Cybersecurity Provisions in Pakistan MCQs

1. Question 1 of 100

   A type of malware that can self-replicate and spread across networks WITHOUT needing to attach itself to another program is called a:

   A Virus B Worm C Adware D Spyware
2. Question 2 of 100

   The process of converting readable data (plaintext) into an unreadable format (ciphertext) to protect it from unauthorized access is called:

   A Compression B Encryption C Formatting D Caching
3. Question 3 of 100

   The fundamental right to privacy in Pakistan is primarily grounded in which Article of the Constitution?

   A Article 9 B Article 14 C Article 19 D Article 25
4. Question 4 of 100

   The organized approach to addressing and managing the aftermath of a security breach or cyberattack is known as:

   A Incident response B Data mining C Penetration testing D Load balancing
5. Question 5 of 100

   Which of the following is generally recommended as a basic cybersecurity hygiene practice for individuals?

   A Using the same password for all accounts B Clicking on links from unknown senders C Regularly updating software and using strong, unique passwords D Disabling all security software to improve speed
6. Question 6 of 100

   The Electronic Transactions Ordinance, 2002 amended which older law to formally allow the admissibility of electronic documents as evidence in Pakistani courts?

   A The Pakistan Penal Code, 1860 B The Qanun-e-Shahadat Order, 1984 C The Code of Civil Procedure, 1908 D The Contract Act, 1872
7. Question 7 of 100

   A one-way mathematical function that converts data into a fixed-length string of characters, commonly used to verify data integrity, is called a:

   A Cipher B Hash function C Firewall rule D VPN tunnel
8. Question 8 of 100

   Which of the following is generally recommended when using public Wi-Fi networks (e.g., in a cafe or airport) to reduce cybersecurity risk?

   A Disable all security software to browse faster B Avoid accessing sensitive accounts (like banking) or use a VPN to encrypt the connection C Share the Wi-Fi password with as many people as possible D Use the same password for the Wi-Fi and your email account
9. Question 9 of 100

   Software designed to detect, prevent, and remove malicious software from a computer system is generically called:

   A A firewall B Antivirus/anti-malware software C A VPN client D A hash calculator
10. Question 10 of 100

    A type of malware that replicates itself by attaching to other programs and requires human action (like opening a file) to spread is called a:

    A Worm B Virus C Trojan horse D Rootkit
11. Question 11 of 100

    An attack in which an attacker systematically tries many password combinations until the correct one is found is called a:

    A Brute-force attack B Zero-day attack C Man-in-the-middle attack D Pharming attack
12. Question 12 of 100

    In information security, 'availability' primarily refers to:

    A Ensuring authorized users have reliable and timely access to systems and data B Ensuring only encrypted data is stored C Ensuring no unauthorized person ever accesses a system D Ensuring software licenses are valid
13. Question 13 of 100

    Phishing conducted via voice calls, often impersonating banks or officials, is commonly referred to as:

    A Smishing B Vishing C Whaling D Pharming
14. Question 14 of 100

    The framework of the draft Personal Data Protection Bill, 2023 is generally described as being modeled on which major international data protection law?

    A The US Patriot Act B The European Union's General Data Protection Regulation (GDPR) C China's Cybersecurity Law D Japan's Personal Information Protection Act
15. Question 15 of 100

    Under the draft Personal Data Protection Bill, 2023, personal data is generally categorized into how many tiers of increasing sensitivity?

    A Two B Three (regular, sensitive, and critical personal data) C Four D Five
16. Question 16 of 100

    What is 'malware' a general term for?

    A Any software designed to damage, disrupt, or gain unauthorized access to a system B Any software that is outdated C Software developed by a foreign company D Software that requires an internet connection
17. Question 17 of 100

    Under the draft Personal Data Protection Bill, an entity that determines the purposes and means of processing personal data is referred to as a:

    A Data subject B Data controller C Data processor only D Certification authority
18. Question 18 of 100

    Software programs that display unwanted advertisements, sometimes bundled with legitimate downloads, are known as:

    A Adware B Spyware C Ransomware D Rootkits
19. Question 19 of 100

    In information security, 'integrity' primarily refers to:

    A Preventing unauthorized access to a system B Ensuring data remains accurate, consistent, and unaltered except by authorized action C Ensuring a system is always available D Ensuring passwords are encrypted
20. Question 20 of 100

    Which of the following is a key practical benefit the Electronic Transactions Ordinance, 2002 provided for Pakistan's economy?

