Computer Security
Exam Answer Key
Course Introduction
This course provides a comprehensive introduction to the fundamental principles and practices of computer security. Students will explore critical topics such as cryptography, network security, authentication, access control, malware, software vulnerabilities, and security policies. Emphasis is placed on understanding the technical and human factors that influence system security, assessing threats and vulnerabilities, and implementing effective countermeasures to protect information assets. Real-world case studies and hands-on activities are integrated to reinforce concepts and develop practical skills essential for securing modern computer systems.
Recommended Textbook
Computer Security Principles and Practice 2nd Edition by William Stallings
Available Study Resources on Quizplus
24 Chapters
1078 Verified Questions
1078 Flashcards
Source URL: https://quizplus.com/study-set/3971
Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79799
Sample Questions
Q1) An assault on system security that derives from an intelligent act that is a deliberate attempt to evade security services and violate the security policy of a system is a(n)__________.
A)risk
B)attack
C)asset
D)vulnerability
Answer: B
Q2) The "A" in the CIA triad stands for "authenticity".
A)True
B)False
Answer: False
Q3) Security implementation involves four complementary courses of action: prevention,detection,response,and _________.
Answer: recovery
Q4) Hardware is the most vulnerable to attack and the least susceptible to automated controls.
A)True
B)False
Answer: True
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79788
Sample Questions
Q1) A __________ is created by using a secure hash function to generate a hash value for a message and then encrypting the hash code with a private key.
A)digital signature
B)keystream
C)one way hash function
D)secret key
Answer: A
Q2) Triple DES takes a plaintext block of 64 bits and a key of 56 bits to produce a ciphertext block of 64 bits.
A)True
B)False
Answer: False
Q3) Also referred to as single-key encryption,the universal technique for providing confidentiality for transmitted or stored data is __________ .
Answer: symmetric encryption
Q4) Public-key algorithms are based on simple operations on bit patterns.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79782
Sample Questions
Q1) The __________ is the pattern formed by veins beneath the retinal surface. Answer: retinal pattern
Q2) The technique for developing an effective and efficient proactive password checker based on rejecting words on a list is based on the use of a __________ filter.
Answer: Bloom
Q3) Memory cards store and process data.
A)True
B)False
Answer: False
Q4) With the __________ strategy a user is allowed to select their own password,but the system checks to see if the password is allowable.
Answer: proactive password checking
Q5) A __________ is an individual to whom a debit card is issued.
Answer: cardholder
Q6) A __________ is a separate file from the user IDs where hashed passwords are kept.
Answer: shadow password file
Q7) A host generated random number is often called a __________.
Answer: nonce
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79781
Sample Questions
Q1) __________ is verification that the credentials of a user or other system entity are valid.
A)Adequacy
B)Authentication
C)Authorization
D)Audit
Q2) An access right describes the way in which a subject may access an object.
A)True
B)False
Q3) __________ is based on the roles the users assume in a system rather than the user's identity.
A)DAC
B)RBAC
C)MAC
D)URAC
Q4) A user may belong to multiple groups.
A)True
B)False
Q5) The __________ user ID is exempt from the usual file access control constraints and has system wide access.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79780
Sample Questions
Q1) __________ is an organization that receives the encrypted data from a data owner and makes them available for distribution to clients.
A)User
B)Client
C)Data owner
D)Server
Q2) The basic building block of a __________ is a table of data,consisting of rows and columns,similar to a spreadsheet.
A)relational database
B)query set
C)DBMS
D)perturbation
Q3) To create a relationship between two tables,the attributes that define the primary key in one table must appear as attributes in another table,where they are referred to as a foreign key.
A)True
B)False
Q4) The __________ is a human entity that presents requests (queries)to the system.
Q5) In a relational database columns are referred to as _________.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79779
Sample Questions
Q1) The __________ is when the virus function is performed.
A)dormant phase
B)propagation phase
C)triggering phase
D)execution phase
Q2) A __________ is when a user views a Web page controlled by the attacker that contains a code that exploits the browser bug and downloads and installs malware on the system without the user's knowledge or consent.
Q3) Computer viruses first appeared in the early __________.
A)1960s
B)1970s
C)1980s
D)1990s
Q4) A computer __________ is a piece of software that can "infect" other programs or any type of executable content and tries to replicate itself.
