Computer Security
Test Bank
Course Introduction
This course introduces the fundamental principles and practices of computer security, covering topics such as threat models, security policies, access control, cryptography, network security, and secure software development. Students will explore system vulnerabilities, common attack vectors, and defense mechanisms used to protect information and resources. Through hands-on exercises and real-world case studies, learners gain practical experience in identifying potential risks, mitigating threats, and implementing robust security solutions in modern computing environments.
Recommended Textbook
Computer Security Principles and Practice 3rd Edition by William Stallings
Available Study Resources on Quizplus
24 Chapters
1076 Verified Questions
1076 Flashcards
Source URL: https://quizplus.com/study-set/3981 Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79973
Sample Questions
Q1) Hardware is the most vulnerable to attack and the least susceptible to automated controls.
A)True
B)False
Answer: True
Q2) The first step in devising security services and mechanisms is to develop a security policy.
A)True
B)False
Answer: True
Q3) The "A" in the CIA triad stands for "authenticity".
A)True
B)False
Answer: False
Q4) The OSI security architecture focuses on security attacks,__________,and services.
Answer: mechanisms
Q5) Release of message contents and traffic analysis are two types of _________ attacks.
Answer: passive
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79962
Sample Questions
Q1) __________ is a block cipher in which the plaintext and ciphertext are integers between 0 and n-1 for some n.
A)DSS
B)RSA
C)SHA
D)AES
Answer: B
Q2) T F 4.The secret key is input to the encryption algorithm.
A)True
B)False
Answer: True
Q3) Cryptanalytic attacks try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
A)True
B)False
Answer: False
Q4) The advantage of a stream cipher is that you can reuse keys.
A)True
B)False
Answer: False
Page 4
To view all questions and flashcards with answers, click on the resource link above.
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79956
Sample Questions
Q1) The __________ step is presenting or generating authentication information that corroborates the binding between the entity and the identifier.
Answer: verification
Q2) __________,in the context of passwords,refers to an adversary's attempt to learn the password by observing the user,finding a written copy of the password,or some similar attack that involves the physical proximity of user and adversary.
Answer: Eavesdropping
Q3) A __________ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.
A)user education
B)reactive password checking
C)proactive password checking
D)computer-generated password
Answer: B
Q4) T F 4.Many users choose a password that is too short or too easy to guess. A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79955
Sample Questions
Q1) In digital identity systems,a __________ functions as a certification program.
Q2) __________ refers to setting a maximum number with respect to roles.
A)Cardinality
B)Prerequisite
C)Exclusive
D)Hierarchy
Q3) Basic access control systems typically define three classes of subject: owner,__________ and world.
Q4) __________ is verification that the credentials of a user or other system entity are valid.
A)Adequacy
B)Authentication
C)Authorization
D)Audit
Q5) A __________ dictates that a user can only be assigned to a particular role if it is already assigned to some other specified role and can be used to structure the implementation of the least privilege concept.
Q6) The three types of attributes in the ABAC model are subject attributes,object attributes,and _________ attributes.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database and Cloud Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79954
Sample Questions
Q1) In a relational database rows are referred to as _________.
A)relations
B)attributes
C)views
D)tuples
Q2) Fixed server roles operate at the level of an individual database.
A)True
B)False
Q3) The database management system makes use of the database description tables to manage the physical database.
A)True
B)False
Q4) A(n)__________ is a structured collection of data stored for use by one or more applications.
A)attribute
B)database
C)tuple
D)inference
Q5) The __________ cloud infrastructure is operated solely for an organization.
Page 7
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79953
Sample Questions
Q1) __________ code refers to programs that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics.
Q2) A program that is covertly inserted into a system with the intent of compromising the integrity or confidentiality of the victim's data is __________.
A)Adobe
B)Animoto
C)malware
D)Prezi
Q3) Many forms of infection can be blocked by denying normal users the right to modify programs on the system.
A)True
B)False
Q4) __________ technology is an anti-virus approach that enables the anti-virus program to easily detect even the most complex polymorphic viruses and other malware,while maintaining fast scanning speeds.