    A It banned all foreign software companies B It legally enabled e-commerce, online banking, and digital signatures C It criminalized the use of the internet for business D It replaced the need for all contracts
21. Question 21 of 100

    Under Section 41 of the Electronic Transactions Ordinance, 2002, a person generally cannot be compelled to disclose:

    A Their real name B A password, key, or other secret information enabling use of a security procedure or advanced electronic signature C Their business address D Their tax records
22. Question 22 of 100

    In information security, 'confidentiality' primarily refers to:

    A Ensuring data is accurate and unaltered B Ensuring data is accessible only to authorized individuals C Ensuring systems remain operational at all times D Ensuring software is regularly updated
23. Question 23 of 100

    The padlock icon and 'https://' prefix in a browser's address bar generally indicate that a website is using which security protocol to encrypt the connection?

    A FTP B SSL/TLS C SMTP D Telnet
24. Question 24 of 100

    Under the Payment Systems and Electronic Fund Transfers Act, 2007, primary regulatory oversight of electronic payment systems in Pakistan rests with:

    A The Securities and Exchange Commission of Pakistan B The State Bank of Pakistan C The Pakistan Telecommunication Authority D The Federal Board of Revenue
25. Question 25 of 100

    A security threat originating from within an organization, such as a disgruntled employee misusing authorized access, is known as an:

    A External threat B Insider threat C Advanced Persistent Threat (APT) only D Zero-day threat
26. Question 26 of 100

    Which Pakistani law was the first major legislation to give legal recognition to electronic documents, records, and signatures?

    A The Prevention of Electronic Crimes Act, 2016 B The Electronic Transactions Ordinance, 2002 C The Personal Data Protection Bill D The Payment Systems and Electronic Fund Transfers Act, 2007
27. Question 27 of 100

    In which month and year was Pakistan's National Cyber Security Policy formally approved by the Cabinet?

    A January 2021 B July 2021 C December 2021 D March 2022
28. Question 28 of 100

    The Pakistan Telecommunication Authority (PTA) was established under which law?

    A The Electronic Transactions Ordinance, 2002 B The Pakistan Telecommunication (Re-organization) Act, 1996 C The Prevention of Electronic Crimes Act, 2016 D The Wireless Telegraphy Act, 1933
29. Question 29 of 100

    Under the Electronic Transactions Ordinance, 2002, a stronger, cryptographically verifiable form of electronic signature -- attracting a legal presumption of authenticity -- is termed a(n):

    A Simple electronic signature B Advanced electronic signature C Notarized signature D Biometric signature
30. Question 30 of 100

    Which of the following best describes the overall relationship between Pakistan's various cyber-related laws (ETO 2002, PSEFTA 2007, and cybercrime legislation)?

    A They are entirely unrelated and address completely separate concerns B Together, they form a layered legal framework addressing electronic transactions, digital payments, and cyber offences respectively C Only one of these laws is currently in force D They apply only to government employees
31. Question 31 of 100

    Before the enactment of specific cybercrime legislation, offences like online fraud or forgery of electronic documents in Pakistan were generally prosecuted under which general criminal law?

    A The Pakistan Penal Code, 1860 B The Anti-Terrorism Act, 1997 C The Companies Act, 2017 D The Anti-Money Laundering Act, 2010
32. Question 32 of 100

    The broad practice of manipulating people into divulging confidential information or performing actions that compromise security is known as:

    A Social engineering B Ethical hacking C Penetration testing D Encryption
33. Question 33 of 100

    A digital signature is primarily used to verify:

    A The speed of a network connection B The authenticity and integrity of a digital message or document C The size of a file D The brand of a computer's hardware
34. Question 34 of 100

    Pakistan's National Cyber Security Policy, 2021 was formally approved by the Federal Cabinet, and issued by which Ministry?