Q5) A __________ uses multiple methods of infection or propagation to maximize the speed of contagion and the severity of the attack.
Q6) A __________ is a collection of bots capable of acting in a coordinated manner.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79778
Sample Questions
Q1) ______ attacks are a variant of reflector attacks and also involve sending a packet with a spoofed source address for the target system to intermediaries.
Q2) Bots starting from a given HTTP link and then following all links on the provided Web site in a recursive way is called _______.
A)trailing
B)spidering
C)spoofing
D)crowding
Q3) The ______ attacks the ability of a network server to respond to TCP connection requests by overflowing the tables used to manage such connections.
A)DNS amplification attack
B)SYN spoofing attack
C)basic flooding attack
D)poison packet attack
Q4) If an organization is dependent on network services it should consider mirroring and ________ these servers over multiple sites with multiple network connections.
Q5) Requests and _______ are the two different types of SIP messages.
To view all questions and flashcards with answers, click on the resource link above.
9
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79777
Sample Questions
Q1) The masquerader is most likely an insider.
A)True
B)False
Q2) A _________ is a security event that constitutes a security incident in which an intruder gains access to a system without having authorization to do so.
A)intrusion detection
B)IDS
C)criminal enterprise
D)security intrusion
Q3) The functional components of an _________ are: data source,sensor,analyzer,administration,manager,and operator.
Q4) A ________ monitors network traffic for particular network segments or devices and analyzes network,transport,and application protocols to identify suspicious activity.
A)host-based IDS
B)security intrusion
C)network-based IDS
D)intrusion detection
Q5) An IDS comprises three logical components: analyzers,user interface and _____.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79776
Sample Questions
Q1) A packet filtering firewall is typically configured to filter packets going in both directions.
A)True
B)False
Q2) A DMZ is one of the internal firewalls protecting the bulk of the enterprise network.
A)True
B)False
Q3) The primary role of the personal firewall is to deny unauthorized remote access to the computer.
A)True
B)False
Q4) A ___________ makes use of both signature and anomaly detection techniques to identify attacks.
Q5) __________ anomaly watches for unusual traffic activities,such as a flood of UDP packets or a new service appearing on the network.
Q6) The firewall can protect against attacks that bypass the firewall. A)True
B)False
Q7) Snort Inline adds three new rule types: drop,reject,and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79798
Sample Questions
Q1) The only consequence of a buffer overflow attack is the possible corruption of data used by the program.
A)True
B)False
Q2) C's designers placed much more emphasis on space efficiency and performance considerations than on type safety.
A)True
B)False
Q3) A successful buffer overflow attack results in the loss of the function or service the attacked program provided.
A)True
B)False
Q4) The buffer overflow type of attack is one of the least commonly seen attacks.
A)True
B)False
Q5) ________ attacks can occur in a binary buffer copy when the programmer has included code to check the number of bytes being transferred,but due to a coding error,allows just one more byte to be copied than there is space available.
Page 12
Q6) ______ defenses aim to harden programs to resist attacks in new programs.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79797
Sample Questions
Q1) Defensive programming requires a changed mindset to traditional programming practices.
A)True
B)False
Q2) Software security is closely related to software quality and reliability.
A)True
B)False
Q3) A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.
A)fuzzing
B)deadlock
C)memory injection
D)memory leak
Q4) A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.
Q5) The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.
Q6) Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79796
Sample Questions
Q1) ______ virtualization systems are typically seen in servers,with the goal of improving the execution efficiency of the hardware.
Q2) ______ is a reactive control that can only inform you about bad things that have already happened.
Q3) Cryptographic file systems are another use of _______.
A)encryption
B)testing
C)virtualizing
D)acceleration
Q4) The ______ process retains copies of data over extended periods of time in order to meet legal and operational requirements.
A)archive
B)virtualization
C)patching
D)backup
Q5) ______ virtualization systems are more common in clients,where they run along side other applications on the host OS,and are used to support applications for alternate operating system versions or types.
Q6) System security begins with the installation of the ________.
Page 14
To view all questions and flashcards with answers, click on the resource link above.
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79795
Sample Questions
Q1) The _______ is a hardware module that is at the heart of a hardware/software approach to trusted computing.
A)BLP
B)TC
C)CC
D)TPM
Q2) A subject can exercise only accesses for which it has the necessary authorization and which satisfy the MAC rules.
