Information Security
Chapter Exam Questions
Course Introduction
Information Security is a comprehensive course that introduces students to the fundamental principles, tools, and practices essential for protecting digital information and systems. The course covers key topics such as risk assessment, cryptography, network and system security, access control models, security policies, and incident response. Students will explore various types of security threats and vulnerabilities, as well as defensive strategies and best practices to safeguard data integrity, confidentiality, and availability. Through practical assignments and case studies, learners gain hands-on experience in identifying risks, implementing security measures, and understanding the legal and ethical considerations in the field of information security.
Recommended Textbook
Computer Security Principles and Practice 2nd Edition by William Stallings
Available Study Resources on Quizplus 24 Chapters
1078 Verified Questions
1078 Flashcards
Source URL: https://quizplus.com/study-set/3971
Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79799
Sample Questions
Q1) Masquerade,falsification,and repudiation are threat actions that cause __________ threat consequences.
A)unauthorized disclosure
B)disruption
C)deception
D)usurpation
Answer: C
Q2) A(n)_________ is a threat that is carried out and,if successful,leads to an undesirable violation of security,or threat consequence.
Answer: attack
Q3) A(n)_________ is any means taken to deal with a security attack.
Answer: countermeasure
Q4) A __________ is data appended to,or a cryptographic transformation of,a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery.
Answer: digital signature
Q5) The assets of a computer system can be categorized as hardware,software,communication lines and networks,and _________.
Answer: data
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79788
Sample Questions
Q1) A __________ is created by using a secure hash function to generate a hash value for a message and then encrypting the hash code with a private key.
A)digital signature
B)keystream
C)one way hash function
D)secret key
Answer: A
Q2) The original message or data that is fed into the algorithm is __________.
A)encryption algorithm
B)secret key
C)decryption algorithm
D)plaintext
Answer: D
Q3) Public-key encryption was first publicly proposed by __________ in 1976.
Answer: Diffie and Hellman
Q4) An important element in many computer security services and applications is the use of cryptographic algorithms.
A)True
B)False
Answer: True
Page 4
To view all questions and flashcards with answers, click on the resource link above.
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79782
Sample Questions
Q1) Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the ___________.
A)identification step
B)authentication step
C)verification step
D)corroboration step
Answer: C
Q2) A __________ authentication system attempts to authenticate an individual based on his or her unique physical characteristics.
Answer: biometric
Q3) User authentication is the basis for most types of access control and for user accountability.
A)True
B)False
Answer: True
Q4) An authentication process consists of the _________ step and the verification step.
Answer: identification
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79781
Sample Questions
Q1) The final permission bit is the _________ bit.
A)superuser
B)kernel
C)set user
D)sticky
Q2) An auditing function monitors and keeps a record of user accesses to system resources.
A)True
B)False
Q3) Role hierarchies make use of the concept of __________ to enable one role to implicitly include access rights associated with a subordinate role.
Q4) A __________ is an entity capable of accessing objects.
A)group
B)object
C)subject
D)owner
Q5) __________ functions provide the capability to create,delete,and maintain RBAC elements and relations.
Q6) The basic elements of access control are: subject,__________,and access right.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79780
Sample Questions
Q1) __________ is an organization that receives the encrypted data from a data owner and makes them available for distribution to clients.
A)User
B)Client
C)Data owner
D)Server
Q2) SQL Server allows users to create roles that can then be assigned access rights to portions of the database.
A)True
B)False
Q3) In a discretionary access control environment database users are classified into three broad categories: administrator,end user other than application owner,and
Q4) A _________ is defined to be a portion of a row used to uniquely identify a row in a table.
A)foreign key
B)query
C)primary key
D)data perturbation
Q5) The __________ is a human entity that presents requests (queries)to the system.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79779
Sample Questions
Q1) A program that is covertly inserted into a system with the intent of compromising the integrity or confidentiality of the victim's data is __________.
A)Adobe
B)Animoto
C)malware
D)Prezi
Q2) A __________ uses multiple methods of infection or propagation to maximize the speed of contagion and the severity of the attack.
Q3) __________ is the first function in the propagation phase for a network worm.
A)Propagating
B)Fingerprinting
C)Keylogging
D)Spear phishing
Q4) The term "computer virus" is attributed to __________.