Q5) Sometimes referred to as the "infection vector",the __________ is the means by which a virus spreads or propagates.
Q6) A __________ is when a user views a Web
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79952
Sample Questions
Q1) It is possible to specifically defend against the ______ by using a modified version of the TCP connection handling code.
A)three-way handshake
B)UDP flood
C)SYN spoofing attack
D)flash crowd
Q2) SYN-ACK and ACK packets are transported using IP,which is an unreliable network protocol.
A)True
B)False
Q3) The four lines of defense against DDoS attacks are: attack prevention and preemption,attack detection and filtering,attack source traceback and identification and _______.
Q4) A DoS attack targeting application resources typically aims to overload or crash its network handling software.
A)True
B)False
Q5) The ICMP echo response packets generated in response to a ping flood using randomly spoofed source addresses is known as _______ traffic.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79951
Sample Questions
Q1) _________ are either individuals or members of a larger group of outsider attackers who are motivated by social or political causes.
A)State-sponsored organizations
B)Activists
C)Cyber criminals
D)Others
Q2) ________ are decoy systems that are designed to lure a potential attacker away from critical systems.
Q3) An IDS comprises three logical components: analyzers,user interface and _____.
Q4) The __________ is the human with overall responsibility for setting the security policy of the organization,and,thus,for decisions about deploying and configuring the IDS.
Q5) The primary purpose of an IDS is to detect intrusions,log suspicious events,and send alerts.
A)True
B)False
Q6) The broad classes of intruders are: cyber criminals,state-sponsored organizations,_________ ,and others.
To view all questions and flashcards with answers, click on the resource link above.
Page 10
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79950
Sample Questions
Q1) An important aspect of a distributed firewall configuration is security monitoring.
A)True
B)False
Q2) A ___________ makes use of both signature and anomaly detection techniques to identify attacks.
Q3) A _________ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control.
A)packet filtering firewall
B)distributed firewall
C)personal firewall
D)stateful inspection firewall
Q4) A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.
Q5) A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.
Q6) The ________ IP address is the IP address of the system that originated the IP packet.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79972
Sample Questions
Q1) A buffer overflow error is not likely to lead to eventual program termination.
A)True
B)False
Q2) A buffer _________ is a condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated,overwriting other information.
A)overflow
B)overrun
C)overwrite
D)all of the above
Q3) In 2003 the _________ exploited a buffer overflow in Microsoft SQL Server 2000.
A)Slammer worm
B)Morris Internet Worm
C)Sasser worm
D)Code Red worm
Q4) An essential component of many buffer overflow attacks is the transfer of execution to code supplied by the attacker and often saved in the buffer being overflowed.This code is known as _________ .
Q5) __________ defenses aim to detect and abort attacks in existing programs.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
43 Verified Questions
43 Flashcards
Source URL: https://quizplus.com/quiz/79971
Sample Questions
Q1) In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.
Q2) The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program,service,or function.
Q3) Programmers often make assumptions about the type of inputs a program will receive.
A)True
B)False
Q4) Cross-site scripting attacks attempt to bypass the browser's security checks to gain elevated access privileges to sensitive data belonging to another site.
A)True
B)False
Q5) A difference between defensive programming and normal practices is that everything is assumed.
A)True
B)False
Q6) Program input data may be broadly classified as textual or ______.
Q7) _________ attacks are most commonly seen in scripted Web applications.
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79970
Sample Questions
Q1) Ideally new systems should be constructed on an unprotected network in order to prevent installation restrictions.
A)True
B)False
Q2) Manual analysis of logs is a reliable means of detecting adverse events.
A)True
B)False
Q3) Unix and Linux systems use a ________ which restricts the server's view of the file system to just a specified portion.
Q4) Backup and archive processes are often linked and managed together.
A)True
B)False
Q5) Each layer of code needs appropriate hardening measures in place to provide appropriate security services.
A)True
B)False
Q6) ______ is a reactive control that can only inform you about bad things that have already happened.
Q7) System security begins with the installation of the ________.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79969
Sample Questions
Q1) A multilevel secure system for confidentiality must enforce:
A)no read up
B)ss-property
C)no write down
D)all of the above
Q2) The Common Criteria for Information Technology and Security Evaluation are ISO standards for specifying security requirements and defining evaluation criteria.