A)True
B)False
Q3) The Common Criteria for Information Technology and Security Evaluation are ISO standards for specifying security requirements and defining evaluation criteria.
A)True
B)False
Q4) The _________ model is intended to deal with the case in which there is data that must be visible to users at multiple or all security levels but should only be modified in controlled ways by authorized agents.
Q5) An object is said to have a security ________ of a given level.
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79794
Sample Questions
Q1) _________ include management,operational,and technical processes and procedures that act to reduce the exposure of the organization to some risks by reducing the ability of a threat source to exploit some vulnerabilities.
A)Security controls
B)Risk appetite
C)Risk controls
D)None of the above
Q2) Organizational security objectives identify what IT security outcomes should be achieved.
A)True
B)False
Q3) The four approaches to identifying and mitigating risks to an organization's IT infrastructure are: baseline approach,detailed risk analysis,combined approach,and __________ approach.
Q4) The use of the _________ approach would generally be recommended for small to medium-sized organizations where the IT systems are not necessarily essential to meeting the organization's business objectives and additional expenditure on risk analysis cannot be justified.
Q5) _________ is sharing responsibility for the risk with a third party.
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: It Security Controls, plans, and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79793
Sample Questions
Q1) Identification and authentication is part of the _______ class of security controls.
A)technical
B)operational
C)management
D)none of the above
Q2) _______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.
Q3) Water damage protection is included in security controls.
A)True
B)False
Q4) _________ is a formal process to ensure that critical assets are sufficiently protected in a cost-effective manner.
A)Configuration management control
B)IT security management
C)Detection and recovery control
D)Security compliance
Q5) ______ checking is an audit process to review the organization's security processes.
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79792
Sample Questions
Q1) Eavesdropping and wiretapping fall into the ________ category.
A)theft
B)vandalism
C)misuse
D)unauthorized physical access
Q2) Relative humidity should be maintained between ________ to avoid the threats from both low and high humidity.
A)20% and 80%
B)40% and 60%
C)50% and 50%
D)30% and 70%
Q3) Power utility problems can be grouped into three categories: undervoltage,overvoltage,and ________.
Q4) A prevalent concern that is often overlooked is ________.
A)overvoltage
B)undervoltage
C)dust
D)noise
Q5) _______ threats encompass threats related to electrical power and electromagnetic emission.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79791
Sample Questions
Q1) Programmers,developers,and system maintainers require less advanced security training than other employees.
A)True B)False
Q2) Having all of the security functions and audit responsibilities reside in the same person is a wise decision on the part of the organization.
A)True
B)False
Q3) An employer cannot be held liable for negligent hiring if an employee causes harm to a third party while acting as an employee.
A)True
B)False
Q4) The goal of the _______ function is to ensure that all information destined for the incident handling service is channeled through a single focal point regardless of the method by which it arrives for appropriate redistribution and handling within the service.
Q5) In general,a ________ program seeks to inform and focus an employee's attention on issues related to security within the organization.
Q6) The group of users,sites,networks,or organizations served by the CSIRT is a _______.
Page 19
To view all questions and flashcards with answers, click on the resource link above.
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79790
Sample Questions
Q1) Security auditing can:
A)provide data that can be used to define anomalous behavior
B)maintain a record useful in computer forensics
C)generate data that can be used in after-the-fact analysis of an attack
D)all of the above
Q2) The security administrator must define the set of events that are subject to audit.
A)True
B)False
Q3) SIEM software has two general configuration approaches: agentless and ______.
Q4) ________ audit trail traces the activity of individual users over time and can be used to hold a user accountable for his or her actions.
Q5) Protection of the audit trail involves both integrity and confidentiality.
A)True
B)False
Q6) ______ is the identification of data that exceed a particular baseline value.
A)Anomaly detection
B)Real-time analysis
C)Thresholding
D)All of the above
20
To view all questions and flashcards with answers, click on the resource link above.
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79789
Sample Questions
Q1) _______ or cybercrime,is a term used broadly to describe criminal activity in which computers or computer networks are a tool,a target,or a place of criminal activity.
Q2) The successful use of law enforcement depends much more on technical skills than on people skills.
A)True
B)False
Q3) A ________ provides distribution channels,such as an online shop or a Web retailer.