A)Herman Hollerith
B)Fred Cohen
C)Charles Babbage
D)Albert Einstein
Q5) A __________ is a collection of bots capable of acting in a coordinated manner.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79778
Sample Questions
Q1) The best defense against being an unwitting participant in a DDoS attack is to prevent your systems from being compromised.
A)True
B)False
Q2) To respond successfully to a DoS attack a good ______ plan is needed that includes details of how to contact technical personal for your ISP(s).
Q3) The standard protocol used for call setup in VoIP is the ________ Protocol.
Q4) ______ attacks are a variant of reflector attacks and also involve sending a packet with a spoofed source address for the target system to intermediaries.
Q5) A _____ is an action that prevents or impairs the authorized use of networks,systems,or applications by exhausting resources such as central processing units,memory,bandwidth,and disk space.
Q6) A DoS attack targeting application resources typically aims to overload or crash its network handling software.
A)True B)False
Q7) A ______ is a graphical puzzle used to attempt to identify legitimate human initiated interactions.
Page 9
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79777
Sample Questions
Q1) Those who hack into computers do so for the thrill of it or for status.
A)True
B)False
Q2) Intrusion detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified.
A)True
B)False
Q3) The objective of the intruder is to gain access to a system or to increase the range of privileges accessible on a system.
A)True
B)False
Q4) The _________ (RFC 4766)document defines requirements for the Intrusion Detection Message Exchange Format (IDMEF).
Q5) A ________ model is used to establish transition probabilities among various states.
A)multivariate model
B)Markov process
C)time series
D)operational model
Q6) The three classes of intruders are masquerader,clandestine user and _________.
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79776
Sample Questions
Q1) An important aspect of a distributed firewall configuration is security monitoring.
A)True
B)False
Q2) A ________ uses encryption and authentication in the lower protocol layers to provide a secure connection through an otherwise insecure network,typically the Internet.
Q3) ________ control controls access to a service according to which user is attempting to access it.
A)User
B)Direction
C)Service
D)Behavior
Q4) A logical means of implementing an IPSec is in a firewall.
A)True
B)False
Q5) One disadvantage of a packet filtering firewall is its simplicity.
A)True
B)False
Q6) Snort Inline adds three new rule types: drop,reject,and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79798
Sample Questions
Q1) The function of the _______ was to transfer control to a user command line interpreter that gave access to any program available on the system with the privileges of the attacked program.
Q2) One of the restrictions on the content of shellcode is that it has to be _______,which means that it cannot contain any absolute address referring to itself.
Q3) The first widely used occurrence of the buffer overflow attack was the _______.
A)Code Red Worm
B)Morris Internet Worm
C)Sasser Worm
D)Slammer Worm
Q4) A runtime technique that can be used is to place ________ between critical regions of memory in a processes address space.
A)guard pages
B)library functions
C)shellcodes
D)MMUs
Q5) Shellcode is not specific to a particular processor architecture.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79797
Sample Questions
Q1) To counter XSS attacks a defensive programmer needs to explicitly identify any assumptions as to the form of input and to verify that any input data conform to those assumptions before any use of the data.
A)True
B)False
Q2) Without suitable synchronization of accesses it is possible that values may be corrupted,or changes lost,due to over-lapping access,use, and replacement of shared values.
A)True
B)False
Q3) In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.
Q4) Key issues from a software security perspective are whether the implemented algorithm correctly solves the specified problem,whether the machine instructions executed correctly represent the high level algorithm specification,and whether the manipulation of data values in variables is valid and meaningful.
A)True
B)False
Q5) Program input data may be broadly classified as textual or ______.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79796
Sample Questions
Q1) Each layer of code needs appropriate hardening measures in place to provide appropriate security services.
A)True
B)False
Q2) The range of logging data acquired should be determined _______.
A)during security testing
B)as a final step
C)after monitoring average data flow volume
D)during the system planning stage
Q3) Cryptographic file systems are another use of _______.
A)encryption
B)testing
C)virtualizing
D)acceleration
Q4) Manual analysis of logs is a reliable means of detecting adverse events.
A)True
B)False
Q5) Unix and Linux systems grant access permissions for each resource using the ______ command.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79795
Sample Questions
Q1) Inserting a new row at a lower level without modifying the existing row at the higher level is known as ________ .
A)polyinstantiation
B)ds-property
C)trust
D)MAC
Q2) The addition of multilevel security to a database system does not increase the complexity of the access control function.
A)True
B)False
Q3) A _______ is a collection of requirements that share a common focus or intent.