A)True
B)False
Q3) _________ rules are built-in system security mechanisms that achieve the objectives of the certification rules.
Q4) One way to secure against Trojan horse attacks is the use of a secure,trusted operating system.
A)True
B)False
Q5) The __________ is a controlling element in the hardware and operating system of a computer that regulates the access of subjects to objects on the basis of security parameters of the subject and object.
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79968
Sample Questions
Q1) IT security management functions include:
A)determining organizational IT security objectives,strategies,and policies
B)detecting and reacting to incidents
C)specifying appropriate safeguards
D)all of the above
Q2) The aim of the _________ process is to provide management with the information necessary for them to make reasonable decisions on where available resources will be deployed.
Q3) The ________ has revised and consolidated a number of national and international standards into a consensus of best practice.
A)ISO
B)CSI
C)VSB
D)DBI
Q4) Establishing security policy,objectives,processes and procedures is part of the ______ step.
A)plan
B)check
C)act
D)none of the above
Page 16
To view all questions and flashcards with answers, click on the resource link above.
Chapter 15: It Security Controls,plans,and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79967
Sample Questions
Q1) The objective of the ________ control category is to avoid breaches of any law,statutory,regulatory,or contractual obligations,and of any security requirements.
A)access
B)asset management
C)compliance
D)business continuity management
Q2) An IT security plan should include details of _________.
A)risks
B)recommended controls
C)responsible personnel
D)all of the above
Q3) The implementation process is typically monitored by the organizational ______.
A)security officer
B)general counsel
C)technology officer
D)human resources
Q4) Controls can be classified as belonging to one of the following classes: management controls,operational controls,technical controls,detection and recovery controls,preventative controls,and _______ controls.
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79966
Sample Questions
Q1) A(n)________ is a battery backup unit that can maintain power to processors,monitors,and other equipment and can also function as a surge protector,power noise filter,and an automatic shutdown device.
Q2) If a computer's temperature gets too cold the system can undergo thermal shock when it is turned on.
A)True
B)False
Q3) A prevalent concern that is often overlooked is ________.
A)overvoltage
B)undervoltage
C)dust
D)noise
Q4) Physical access control should address not just computers and other IS equipment but also locations of wiring used to connect systems,equipment and distribution systems,telephone and communications lines,backup media,and documents.
A)True
B)False
Q5) _______ threats encompass threats related to electrical power and electromagnetic emission.
18
To view all questions and flashcards with answers, click on the resource link above.
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79965
Sample Questions
Q1) Programmers,developers,and system maintainers require less advanced security training than other employees.
A)True
B)False
Q2) Network and host __________ monitor and analyze network and host activity and usually compare this information with a collection of attack signatures to identify potential security incidents.
Q3) Security basics and literacy is required for those employees,including contractor employees,who are involved in any way with IT systems.
A)True
B)False
Q4) ___________ scan critical system files,directories,and services to ensure they have not been changed without proper authorization.
A)Intrusion prevention systems
B)System integrity verification tools
C)Log analysis tools
D)Network and host intrusion detection systems
Q5) The principles that should be followed for personnel security are: limited reliance on key employees,separation of duties,and _______.
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79964
Sample Questions
Q1) Thresholding is a form of baseline analysis.
A)True
B)False
Q2) The first order of business in security audit trail design is the selection of data items to capture.
A)True
B)False
Q3) SIEM software has two general configuration approaches: agentless and ______.
Q4) A _________is a chronological record of system activities that is sufficient to enable the reconstruction and examination of the sequence of environments and activities surrounding or leading to an operation,procedure,or event in a security-relevant transaction from inception to final results.
Q5) Applications,especially applications with a certain level of privilege, present security problems that may not be captured by system-level or user-level auditing data.
A)True
B)False
Q6) RFC 2196 (Site Security Handbook)lists three alternatives for storing audit records: read/write file on a host,write-once/read-many device,and ______.
Page 20
To view all questions and flashcards with answers, click on the resource link above.
