Security Principles and Practice
Test Questions
Course Introduction
This course provides a comprehensive introduction to the foundational principles and best practices of computer and information security. Topics include the core concepts of confidentiality, integrity, and availability; authentication and access control mechanisms; threat models and common attack vectors; cryptographic techniques; secure software development; risk management; and security policies. Students will also explore real-world applications of security technologies, ethical considerations, and emerging trends. The course combines theoretical understanding with practical exercises to equip students with the skills needed to assess vulnerabilities, implement safeguards, and respond effectively to security threats in diverse computing environments.
Recommended Textbook
Computer Security Principles and Practice 2nd Edition by William Stallings
Available Study Resources on Quizplus 24 Chapters
1078 Verified Questions
1078 Flashcards
Source URL: https://quizplus.com/study-set/3971
Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79799
Sample Questions
Q1) An example of __________ is an attempt by an unauthorized user to gain access to a system by posing as an authorized user.
A)masquerade
B)repudiation
C)interception
D)inference
Answer: A
Q2) The OSI security architecture focuses on security attacks,__________,and services.
Answer: mechanisms
Q3) Data integrity assures that information and programs are changed only in a specified and authorized manner.
A)True
B)False
Answer: True
Q4) Many security administrators view strong security as an impediment to efficient and user-friendly operation of an information system.
A)True
B)False
Answer: True
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79788
Sample Questions
Q1) The most important symmetric algorithms,all of which are block ciphers,are the DES,triple DES,and the __________.
A)SHA
B)RSA
C)AES
D)DSS
Answer: C
Q2) The purpose of a __________ is to produce a "fingerprint" of a file,message,or other block of data.
A)secret key
B)digital signature
C)keystream
D)hash function
Answer: D
Q3) The __________ is a pair of keys that have been selected so that if one is used for encryption,the other is used for decryption.
Answer: public and private key
Q4) Public-key encryption was first publicly proposed by __________ in 1976. Answer: Diffie and Hellman
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79782
Sample Questions
Q1) The __________ step is presenting or generating authentication information that corroborates the binding between the entity and the identifier.
Answer: verification
Q2) Voice pattern,handwriting characteristics,and typing rhythm are examples of __________ biometrics.
Answer: dynamic
Q3) Enrollment creates an association between a user and the user's biometric characteristics.
A)True
B)False
Answer: True
Q4) __________ allows an issuer to access regional and national networks that connect point of sale devices and bank teller machines worldwide.
A)EFT
B)ATM
C)POS
D)ALF
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79781
Sample
Questions
Q1) Role hierarchies make use of the concept of __________ to enable one role to implicitly include access rights associated with a subordinate role.
Q2) A __________ access control scheme is one in which an entity may be granted access rights that permit the entity,by its own volition,to enable another entity to access some resource.
Q3) __________ controls access based on comparing security labels with security clearances.
A)MAC
B)DAC
C)RBAC
D)MBAC
Q4) A user program executes in a kernel mode in which certain areas of memory are protected from the user's use and certain instructions may not be executed.
A)True
B)False
Q5) Any program that is owned by,and SetUID to,the "superuser" potentially grants unrestricted access to the system to any user executing that program.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79780
Sample Questions
Q1) In a relational database rows are referred to as _________.
A)relations
B)attributes
C)views
D)tuples
Q2) The __________ cloud infrastructure is a composition of two or more clouds that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability.
A)hybrid
B)community
C)private
D)public
Q3) _________ is a model for enabling ubiquitous,convenient,on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.
Q4) A __________ cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.
Q5) The __________ is a human entity that presents requests (queries)to the system.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79779
Sample Questions
Q1) A _________ is a set of programs installed on a system to maintain covert access to that system with administrator (root)privileges while hiding evidence of its presence.
Q2) __________ is the first function in the propagation phase for a network worm.
A)Propagating
B)Fingerprinting
C)Keylogging
D)Spear phishing
Q3) A bot propagates itself and activates itself,whereas a worm is initially controlled from some central facility.
A)True
B)False
Q4) Keyware captures keystrokes on a compromised system.
A)True
B)False
Q5) A __________ is a collection of bots capable of acting in a coordinated manner.
Q6) A __________ uses multiple methods of infection or propagation to maximize the speed of contagion and the severity of the attack.