    A Ministry of Interior B Ministry of Information Technology and Telecommunication (MoITT) C Ministry of Defence D Ministry of Law and Justice
35. Question 35 of 100

    The National Centre for Cyber Security (NCCS), established in 2018 as a research and development body, is a joint initiative involving which institutions?

    A The Higher Education Commission (HEC) and the Planning Commission B The Supreme Court and the Election Commission C NADRA and the State Bank D PTA and PEMRA
36. Question 36 of 100

    A fraudulent scheme in which an attacker impersonates a trusted business contact (often via email) to trick an organization into making an unauthorized wire transfer is commonly called:

    A Business Email Compromise (BEC) B A brute-force attack C A rootkit installation D A zero-day exploit
37. Question 37 of 100

    The three foundational principles of information security -- often called the CIA triad -- are:

    A Confidentiality, Integrity, Availability B Control, Investigation, Authorization C Cryptography, Isolation, Access D Compliance, Inspection, Authentication
38. Question 38 of 100

    Under Section 3 of the Electronic Transactions Ordinance, 2002, the core principle established is that:

    A Electronic information cannot be used in court B Information shall not be denied legal effect, validity, or enforceability solely because it is in electronic form C Only government agencies may use electronic documents D Electronic signatures require notarization to be valid
39. Question 39 of 100

    A server that acts as an intermediary between a user's device and the internet, often used for privacy or content filtering, is called a:

    A Proxy server B Domain controller C Load balancer D Certificate authority
40. Question 40 of 100

    Which of the following statements about Pakistan's data protection landscape is most accurate?

    A Pakistan has a fully operational, dedicated Data Protection Authority actively enforcing a comprehensive data protection statute B Pakistan currently relies on a patchwork of sector-specific rules and a draft bill, without one comprehensive, enacted data protection law yet in force C Pakistan was the first country in South Asia to enact comprehensive data protection legislation D Data protection is governed exclusively by the Anti-Terrorism Act, 1997
41. Question 41 of 100

    The State Bank of Pakistan issues cybersecurity-related regulatory circulars and frameworks primarily aimed at:

    A Regulating cricket broadcasting rights B Ensuring the security and resilience of banks and financial institutions against cyber threats C Licensing television channels D Managing agricultural subsidies
42. Question 42 of 100

    Under the National Cyber Security Policy, 2021, a cyberattack against Pakistan's critical infrastructure is characterized as:

    A A minor administrative issue B An act of aggression against national sovereignty C A purely civil matter D An issue solely for private companies to resolve
43. Question 43 of 100

    The process of regularly copying data to a separate location so it can be restored in case of loss or attack is called:

    A Data backup B Data mining C Data compression D Data caching
44. Question 44 of 100

    An attack that floods a system, server, or network with excessive traffic to make it unavailable to legitimate users is known as a:

    A Denial-of-Service (DoS) attack B Phishing attack C Man-in-the-middle attack D Social engineering attack
45. Question 45 of 100

    Encryption that uses a PAIR of different keys -- a public key and a private key -- is known as:

    A Symmetric encryption B Asymmetric encryption C Hashing D Obfuscation
46. Question 46 of 100

    The Electronic Transactions Ordinance, 2002 was promulgated during whose presidency?

    A Ghulam Ishaq Khan B Pervez Musharraf C Asif Ali Zardari D Farooq Leghari
47. Question 47 of 100

    Which of the following is an example of 'sensitive personal data' as typically categorized under modern data protection frameworks (including Pakistan's draft bill)?

    A A person's favorite color B Health records or biometric data C A person's public job title D A company's publicly listed address
48. Question 48 of 100

    Which of the following best describes 'shoulder surfing' as a security risk?