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79963
Sample Questions
Q1) The relative lack of success in bringing cybercriminals to justice has led to an increase in their numbers,boldness,and the global scale of their operations.
A)True
B)False
Q2) ________ ensures that a user may make multiple uses of resources or services without others being able to link these uses together.
A)Anonymity
B)Pseudonymity
C)Unobservability
D)Unlinkability
Q3) A servicemark is the same as a trademark except that it identifies and distinguishes the source of a service rather than a product.
A)True
B)False
Q4) ________ rights may be used to prevent others from using a confusingly similar mark,but not to prevent others from making the same goods or from selling the same goods or services under a clearly different mark.
Q5) The three types of patents are: utility patents,design patents,and ________.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79961
Sample Questions
Q1) For stream-oriented transmission over noisy channel you would typically use _______ mode.
A)ECB
B)CTR
C)OFB
D)CBC
Q2) AES uses a Feistel structure.
A)True
B)False
Q3) For general-purpose stream-oriented transmission you would typically use _______ mode.
A)CTR
B)CFB
C)ECB
D)CBC
Q4) Symmetric encryption is also referred to as secret-key or single-key encryption.
A)True
B)False
Q5) The three most important symmetric block ciphers are: 3DES,AES,and _____.
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79960
Sample Questions
Q1) The Secure Hash Algorithm (SHA)was developed by the _________ and published as a federal information processing standard (FIPS 180)in 1993.
Q2) SHA-1 produces a hash value of __________ bits.
A)256
B)160
C)384
D)180
Q3) __________ are alarming for two reasons: they come from a completely unexpected direction and they are a ciphertext-only attack.
Q4) ___________ was the first published public-key algorithm.
A)NIST
B)Diffie-Hellman
C)RC4
D)RSA
Q5) A ________ attack involves trying all possible private keys.
A)mathematical
B)timing
C)brute-force
D)chosen ciphertext
Page 23
To view all questions and flashcards with answers, click on the resource link above.
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79959
Sample Questions
Q1) In the case of ________ only the digital signature is encoded using base64.
A)enveloped data
B)signed and enveloped data
C)signed data
D)clear-signed data
Q2) The default algorithms used for signing S/MIME messages are SHA-1 and the _________.
Q3) A signed data message can only be viewed by a recipient with __________ capability.
Q4) Search engines support HTTPS.
A)True
B)False
Q5) MIME is an extension to the old RFC 822 specification of an Internet mail format.
A)True
B)False
Q6) ________ is a security enhancement to the MIME Internet e-mail format standard,based on technology from RSA Data Security.
Q7) The SSL record protocol provides two services for SSL connection: message integrity and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 24
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79958
Sample Questions
Q1) A principal element of an identity management system is _______.
A)workflow automation
B)delegated administration
C)authentication
D)all of the above
Q2) X.509 provides a format for use in revoking a key before it expires.
A)True
B)False
Q3) _______ is an XML-based language for the exchange of security information between online business partners.
Q4) In Kerberos,the ___________ decrypts the ticket and authenticator,verifies the request,and creates ticket for requested server.
Q5) The _______ consists of two dates: the first and last on which the certificate is valid.
A)version
B)period of validity
C)extension
D)unique identifier
Q6) In a generic identity management architecture a ________ is an identity holder.
Page 25
To view all questions and flashcards with answers, click on the resource link above.
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79957
Sample Questions
Q1) Two types of countermeasures are appropriate to deal with eavesdropping: signal-hiding techniques and ____________.
Q2) The transmission medium carries the radio waves for data transfer.
A)True
B)False
Q3) The wireless environment lends itself to a ______ attack because it is so easy for the attacker to direct multiple wireless messages at the target.
A)DoS
B)man-in-the-middle
C)network injection
D)identity theft
Q4) CRC is an error detecting code.
A)True
B)False
Q5) Like TKIP,CCMP provides two services: message integrity and ________.
Q6) A ____________ attack involves persuading a user and an access point to believe that they are talking to each other when in fact the communication is going through an intermediate attacking device.
Q7) At the top level of the group key hierarchy is the ___________.
26
To view all questions and flashcards with answers, click on the resource link above.