Q7) A __________ virus is explicitly designed to hide itself from detection by anti-virus software.
Page 8
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79778
Sample Questions
Q1) A _____ is an action that prevents or impairs the authorized use of networks,systems,or applications by exhausting resources such as central processing units,memory,bandwidth,and disk space.
Q2) The four lines of defense against DDoS attacks are: attack prevention and preemption,attack detection and filtering,attack source traceback and identification and _______.
Q3) During a ______ attack,the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system and when the intermediary responds,the response is sent to the target.
Q4) SYN-ACK and ACK packets are transported using IP,which is an unreliable network protocol.
A)True
B)False
Q5) _____ attacks flood the network link to the server with a torrent of malicious packets competing with valid traffic flowing to the server.
Q6) There is very little that can be done to prevent a flash crowd.
A)True
B)False
Q7) The standard protocol used for call setup in VoIP is the ________ Protocol.
Page 9
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79777
Sample Questions
Q1) A(n)________ is inserted into a network segment so that the traffic that it is monitoring must pass through the sensor.
A)passive sensor
B)analysis sensor
C)LAN sensor
D)inline sensor
Q2) Anomaly detection is effective against misfeasors.
A)True
B)False
Q3) The _________ is the predefined formally documented statement that defines what activities are allowed to take place on an organization's network or on particular hosts to support the organization's requirements.
Q4) An IDS comprises three logical components: analyzers,user interface and _____.
Q5) An intruder can also be referred to as a hacker or cracker.
A)True
B)False
Q6) The functional components of an _________ are: data source,sensor,analyzer,administration,manager,and operator.
Q7) The three classes of intruders are masquerader,clandestine user and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79776
Sample Questions
Q1) A _________ configuration involves stand-alone firewall devices plus host-based firewalls working together under a central administrative control.
A)packet filtering firewall
B)distributed firewall
C)personal firewall
D)stateful inspection firewall
Q2) One disadvantage of a packet filtering firewall is its simplicity.
A)True
B)False
Q3) Typically the systems in the _________ require or foster external connectivity such as a corporate Web site,an e-mail server,or a DNS server.
A)DMZ
B)IP protocol field
C)boundary firewall
D)VPN
Q4) A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.
Q5) Snort Inline adds three new rule types: drop,reject,and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79798
Sample Questions
Q1) The attacker is able to precisely specify the starting address of the instructions in the shellcode.
A)True
B)False
Q2) One of the restrictions on the content of shellcode is that it has to be _______,which means that it cannot contain any absolute address referring to itself.
Q3) _______ can be placed between stack frames or between different allocations on the heap to provide further protection against stack and heap overflow attacks,but at cost in execution time supporting the large number of page mappings necessary.
Q4) The _______ exploited a buffer overflow in Microsoft SQL Server 2000.
A)Morris Internet Worm
B)Code Red Worm
C)Sasser Worm
D)Slammer Worm
Q5) At the basic machine level,all of the data manipulated by machine instructions executed by the computer processor are stored in either the processor's registers or in
Q6) ______ defenses aim to harden programs to resist attacks in new programs.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79797
Sample Questions
Q1) _________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.
A)Deadlocks
B)Privileges
C)Environment variables
D)Race conditions
Q2) Security flaws occur as a consequence of sufficient checking and validation of data and error codes in programs.
A)True
B)False
Q3) "Improper Access Control (Authorization)" is in the _________ software error category.
A)Porous Defenses
B)Allocation of Resources
C)Risky Resource Management
D)Insecure Interaction Between Components
Q4) The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.
Q5) Program input data may be broadly classified as textual or ______.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79796
Sample Questions
Q1) The needs and policy relating to backup and archive should be determined ______.
A)as a final step
B)during the system planning stage
C)during security testing
D)after recording average data flow volume
Q2) ______ virtualization systems are more common in clients,where they run along side other applications on the host OS,and are used to support applications for alternate operating system versions or types.
Q3) A very common configuration fault seen with Web and file transfer servers is for all the files supplied by the service to be owned by the same "user" account that the server executes as.
A)True
B)False
Q4) Ideally new systems should be constructed on an unprotected network in order to prevent installation restrictions.
A)True B)False
Q5) ______ is a reactive control that can only inform you about bad things that have already happened.