    A A type of malware that infects USB drives B Observing someone's screen or keystrokes to steal information without their knowledge C A network scanning technique D A method of encrypting emails
49. Question 49 of 100

    The National Cyber Security Policy, 2021 primarily aims to protect Pakistan's:

    A Only military communication networks B National Critical Information Infrastructure (CII) and the broader digital ecosystem C Only banking sector systems D Only social media platforms
50. Question 50 of 100

    A decoy system deliberately set up to attract and study attackers, diverting them from real targets, is known as a:

    A Firewall B Honeypot C Sandbox D Proxy server
51. Question 51 of 100

    A piece of malicious code that lies dormant until triggered by a specific event or date is known as a:

    A Logic bomb B Firewall C Rootkit D Sandbox
52. Question 52 of 100

    Prior to 2024, cybercrime complaints in Pakistan were primarily investigated by which body under the Federal Investigation Agency (FIA)?

    A The Anti-Corruption Wing B The National Response Centre for Cyber Crime (NR3C) / Cyber Crime Wing C The Immigration Wing D The Anti-Narcotics Wing
53. Question 53 of 100

    Which of the following is generally considered a core objective shared across Pakistan's various cybersecurity-related laws and policies?

    A Eliminating internet access entirely B Building trust in digital transactions and protecting critical digital infrastructure and data C Banning all foreign technology companies D Restricting cybersecurity research
54. Question 54 of 100

    An attack in which a malicious actor secretly intercepts and possibly alters communication between two parties who believe they are directly communicating with each other is called a:

    A Denial-of-service attack B Man-in-the-middle attack C Brute-force attack D SQL injection attack
55. Question 55 of 100

    Under the draft Personal Data Protection Bill, 2023, which category of data is proposed to be subject to the strictest localization requirement, requiring processing exclusively on servers within Pakistan?

    A Regular personal data B Sensitive personal data C Critical personal data D Publicly available data
56. Question 56 of 100

    A network of compromised, internet-connected devices controlled remotely by an attacker, often used for large-scale attacks, is called a:

    A Botnet B VPN C Intranet D Sandbox
57. Question 57 of 100

    Malware that encrypts a victim's files and demands payment for their release is known as:

    A Spyware B Ransomware C Adware D A keylogger
58. Question 58 of 100

    A phishing attack specifically targeting high-profile individuals such as executives or senior officials is called:

    A Spear phishing B Whaling C Pharming D Smishing
59. Question 59 of 100

    A service that creates an encrypted, private connection over a public network, often used to protect data and mask a user's IP address, is called a:

    A Virtual Private Network (VPN) B Content Delivery Network (CDN) C Local Area Network (LAN) D Domain Name System (DNS)
60. Question 60 of 100

    The authorized, simulated cyberattack conducted to evaluate an organization's security posture is known as:

    A Penetration testing (ethical hacking) B Social engineering C Ransomware deployment D Phishing
61. Question 61 of 100

    An isolated, controlled environment used to safely run and analyze suspicious code without risking the host system is called a:

    A Sandbox B Honeypot C VPN D Firewall
62. Question 62 of 100

    As of the most recent available information, Pakistan's comprehensive data protection legislation, the Personal Data Protection Bill, is:

    A Fully enacted and in force since 2020 B Still in draft/proposed form, pending passage by Parliament C Repealed and no longer under consideration D Already superseded by a newer law
63. Question 63 of 100

    A network security device or software that monitors and filters incoming/outgoing traffic based on predetermined security rules is called a:

    A Router B Firewall C Modem D Switch
64. Question 64 of 100

    Under the Electronic Transactions Ordinance, 2002, entities that issue digital certificates to verify the identity of parties in electronic transactions are known as:

    A Data Controllers B Certification Service Providers (CSPs) C Internet Service Providers (ISPs) D National Response Centres
65. Question 65 of 100

    Malicious software that hides its presence and provides an attacker with continued privileged access to a system is known as a:

    A Rootkit B Adware C Cookie D Patch
66. Question 66 of 100

    Authentication based on unique physical characteristics, such as fingerprints or facial recognition, is known as:

    A Token-based authentication B Biometric authentication C Knowledge-based authentication D Certificate-based authentication
67. Question 67 of 100

    An attack that exploits a previously unknown software vulnerability, for which no patch yet exists, is called a:

    A Zero-day attack B Brute-force attack C Phishing attack D DDoS attack
68. Question 68 of 100

    The old Telegraph Act, 1885, historically relevant to interception of communications, has in modern Pakistan been substantially supplemented in the surveillance/interception context by which more recent law?

