DSST® practice test

Free DSST Fundamentals of Cybersecurity Practice Test (2026)

This is a set of 25 original practice questions that follow the official DSST Fundamentals of Cybersecurity content outline and its topic weights, each with a short explanation. Answer all 25, then read the explanations to see which topics need more study.

  • 25 questions
  • 8 topics from the official outline
  • No timer
Start the test

Free. Create a free account to see your score.

The practice test

25 questions

Question 1 of 25A server worth $50,000 has an exposure factor of 40% for flooding, and a flood is expected once every 10 years. What is the annualized loss expectancy (ALE)?
Question 2 of 25A company must encrypt 2 TB of backups quickly and get the decryption key safely to a remote site that has published an RSA public key. Which approach is standard practice?
Question 3 of 25Members of the incident response team meet in a conference room and talk through how each of them would respond to a simulated ransomware attack, without touching any systems. Which type of plan test is this?
Question 4 of 25An endpoint tool flags a program because it starts rewriting hundreds of user files per minute, even though the program's file matches nothing in the tool's malware database. Which detection method caught it?
Question 5 of 25In a hospital system, a nurse can open patient charts because she is assigned the Nurse job title, and she loses that access automatically when she transfers to billing. Which access control model is this?
Question 6 of 25What is the main difference between a vulnerability scan and a penetration test?
Question 7 of 25Which login combination is true multifactor authentication?
Question 8 of 25A company moves its customer database to a cloud provider. Which statement about responsibility is correct?
Question 9 of 25A security team wants one system that collects logs from servers, firewalls and applications, correlates the events, and raises alerts on suspicious patterns. Which tool fits?
Question 10 of 25A server gets a full backup every Sunday night and a differential backup every other night of the week. It fails on Thursday afternoon. Which backups are needed to restore it as fully as possible?
Question 11 of 25A company rule says the employee who adds a new vendor to the payment system may not also approve payments to that vendor. Which principle does the rule apply?
Question 12 of 25A software vendor posts a SHA-256 value next to each installer it offers for download. What does a user confirm by hashing the downloaded file and getting the same value?
Question 13 of 25A production server crashes after an administrator applies an untested patch directly to it during business hours. Which operational control was most clearly missing?
Question 14 of 25Before a penetration test starts, the testers are given network diagrams, application source code and valid user credentials. What kind of test is this?
Question 15 of 25Which device sits inline in the traffic path and can drop malicious packets as soon as it detects them?
Question 16 of 25A login form inserts whatever the user types straight into a database query, and an attacker logs in by typing ' OR '1'='1 as the password. Which fix addresses the root cause?
Question 17 of 25Staff at a data center keep holding the secure door open for people carrying boxes who have no badge. Which control best prevents this tailgating?
Question 18 of 25A technician needs to find which hosts on a subnet are up and which TCP ports each one has open. Which tool is built for this job?
Question 19 of 25An attacker phones the help desk, claims to be a traveling executive who is locked out before a big meeting, and asks for an urgent password reset. Which social engineering technique is the attacker mainly using?
Question 20 of 25Which Wi-Fi security standard replaces the pre-shared key handshake with Simultaneous Authentication of Equals (SAE) to resist offline password guessing?
Question 21 of 25A business says it can afford to lose no more than 4 hours of transaction data if its database fails. Which recovery metric does this statement set?
Question 22 of 25A company's top-level policy says sensitive data must be protected. A second document says, "All company laptops must use full-disk encryption with AES-256." How is the second document best classified?
Question 23 of 25An administrator wants to replace Telnet for command-line management of network routers. Which protocol and default port should be used?
Question 24 of 25A manager approves a large wire transfer by email. Which control best gives non-repudiation, so the manager cannot later credibly deny sending the approval?
Question 25 of 25After assessing the risk of a data breach, a company buys a cyber insurance policy to cover the financial losses. Which risk response is this?

Your answers save on this device as you go.

More free DSST practice tests 37

Each has 25 questions written from the exam's official outline. Your answers on each test save separately.

Not sure where to start?

Ask Iris, our AI assistant, which exams your college takes and which guide fits. A person on our team answers at team@transfercredit.org.

Find my college

These are practice questions we wrote from the official outline. This is not the real exam, and a practice score doesn't predict your DSST score. We source all of this information from DSST. Each college decides whether to award credit for a DSST exam, so confirm with your registrar before you book an exam. DSST® is a registered trademark of Prometric, which was not involved in making these questions and does not endorse TransferCredit.org. Terms