A)trust
B)family
C)class
D)component
Q4) In the United States the ______ and the NSA jointly operate the Common Criteria Evaluation and Validation Scheme.
Q5) Trusted computing provides three basic services: authenticated boot,certification, and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79794
Sample Questions
Q1) _________ is a process used to achieve and maintain appropriate levels of confidentiality,integrity,availability,accountability,authenticity,and reliability.
Q2) IT security management functions include:
A)determining organizational IT security objectives,strategies,and policies
B)detecting and reacting to incidents
C)specifying appropriate safeguards
D)all of the above
Q3) The intent of the ________ is to provide a clear overview of how an organization's IT infrastructure supports its overall business objectives.
A)risk register
B)corporate security policy
C)vulnerability source
D)threat assessment
Q4) Not proceeding with the activity or system that creates the risk is _________.
Q5) The use of the _________ approach would generally be recommended for small to medium-sized organizations where the IT systems are not necessarily essential to meeting the organization's business objectives and additional expenditure on risk analysis cannot be justified.
To view all questions and flashcards with answers, click on the resource link above.
Page 16
Chapter 15: It Security Controls, plans, and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79793
Sample Questions
Q1) It is likely that the organization will not have the resources to implement all the recommended controls.
A)True
B)False
Q2) The recommended controls need to be compatible with the organization's systems and policies.
A)True
B)False
Q3) The _________ controls focus on the response to a security breach,by warning of violations or attempted violations of security policies or the identified exploit of a vulnerability and by providing means to restore the resulting lost computing resources.
Q4) _______ management is concerned with specifically keeping track of the configuration of each system in use and the changes made to each.
Q5) ________ is a means of managing risk,including policies,procedures,guidelines,practices,or organizational structures.
Q6) _________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.
To view all questions and flashcards with answers, click on the resource link above.
Page 17
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79792
Sample Questions
Q1) A restricted area within close proximity of a security interest has a classification of
A)exclusion
B)controlled
C)limited
D)unrestricted
Q2) The optimal temperature for computer systems is between 10 and 32 degrees Fahrenheit.
A)True
B)False
Q3) Physical security must also prevent any type of physical access or intrusion that can compromise logical security.
A)True
B)False
Q4) _______ threats encompass threats related to electrical power and electromagnetic emission.
Q5) ______ authentication is implemented by using a fingerprint or iris data object sent from the PIV card to the PACS.
Q6) The most essential element of recovery from physical security breaches is ____.
Page 18
To view all questions and flashcards with answers, click on the resource link above.
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79791
Sample Questions
Q1) In general,a ________ program seeks to inform and focus an employee's attention on issues related to security within the organization.
Q2) Any action that threatens one or more of the classic security services of confidentiality,integrity,availability,accountability,authenticity,and reliability in a system constitutes a(n)________.
Q3) Awareness is used to explain the rules of behavior for using an agency's information systems and information and establishes a level of expectation on the acceptable use of the information and information systems.
A)True
B)False
Q4) To emphasize the importance of security awareness,an organization should have a security awareness policy document that is provided to all employees. A)True
B)False
Q5) A(n)________ is any file or object found on a system that might be involved in probing or attacking systems and networks or that is being used to defeat security measures.
To view all questions and flashcards with answers, click on the resource link above.
19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79790
Sample Questions
Q1) RFC 2196 (Site Security Handbook)lists three alternatives for storing audit records: read/write file on a host,write-once/read-many device,and ______.
Q2) ______ software is a centralized logging software package similar to,but much more complex than,syslog.
A)NetScan
B)McAfee
C)IPConfig
D)SIEM
Q3) _________ identifies the level of auditing,enumerates the types of auditable events,and identifies the minimum set of audit-related information provided.
A)Event selection
B)Data generation
C)Automatic response
D)Audit analysis
Q4) Audit trails are different from audit logs.
A)True
B)False
Q5) ______ is the process of defining normal versus unusual events and patterns.
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79789
Sample Questions
Q1) The 2001 _________ is the first international treaty seeking to address Internet crimes by harmonizing national laws,improving investigative techniques,and increasing cooperation among nations.
Q2) ________ is a function that removes specific identifying information from query results,such as last name and telephone number,but creates some sort of unique identifier so that analysts can detect connections between queries.
A)Anonymization
B)Data transformation
C)Immutable audit
D)Selective revelation
Q3) _____ can be copyrighted.