    A The Anti-Terrorism Act, 1997 B The Investigation for Fair Trial Act, 2013 C The Companies Act, 2017 D The Limitation Act, 1908
69. Question 69 of 100

    A system designed to monitor network traffic for suspicious activity and alert administrators is known as an:

    A Intrusion Detection System (IDS) B Encryption Gateway C Data Warehouse D Load Balancer
70. Question 70 of 100

    The fraudulent practice of sending emails that appear to be from reputable sources in order to trick individuals into revealing sensitive information is called:

    A Phishing B Spoofing only C Encryption D Patching
71. Question 71 of 100

    Which of the following is explicitly listed as an objective of the National Cyber Security Policy, 2021?

    A Promoting data governance, protection, and online privacy B Abolishing all internet access in Pakistan C Nationalizing all private telecom companies D Eliminating the use of encryption nationwide
72. Question 72 of 100

    Under general cybersecurity best practice, why is it recommended to enable automatic software updates on devices?

    A To use more mobile data B To ensure known security vulnerabilities are patched promptly, reducing exposure to exploits C To slow down the device intentionally D To disable antivirus software
73. Question 73 of 100

    The practice of applying updates released by software vendors to fix known vulnerabilities is known as:

    A Patch management B Data masking C Load balancing D Session hijacking
74. Question 74 of 100

    Software that secretly monitors a user's activity and gathers information without their consent is called:

    A Spyware B Firewall software C Antivirus software D A patch
75. Question 75 of 100

    A highly targeted phishing attack aimed at a specific individual or organization, often using personalized information, is called:

    A Whaling B Spear phishing C Vishing D Smishing
76. Question 76 of 100

    Encryption that uses the SAME key for both encrypting and decrypting data is known as:

    A Asymmetric encryption B Symmetric encryption C Hashing D Tokenization
77. Question 77 of 100

    Malware that disguises itself as legitimate software to trick users into installing it is known as a:

    A Trojan horse B Worm C Bot D Logic bomb
78. Question 78 of 100

    A malicious program that records a user's keystrokes to steal passwords and sensitive data is known as a:

    A Firewall B Keylogger C Sandbox D Honeypot
79. Question 79 of 100

    Which regulatory body in Pakistan is primarily responsible for licensing telecom operators and Internet Service Providers (ISPs)?

    A State Bank of Pakistan B Pakistan Telecommunication Authority (PTA) C Securities and Exchange Commission of Pakistan D PEMRA
80. Question 80 of 100

    Under Section 7 of the Electronic Transactions Ordinance, 2002, a legal requirement for a signature is satisfied where:

    A A notarized wet-ink signature is used B An electronic signature or advanced electronic signature is applied C A witness is physically present D A biometric scan is conducted by a court official
81. Question 81 of 100

    An attack technique that inserts malicious code into a database query field to manipulate or extract data from a website's database is known as:

    A Cross-Site Scripting (XSS) B SQL injection C Man-in-the-middle attack D DNS spoofing
82. Question 82 of 100

    Phishing conducted via SMS text messages is commonly referred to as:

    A Vishing B Smishing C Whaling D Pharming
83. Question 83 of 100

    The security principle stating that a user should be granted only the minimum access necessary to perform their job is known as the:

    A Principle of maximum access B Principle of least privilege C Principle of open access D Principle of shared credentials
84. Question 84 of 100

    The Personal Data Protection Bill, 2023 proposes the establishment of which regulatory body to oversee data protection compliance?

    A National Commission for Personal Data Protection (NCPDP) B Federal Data Bureau C Cyber Crime Tribunal D National Privacy Court
85. Question 85 of 100

    A security process that requires a user to provide two or more distinct forms of verification before gaining access is known as:

    A Single Sign-On (SSO) B Multi-Factor Authentication (MFA) C Role-based access D Data masking
86. Question 86 of 100

    Which of the following is generally considered a WEAK password practice?