Q6) System security begins with the installation of the ________.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79795
Sample Questions
Q1) Inserting a new row at a lower level without modifying the existing row at the higher level is known as ________ .
A)polyinstantiation
B)ds-property
C)trust
D)MAC
Q2) The _________ model is aimed at commercial rather than military applications and closely models real commercial operations.
Q3) The addition of multilevel security to a database system does not increase the complexity of the access control function.
A)True
B)False
Q4) An entire database such as a financial or personnel database cannot be maintained on a server with other files and still be classified as confidential or restricted.
A)True
B)False
Q5) _________ rules are security policy restrictions on the behavior of IVPs and TPs.
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79794
Sample Questions
Q1) A threat may be either natural or human made and may be accidental or deliberate.
A)True
B)False
Q2) __________ ensures that critical assets are sufficiently protected in a cost-effective manner.
A)IT control
B)IT security management
C)IT discipline
D)IT risk implementations
Q3) The term ________ refers to a document that details not only the overall security objectives and strategies,but also procedural policies that define acceptable behavior,expected practices,and responsibilities.
Q4) Implementing the risk treatment plan is part of the ______ step.
A)check
B)act
C)do
D)plan
Q5) _________ is sharing responsibility for the risk with a third party.
Q6) A(n)_________ is anything that has value to the organization.
Page 16
To view all questions and flashcards with answers, click on the resource link above.
Chapter 15: It Security Controls, plans, and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79793
Sample Questions
Q1) Incident response is part of the ________ class of security controls.
Q2) The recommended controls need to be compatible with the organization's systems and policies.
A)True
B)False
Q3) _______ controls focus on security policies,planning,guidelines,and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.
A)Management
B)Technical
C)Preventative
D)Supportive
Q4) Physical access or environmental controls are only relevant to areas housing the relevant equipment.
A)True
B)False
Q5) Contingency planning falls into the _________ class of security controls.
Q6) _______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.
Page 17
To view all questions and flashcards with answers, click on the resource link above.
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79792
Sample Questions
Q1) _________ security,also called infrastructure security,protects the information systems that contain data and the people who use,operate,and maintain the systems.
Q2) To deal with the threat of smoke,the responsible manager should install _______ in every room that contains computer equipment as well as under raised floors and over suspended ceilings.
Q3) Physical security must prevent misuse of the physical infrastructure that leads to the misuse or damage of the protected information.
A)True
B)False
Q4) _______ threats encompass threats related to electrical power and electromagnetic emission.
Q5) The _______ authentication has an attendant supervise the use of the PIV card and the submission of the PIN and the sample biometric by the cardholder.
Q6) The direct flame is the only threat from fire.
A)True
B)False
Q7) ________ physical threats are more difficult to deal with than environmental and technical threats.
18
To view all questions and flashcards with answers, click on the resource link above.
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79791
Sample Questions
Q1) ________ lists the following security objective with respect to current employees: to ensure that employees,contractors,and third-party users are aware of information security threats and concerns and their responsibilities and liabilities with regard to information security and are equipped to support organizational security policy in the course of their normal work and to reduce the risk of human error.
Q2) ________ is explicitly required for all employees.
A)Security awareness
B)Education and experience
C)Security basics and literacy
D)Roles and responsibilities relative to IT systems
Q3) There is a need for a continuum of learning programs that starts with _______,builds to training,and evolves into education.
Q4) ________ can include computer viruses,Trojan horse programs,worms,exploit scripts,and toolkits.
A)Artifacts
B)Vulnerabilities
C)CSIRT
D)Constituencies
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79790
Sample Questions
Q1) Data items to capture for a security audit trail include:
A)events related to the security mechanisms on the system
B)operating system access
C)remote access
D)all of the above
Q2) Data representing behavior that does not trigger an alarm cannot serve as input to intrusion detection analysis.
A)True
B)False
Q3) The ________ is a module that transmits the audit trail records from its local system to the centralized audit trail collector.
A)audit dispatcher
B)audit analyzer
C)audit trail collector
D)none of the above
Q4) The security administrator must define the set of events that are subject to audit.
A)True
B)False
Q5) SIEM software has two general configuration approaches: agentless and ______.
Page 20
To view all questions and flashcards with answers, click on the resource link above.
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79789
Sample Questions
Q1) The right to seek civil recourse against anyone infringing his or her property is granted to the ________.
