Cybersecurity Trivia Questions
0Loading crowd target
0Loading crowd target
7correct to beat the crowd
109 free Cybersecurity trivia questions with answers — technology quiz, new questions added Oct 2026.
60 free cybersecurity trivia questions with answers. Sixty cybersecurity trivia questions, written for security-awareness sessions, IT team socials and anyone who enjoys the history of hacking. The opening stretch covers the vocabulary every employee is supposed to know: phishing, ransomware, the CIA triad, zero-days, honeypots, multi-factor authentication, air gaps and zero trust. Then it moves through the incidents that made the news, from Creeper and the Morris worm to ILOVEYOU, Stuxnet, WannaCry, Heartbleed, Equifax, SolarWinds, Colonial Pipeline and Log4Shell. The back half is for the people who read the post-mortems: Rejewski and Enigma, Colossus, the first password on CTSS, who really invented RSA, Captain Crunch's whistle, the Selectric bug, DEF CON, Have I Been Pwned, and the films and shows that taught the public what a hacker looks like. Difficulty runs from easy definitions to a few questions only a veteran will get, so mixed groups all have something to play for. Every answer was checked against Wikipedia's articles on the incidents, people and technologies involved, and the sentence that establishes it is shown under each explanation.
30 of 109 questions with answers and explanations. Play the quiz
Q 01What is the fraud of sending messages posing as a trusted sender to trick people into revealing passwords called?
Phishing
Phishing is 'fishing' for passwords in hacker spelling, the 'ph' generally linked to phone 'phreaking'; the scam was documented among AOL account thieves by 1995, helped by a tool called AOHell that posed as AOL staff.
Q 02Malware that encrypts a victim's files and demands payment for the key is called what?
Ransomware
Ransomware dates to 1989, when floppy disks labelled as AIDS information scrambled file names on victims' PCs and demanded $189 be mailed to a post-office box in Panama; the weak cipher was soon reversed.
Q 03The 'CIA triad' at the heart of information security stands for confidentiality, integrity and what?
Availability
Availability means authorised users can reach systems and data when they need them; a denial-of-service flood attacks it directly, stealing nothing but knocking a service offline.
Q 04A software flaw exploited by attackers before the vendor even knows it exists is called what?
Zero-day
Zero-day counts the days the vendor has had to fix it, which at the moment of discovery is none.
Q 05In cybersecurity, a decoy system set up to attract attackers and study them is known as what?
Honeypot
A honeypot makes suspicion automatic: it should receive no legitimate traffic, so any activity it logs is presumed to be a probe or an attack.
Q 06In multi-factor authentication, a fingerprint scan counts as which kind of factor?
Something you are
Something you are covers biometrics such as a fingerprint or face scan; real multi-factor login needs two or more different kinds of proof, so two passwords in a row would not count.
Q 07Malware that disguises itself as a normal program is named after what?
A wooden horse from Greek myth
A wooden horse from Greek myth fits because, unlike a virus or worm, a Trojan cannot copy itself: the victim has to be tricked into letting it in, as the Trojans were with the horse.
Q 08Manipulating people psychologically into divulging information or taking unsafe actions is called what?
Social engineering
Social engineering attacks the person rather than the machine: in 2020, hackers phoned Twitter staff posing as its IT help desk, got their logins and hijacked Barack Obama's and Elon Musk's accounts.
Q 09Which networking term, borrowed from building construction, names a system that filters traffic between networks?
Firewall
Firewall first meant a wall built to stop a blaze spreading between buildings; the first network versions grew out of 1980s routers, which already sat between networks and so could be told which traffic to drop.
Q 10A computer that is physically isolated from the internet and other unsecured networks is said to be what?
Air-gapped
An air-gapped computer has no network link at all, so data must travel by hand on removable media; an infected USB stick is reportedly how Stuxnet crossed the gap into Iran's enrichment plant.
Q 11Which security model verifies every user and device on each request, even inside the corporate network?
Zero Trust
Zero Trust took off after Forrester analyst John Kindervag championed it in 2010, as cloud services and remote working made the old idea of a safe network perimeter unworkable.
Q 12What is generally considered the first computer worm, a 1971 program on ARPANET?
Creeper
Creeper printed 'I'M THE CREEPER: CATCH ME IF YOU CAN' as it hopped between machines; a second program, Reaper, was then written to chase and delete it, which is why Reaper is often called the first antivirus.
Q 13The Morris worm of 2 November 1988 was written by a graduate student at which university?
Cornell
Q 21The May 2017 WannaCry attack spread using EternalBlue, an exploit originally developed by which agency?