    A Using a long passphrase with mixed characters B Reusing the same simple password across multiple accounts C Enabling two-factor authentication D Using a password manager
87. Question 87 of 100

    Which government body is responsible for coordinating Pakistan's official national-level response to major cybersecurity incidents, established as a formal national CERT in 2024?

    A National CERT (PKCERT) B Ministry of Foreign Affairs C State Bank of Pakistan D Election Commission of Pakistan
88. Question 88 of 100

    The National Cyber Security Policy, 2021 emphasizes establishing protection and information-sharing mechanisms at all levels, commonly organized around which type of response units?

    A Traffic police units B Computer Emergency Response Teams / Security Operations Centres (CERTs/SOCs) C Municipal fire brigades D Customs checkpoints
89. Question 89 of 100

    When a Denial-of-Service attack is launched simultaneously from multiple compromised devices, it is called a:

    A Distributed Denial-of-Service (DDoS) attack B Spear phishing attack C Zero-day attack D Man-in-the-middle attack
90. Question 90 of 100

    In 2024, a new specialized agency was established to replace the FIA's Cyber Crime Wing for investigating cybercrime in Pakistan. What is this agency called?

    A National Cyber Crime Investigation Agency (NCCIA) B National Accountability Bureau (NAB) C National Database and Registration Authority (NADRA) D National Counter Terrorism Authority (NACTA)
91. Question 91 of 100

    An attack technique in which malicious scripts are injected into otherwise trusted websites, later executing in a victim's browser, is known as:

    A SQL injection B Cross-Site Scripting (XSS) C Brute-force attack D Session hijacking
92. Question 92 of 100

    Which Pakistani law governs the regulation of payment systems and electronic fund transfers, including obligations for banks and payment service providers?

    A The Payment Systems and Electronic Fund Transfers Act, 2007 B The Banking Companies Ordinance, 1962 alone C The Negotiable Instruments Act, 1881 alone D The Contract Act, 1872
93. Question 93 of 100

    Which of the following best distinguishes a 'data controller' from a 'data processor' under modern data protection frameworks (as reflected in Pakistan's draft bill)?

    A There is no distinction; the terms are interchangeable B A data controller determines the purpose and means of processing, while a data processor processes data on the controller's behalf C A data processor always owns the data, while a controller does not D Only data processors can be held legally liable
94. Question 94 of 100

    Under the National Cyber Security Policy, 2021, which type of infrastructure receives special mandated protection through national security standards?

    A National Critical Information Infrastructure (CII) B Personal social media accounts C Private residential Wi-Fi networks D Public parks
95. Question 95 of 100

    Which Ministry drafted and finalized the Personal Data Protection Bill, 2023?

    A Ministry of Interior B Ministry of Information Technology and Telecommunication C Ministry of Law and Justice D Ministry of Finance
96. Question 96 of 100

    Which Pakistani authority is primarily responsible for safeguarding the security of citizens' data held in the national identity database (CNIC records)?

    A PEMRA B NADRA (National Database and Registration Authority) C FIA Immigration Wing D Election Commission of Pakistan
97. Question 97 of 100

    Redirecting a website's traffic to a fraudulent, look-alike site (often by corrupting DNS records) is known as:

    A Phishing B Pharming C Vishing D Smishing
98. Question 98 of 100

    Under the Electronic Transactions Ordinance, 2002, which regulatory body was designated to license and regulate Certification Service Providers?

    A State Bank of Pakistan B Pakistan Telecommunication Authority (PTA) C Securities and Exchange Commission of Pakistan D FIA
99. Question 99 of 100

    Small text files stored by a web browser that track user activity and preferences across websites are known as:

    A Cookies B Patches C Firewalls D Certificates
100. Question 100 of 100

     A prolonged, targeted cyberattack in which an intruder gains unauthorized access to a network and remains undetected for an extended period is known as a(n):

     A Advanced Persistent Threat (APT) B Zero-day exploit only C DDoS attack D Logic bomb

You can practise as a guest, but sign in to save your score and track your progress.