KnowledgeGate.
Q12. RSSB 2023
During May 2017, a very popular malware infected almost 2 lakh computers around the world. It demanded payments in Bitcoin cryptocurrency. It made its victims cry. It is known as ______.
(a) Wanna Cry
(b) Baby Cry
(c) Crypto Cry
(d) Node Cry
Answer: (a) Wanna Cry.
The date, Bitcoin demand and wordplay identify WannaCry ransomware. Ransomware extorts, while a worm self-propagates, so one incident can have both behaviours. Practise this question on KnowledgeGate.
Three worked classification cases that separate the look-alikes
In each case, fix the mechanism first, then read off the CIA loss it causes.
Case A: A server handles 2,000 requests per second, but an attacker sends 5,000 per second for 60 seconds. The ratio is 5,000 / 2,000 = 2.5; excess load is 5,000 - 2,000 = 3,000 requests per second. Crowding out legitimate traffic makes this DoS and an availability loss, not man-in-the-middle.
Case B: A client sends transfer=1000; an attacker relays it as transfer=9000. Occupying the path makes this active man-in-the-middle, while modifying the value breaks integrity. Copying transfer=1000 without alteration would instead be eavesdropping and a confidentiality loss.
Case C: Of 40 engineers using vendor.example, 6 visiting browsers execute malicious update.js after the site is compromised. Targeting a trusted site used by this group makes it a watering hole, not mass phishing, because no email lure is needed.
The short version and what to practise next
Map disclosure, alteration and unavailability to confidentiality, integrity and availability. A firewall is a control. Phishing persuades, spoofing disguises, eavesdropping listens, MITM occupies the path, and DoS exhausts resources. A worm propagates, a Trojan hides, and ransomware extorts.
UPLT 2018, BPSC 2023 and RSSB 2025 have tested threat-versus-control classification. IBPS 2025, ISRO 2025 and DSSSB 2021 tested deception, RSSB 2023 tested eavesdropping and WannaCry, Deloitte 2025 tested the man-in-the-middle and denial-of-service definitions, and UGC NET 2014 and 2024 tested malware behaviour.
Practise with GATE Test Series. Then continue with Cyber Safety and Malware MCQs: 12 Solved PYQs for antivirus tools, virus entry routes and safe-practice questions.