NSA
EternalBlue was built by the NSA and leaked by the Shadow Brokers in April 2017, a month before WannaCry; the US and Britain later blamed North Korea for the attack itself.
Q 22WannaCry was halted within hours when researcher Marcus Hutchins did what?
Registered an unclaimed web domain
Registered an unclaimed web domain: Hutchins found the address in WannaCry's code and bought it only to track the outbreak, unaware that the malware shut itself down once that address answered.
Q 23Heartbleed, disclosed in April 2014, was a bug in which widely used cryptography library?
OpenSSL
Robert Tappan Morris was a Cornell graduate student who released the worm from another university's computer to hide its origin; his was the first felony conviction under the 1986 Computer Fraud and Abuse Act.
Q 14What sentence did Robert Tappan Morris receive for releasing the 1988 internet worm?
Three years' probation and a fine
Morris got three years' probation and a fine of $10,050, plus 400 hours of community service, and never went to prison; he later co-founded the start-up funder Y Combinator.
Q 15The ILOVEYOU worm of May 2000 was written by a college dropout from which country?
Philippines
Onel de Guzman, a computer-college dropout from Manila in the Philippines, had all charges dropped because the Philippines had no law against hacking at the time.
Q 16Which 1999 virus spread via infected Word documents emailed to a victim's first 50 contacts?
Melissa
Melissa, reportedly named by its author after a Florida stripper, overloaded mail servers at more than 300 companies and government agencies, and some had to shut their email down altogether.
Q 17Elk Cloner, an early 'in the wild' virus written by a 15-year-old around 1982, infected which computer?
Apple II
Rich Skrenta wrote Elk Cloner for the Apple II as a prank and hid it on a game disk; on every 50th boot it displayed a short poem.
Q 18Brain, considered the first virus for the IBM PC, was written in 1986 by two brothers in which city?
Lahore
Basit and Amjad Farooq Alvi signed Brain with the name, address and phone numbers of their computer firm in Lahore, Pakistan, plus a line telling victims to contact them for 'vaccination'.
Q 19Stuxnet, uncovered in 2010, is believed to have destroyed nuclear centrifuges at which Iranian facility?
Natanz
Stuxnet took over the Siemens controllers at Natanz and is thought to have driven centrifuges to destruction while feeding operators readings that all was normal; Iran replaced about 1,000 machines.
Q 20The covert sabotage programme that reportedly built Stuxnet is known by what code name?
Operation Olympic Games
Operation Olympic Games was revealed by New York Times reporter David Sanger in 2012 as a programme begun under George W. Bush and expanded under Barack Obama.
OpenSSL's Heartbleed bug let anyone quietly read chunks of a server's memory, passwords and secret keys included; the flaw had sat in the widely used library for over two years before it was spotted.
Q 24Which company's 2017 breach exposed the personal records of nearly 150 million Americans?
Equifax
Equifax was warned in March 2017 of a critical flaw in its Apache Struts web software but failed to patch it; the US later charged four members of China's military with the break-in.
Q 25Hackers tied to Russian intelligence breached US agencies in 2020 through tainted updates from which software company?
SolarWinds
SolarWinds unknowingly sent the booby-trapped update of its Orion network software to nearly 18,000 customers; the intrusion surfaced only when security firm FireEye found its own hacking tools stolen.
Q 26A May 2021 hack caused panic buying of fuel across the US Southeast after hitting which company?
Colonial Pipeline
Colonial Pipeline shut its fuel line for days and paid the DarkSide gang 75 bitcoin, about $4.4 million; within a month the US Justice Department had traced the payment and seized back 63.7 bitcoin of it.
Q 27Which company revealed in 2017 that a 2013 breach had hit every one of its 3 billion user accounts?
Yahoo
Yahoo had first put the 2013 breach at 1 billion accounts, then tripled it to every account it had, only months after Verizon finished buying the company.
Q 28The 'Guardians of Peace' hackers leaked Sony Pictures data in 2014 demanding it pull which film?
The Interview
The Interview stars James Franco and Seth Rogen as a TV host and his producer recruited to assassinate Kim Jong Un; Sony cancelled the release, then put the film online and into a few hundred independent cinemas at Christmas.
Q 29Log4Shell, the critical December 2021 flaw, hit Log4j, a logging library for which language?
Java
Java's Log4j library is built into so much software that the flaw put systems worldwide at risk; it first surfaced in Minecraft, where pasting a short message into the chat box was enough to trigger it.
Q 30NSO Group, developer of the Pegasus phone spyware, is based in which country?
Israel
NSO Group is headquartered in Herzliya, Israel, and every foreign sale of Pegasus needs an export licence from the Israeli defence ministry; the US Commerce Department blacklisted the firm in November 2021.