click below
click below
Normal Size Small Size show me how
CECS 378 Midterm I
| Question | Answer |
|---|---|
| Which term best matches this definition? Preventing unauthorized disclosure of information. | Confidentiality |
| Which term best matches this definition? Preventing unauthorized or improper change. | Integrity |
| Which term best matches this definition? Ensuring authorized users can obtain a service when needed. | Availability |
| Which term best matches this definition? The set of reachable points where an attacker may interact with a system. | Attack surface |
| Which term best matches this definition? Explicit permission to access or test a system. | Authorization |
| A team reports: Only authorized advisers may view student records. Which concept should guide the analysis? | Confidentiality |
| A team reports: A grade record must not be altered without approval. Which concept should guide the analysis? | Integrity |
| A team reports: A registration system must remain usable during enrollment. Which concept should guide the analysis? | Availability |
| A team reports: A portal exposes login, upload, API, and recovery paths. Which concept should guide the analysis? | Attack Surface |
| A team reports: A security analyst receives written scope before scanning. Which concept should guide the analysis? | Authorization |
| Which term best matches this definition? The effect of uncertainty on objectives, often reasoned about through likelihood and impact. | Risk |
| Which term best matches this definition? A structured representation of assets, trust boundaries, threats, and mitigations. | Threat model |
| Which term best matches this definition? A place where data or control crosses between different trust assumptions. | Trust boundary |
| Which term best matches this definition? A decision to mitigate, transfer, avoid, or accept a risk. | Risk treatment |
| Which term best matches this definition? One of govern, identify, protect, detect, respond, and recover. | CSF function |
| A team reports: A stolen credential could expose financial records. Which concept should guide the analysis? | Risk |
| A team reports: A team analyzes a new payment workflow before launch. Which concept should guide the analysis? | Threat model |
| A team reports: A browser sends a request to an internal API. Which concept should guide the analysis? | Trust boundary |
| A team reports: A team chooses controls and records residual risk. Which concept should guide the analysis? | Risk treatment |
| A team reports: A plan groups cybersecurity outcomes across the lifecycle. Which concept should guide the analysis? | CSF function |