Q2) The first comprehensive privacy legislation adopted in the United States was the Privacy Act of 1974.
A)True
B)False
Q3) The copyright owner has which exclusive right(s)?
A)reproduction right
B)distribution right
C)modification right
D)all of the above
Q4) Computer attacks are considered crimes but do not carry criminal sanctions.
A)True
B)False
Q5) Privacy is broken down into four major areas: anonymity,unlinkability,unobservability,and _________.
Q6) The ___________ Act places restrictions on online organizations in the collection of data from children under the age of 13.
Page 21
To view all questions and flashcards with answers, click on the resource link above.
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79787
Sample Questions
Q1) The three most important symmetric block ciphers are: 3DES,AES,and _____.
Q2) ______ was designed in 1987 by Ron Rivest and is a variable key-size stream cipher with byte-oriented operations.
Q3) A brute-force approach involves trying every possible key until an intelligible translation of the ciphertext into plaintext in obtained.
A)True
B)False
Q4) __________ is a term that refers to the means of delivering a key to two parties that wish to exchange data without allowing others to see the key.
A)Session key
B)Subkey
C)Key distribution technique
D)Ciphertext key
Q5) "Each block of 64 plaintext bits is encoded independently using the same key" is a description of the CBC mode of operation.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 22
Q6) A ________ cipher processes the input elements continuously,producing output one element at a time as it goes along.
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79786
Sample Questions
Q1) The Diffie-Hellman algorithm depends for its effectiveness on the difficulty of computing discrete logarithms.
A)True
B)False
Q2) HMAC can be proven secure provided that the embedded hash function has some reasonable cryptographic strengths.
A)True
B)False
Q3) The one-way hash function is important not only in message authentication but also in digital signatures.
A)True
B)False
Q4) ___________ was the first published public-key algorithm.
A)NIST
B)Diffie-Hellman
C)RC4
D)RSA
Q5) The purpose of the algorithm is to enable two users to exchange a __________ securely that can then be used for subsequent encryption of messages.
Q6) One of the simplest hash functions is the ________ of every block. Page 23
To view all questions and flashcards with answers, click on the resource link above.
Page 24
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79785
Sample Questions
Q1) The SSL record protocol provides two services for SSL connection: message integrity and _________.
Q2) IPsec provides two main functions: a combined authentication/encryption function called ___________ and a key exchange function.
Q3) SMTP is used between the message user agent and the mail submission agent.
A)True
B)False
Q4) The recipient of a message can decrypt the signature using DSS and the sender's public DSS key.
A)True
B)False
Q5) The ________ accepts the message submitted by a message user agent and enforces the policies of the hosting domain and the requirements of Internet standards.
A)mail submission agent
B)message user agent
C)mail delivery agent
D)message transfer agent
Q6) The _________ is used to convey SSL-related alerts to the peer entity.
To view all questions and flashcards with answers, click on the resource link above. Page 25
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79784
Sample Questions
Q1) _______ is the process whereby a user first makes itself known to a CA prior to that CA issuing a certificate or certificates for that user.
A)Authorization
B)Registration
C)Certification
D)Initialization
Q2) Kerberos is designed to counter only one specific threat to the security of a client/server dialogue.
A)True
B)False
Q3) _______ certificates are used in most network security applications,including IP security,secure sockets layer,secure electronic transactions,and S/MIME.
A)X.509
B)PKI
C)FIM
D)SCA
Q4) X.509 provides a format for use in revoking a key before it expires.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 26
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79783
Sample Questions
Q1) The wireless access point provides a connection to the network or service.
A)True
B)False
Q2) There are two types of keys: ________ used for communication between a STA and an AP and group keys used for multicast communication.
Q3) The purpose of the discovery phase is for an STA and an AP to recognize each other,agree on a set of security capabilities,and establish an association for future communication using those security capabilities.
A)True
B)False
Q4) A __________ attack occurs when an attacker continually bombards a wireless access point or some other accessible wireless port with various protocol messages designed to consume system resources.
Q5) The association service enables transfer of data between a station on an IEEE 802.11 LAN and a station on an integrated IEEE 802.x LAN.
A)True
B)False
Q6) The fields preceding the MSDU field are referred to as the _________.
To view all questions and flashcards with answers, click on the resource link above. Page 27