A)content provider
B)distributor
C)consumer
D)clearinghouse
Q4) _______ refers to a system of moral principles that relates to the benefits and harms of particular actions,and to the rightness and wrongness of motives and ends of those actions.
Q5) The 2001 _________ is the first international treaty seeking to address Internet crimes by harmonizing national laws,improving investigative techniques,and increasing cooperation among nations.
Q6) The three types of patents are: utility patents,design patents,and ________.
Page 21
To view all questions and flashcards with answers, click on the resource link above.
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79787
Sample Questions
Q1) If both sender and receiver use the same key the system is referred to as asymmetric.
A)True
B)False
Q2) If the analyst is able to get the source system to insert into the system a message chosen by the analyst,then a ________ attack is possible.
A)known-plaintext
B)chosen-plaintext
C)chosen ciphertext
D)chosen text
Q3) An encryption scheme is _________ if the cost of breaking the cipher exceeds the value of the encrypted information and/or the time required to break the cipher exceeds the useful lifetime of the information.
Q4) A symmetric encryption scheme has five ingredients: plaintext,encryption algorithm,ciphertext,decryption algorithm and _________.
Q5) In using encryption,we need to decide what to encrypt and where the encryption gear should be located.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79786
Sample Questions
Q1) Perhaps the most widely used public-key algorithms are _________ and Diffie-Hellman.
Q2) The key exchange protocol is vulnerable to a man-in-the-middle attack because it does not authenticate the participants.
A)True
B)False
Q3) The one-way hash function is important not only in message authentication but also in digital signatures.
A)True
B)False
Q4) One of the simplest hash functions is the ________ of every block.
Q5) The __________ uses an algorithm that is designed to provide only the digital signature function and cannot be used for encryption or key exchange.
A)ECC
B)RSA
C)DSS
D)XOR
Q6) Timing attacks are only applicable to RSA.
A)True
B)False Page 23
To view all questions and flashcards with answers, click on the resource link above.
Page 24
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79785
Sample Questions
Q1) The _________ is used to convey SSL-related alerts to the peer entity.
Q2) _________ is a specification for cryptographically signing e-mail messages,permitting a signing domain to claim responsibility for a message in the mail stream.
Q3) Recipients without S/MIME capability can view the message content, although they cannot verify the signature.
A)True
B)False
Q4) If encryption is used alone,_______ is used to convert the ciphertext to ASCII format.
Q5) To protect the data,either the signature alone or the signature plus the message are mapped into printable ASCII characters using a scheme known as ________ or base64mapping.
A)radix-64
B)ASCII-64
C)ESP-64
D)safe mapping
Q6) A security association is uniquely identified by three parameters: security parameter index,protocol identifier,and ________________.
Page 25
To view all questions and flashcards with answers, click on the resource link above.
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79784
Sample Questions
Q1) _______ is the process whereby a user first makes itself known to a CA prior to that CA issuing a certificate or certificates for that user.
A)Authorization
B)Registration
C)Certification
D)Initialization
Q2) An integer value unique within the issuing CA that is unambiguously associated with the certificate is the ________.
A)issuer name
B)subject's public-key information
C)issuer unique identifier
D)serial number
Q3) The ticket-granting ticket is encrypted with a secret key known only to the AS and the TGS.
A)True
B)False
Q4) In Kerberos,the ___________ decrypts the ticket and authenticator,verifies the request,and creates ticket for requested server.
Q5) In a generic identity management architecture a ________ is an identity holder.
To view all questions and flashcards with answers, click on the resource link above. Page 26
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79783
Sample Questions
Q1) The purpose of the discovery phase is for an STA and an AP to recognize each other,agree on a set of security capabilities,and establish an association for future communication using those security capabilities.
A)True
B)False
Q2) The principal threats to wireless transmission are disruption,_____________,and altering or inserting messages.
Q3) A __________ attack occurs when an attacker continually bombards a wireless access point or some other accessible wireless port with various protocol messages designed to consume system resources.
Q4) The primary purpose of the MAC layer is to transfer MSDUs between MAC entities.
A)True
B)False
Q5) There are two types of keys: ________ used for communication between a STA and an AP and group keys used for multicast communication.
Q6) The field following the MSDU field is referred to as the ___________.
Q7) Like TKIP,CCMP provides two services: message integrity and ________.
To view all questions and flashcards with answers, click on the resource link above. Page 27