A)Dramatic works
B)Architectural works
C)Software-related works
D)All of the above
Q4) A(n)_________ may be granted to anyone who invents or discovers any new and useful process,machine,article of manufacture,or composition of matter,or any new and useful improvement thereof.
Q5) The three types of patents are: utility patents,design patents,and ________.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79787
Sample Questions
Q1) In using encryption,we need to decide what to encrypt and where the encryption gear should be located.
A)True
B)False
Q2) A ________ cipher processes the input one block of elements at a time,producing an output block for each input block.
Q3) The _________ was issued as a federal information-processing standard and is intended to replace DES and 3DES with an algorithm that is more secure and efficient.
Q4) For symmetric encryption to work the two parties to an exchange must share the same _____,which must be protected from access by others.
Q5) One disadvantage of the link encryption approach is that the message must be decrypted each time it enters a frame switch.
A)True
B)False
Q6) A symmetric encryption scheme has five ingredients: plaintext,encryption algorithm,ciphertext,decryption algorithm and _________.
Q7) The three most important symmetric block ciphers are: 3DES,AES,and _____.
Q8) _________ is the process of attempting to discover the plaintext or key.
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79786
Sample Questions
Q1) One of the first public-key schemes,_______,was developed in 1977 by Ron Rivest,Adi Shamir,and Len Adleman.
Q2) Timing attacks are only applicable to RSA.
A)True
B)False
Q3) SHA-1 is considered to be very secure.
A)True
B)False
Q4) Unlike RSA,DSS cannot be used for encryption or key exchange.
A)True
B)False
Q5) Although the _________ attack is a serious threat,there are simple countermeasures that can be used such as constant time calcs,random delays or blinding computations.
A)timing
B)chosen ciphertext
C)mathematical
D)none of the above
Q6) One of the simplest hash functions is the ________ of every block.
Q7) NIST has published FIPS PUB 186,which is known as the ___________. Page 23
To view all questions and flashcards with answers, click on the resource link above.
Page 24
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79785
Sample Questions
Q1) DKIM has been widely adopted by a range of e-mail providers and many Internet service providers.
A)True
B)False
Q2) An ADMD is an Internet e-mail provider.
A)True
B)False
Q3) S/MIME content-types support four new functions: enveloped data,__________,clear-signed data,and signed and enveloped data.
Q4) The default algorithms used for signing S/MIME messages are SHA-1 and the
Q5) If encryption is used alone,_______ is used to convert the ciphertext to ASCII format.
Q6) DKIM is designed to provide an e-mail authentication technique that is transparent to the end user.
A)True
B)False
Q7) IP-level security encompasses three functional areas: authentication,confidentiality,and _________.
Q8) The _________ is used to convey SSL-related alerts to the peer entity.
To view all questions and flashcards with answers, click on the resource link above. Page 25
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79784
Sample Questions
Q1) An integer value unique within the issuing CA that is unambiguously associated with the certificate is the ________.
A)issuer name
B)subject's public-key information
C)issuer unique identifier
D)serial number
Q2) The _______ consists of two dates: the first and last on which the certificate is valid.
A)version
B)period of validity
C)extension
D)unique identifier
Q3) A software utility initially developed at MIT and available both in the public domain and in commercially supported versions,________ is the defacto standard for remote authentication.
Q4) The overall scheme of Kerberos is that of a trusted third-party authentication service.
A)True
B)False
Q5) In a generic identity management architecture a ________ is an identity holder.
To view all questions and flashcards with answers, click on the resource link above. Page 26
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79783
Sample Questions
Q1) An example of a __________ attack is one in which bogus reconfiguration commands are used to affect routers and switches to degrade network performance.
A)identity theft
B)ad hoc network
C)network injection
D)man-in-the-middle
Q2) A ____________ attack involves persuading a user and an access point to believe that they are talking to each other when in fact the communication is going through an intermediate attacking device.
Q3) The concerns for wireless security,in terms of threats,and countermeasures,are different to those found in a wired environment, such as an Ethernet LAN or a wired wide-area network.
A)True
B)False
Q4) A __________ attack occurs when an attacker continually bombards a wireless access point or some other accessible wireless port with various protocol messages designed to consume system resources.
Q5) The fields preceding the MSDU field are referred to as the _________.
To view all questions and flashcards with answers, click on the resource link above. Page 27