Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
CECS 478 Exam 1
| Question | Answer |
|---|---|
| What is Confidentiality? | Only authorized users can access information. |
| What is Integrity? | Data cannot be changed without authorization. |
| What is Availbility? | Authorized users can access systems and data when needed. |
| What is the CIA Triad? | Confidentiality, Integrity, and Availability — the three main goals of security. |
| What is Authenticity? | Verifying that a user, message, or system is genuine. |
| What is Accountability? | Being able to determine who performed an action. |
| What is an Asset? | Something valuable that needs to be protected. |
| What is a Threat? | Something that could potentially cause harm. |
| What is a Vulnerability? | A weakness that can be exploited. |
| What is an Attack? | An attempt to exploit a vulnerability. |
| What is a Countermeasure? | A security control used to reduce or prevent a threat. |
| What is Risk? | The possibility of harm when a threat exploits a vulnerability. |
| What is Impact? | The damage caused by a successful attack. |
| What is a Passive Attack? | An attack that observes or monitors without changing data. |
| What is an Active Attack? | An attack that changes, disrupts, or interferes with a system. |
| What is an Inside Attack? | An attack from someone with legitimate internal access. |
| What is an Outside Attack? | An attack from someone without normal authorized access. |
| What is Phishing? | Tricking a user into revealing information or performing an action. |
| What is a Buffer? | An area of memory used to temporarily store data. |
| What is a Buffer Overflow? | Writing more data into a buffer than it can hold. |
| What is Control-Flow Hijacking? | Causing a program to execute somewhere unintended. |
| What is a Return Address? | The address telling a program where to continue after a function finishes. |
| What is Memory Corruption? | When a program accidentally or maliciously changes memory it should not change. |
| What is a Stack Canary? | A value used to detect stack corruption. |
| What is NX/DEP? | A defense that prevents execution from protected data memory. |
| What is ASLR? | A defense that randomizes important memory addresses. |
| What is CFI? | A defense that restricts execution to valid control-flow paths. |
| What is Defense in Depth? | Using multiple security layers instead of relying on one defense. |
| What is Cryptography? | Mathematical techniques used to protect information. |
| What is Encryption? | Transforming plaintext into ciphertext to protect information |
| What is Plaintext? | The original readable information before encryption. |
| What is Ciphertext? | The encrypted, unreadable version of plaintext. |
| What is Symmetric Encryption? | Encryption that uses the same secret key to encrypt and decrypt. |
| What is AES? | A symmetric encryption algorithm used to protect data. |
| What is Asymmetric Encryption? | Encryption that uses a public key and a private key. |
| What is Hashing? | Converting input into a fixed-size, one-way digest. |
| What is a Hash Function? | A function that converts data into a fixed-size hash value. |
| What is SHA-256? | A cryptographic hash function that produces a 256-bit digest. |
| What is a Salt? | Random data added to a password before hashing. |
| Why are salts used? | To make password hashes unique and harder to attack with precomputed tables. |
| What is PBKDF2? | A password function designed to make password guessing more expensive. |
| What is Authentication? | Verifying who a user is. |
| What is Authorization? | Determining what an authenticated user is allowed to do. |
| What is Multi-Factor Authentication (MFA)? | Authentication using multiple different types of factors. |
| What is "Something you know"? | An authentication factor such as a password or PIN. |
| What is "Something you have"? | An authentication factor such as a phone or security token. |
| What is "Something you are"? | An authentication factor such as a fingerprint or face. |
| What is Access Control? | Controlling who can access resources and what they can do. |
| What is a Subject? | The user or process requesting access. |
| What is an Object? | The resource being accessed, such as a file or database. |
| What is a Permission? | An allowed action, such as read, write, or execute. |
| What is DAC? | Access control where the resource owner decides who gets access. |
| What is MAC? | Access control based on centrally defined security policies and labels. |
| What is RBAC? | Access control where permissions are assigned to roles. |
| What is ABAC? | Access control based on attributes and conditions. |
| What is Least Privilege? | Giving users only the permissions they need. |
| What is Separation of Duties? | Dividing important responsibilities among multiple people. |
| What is Input Validation? | Checking that input is safe and follows expected rules. |
| A university employee accidentally emails a student's financial-aid information to an unauthorized person. Which security objective is primarily affected? | Confidentiality |
| A database administrator notices that several employee records contain incorrect phone numbers that were not changed by authorized staff. Which security objective is primarily affected? | Integrity |
| A hospital's scheduling system stops working for two hours, preventing doctors from viewing appointments. Which security objective is primarily affected? | Integrity |
| An employee secretly copies a company's confidential research files but does not modify them. Which security objective is primarily affected? | Confidentiality |
| A server is overwhelmed by traffic and legitimate users can no longer connect to it. Which security objective is primarily affected? | Availability |
| An attacker gains access to a student account, reads private records, and changes the student's address. Which two CIA properties are clearly affected? | Confidentiality and Integrity |
| A company uses an old version of software that has a publicly known security weakness. Is this a threat, vulnerability, attack, or impact? | Vulnerability |
| A criminal group is looking for companies to target with ransomware. What does the criminal group represent in the security chain? | Threat / threat agent |
| An attacker sends specially crafted input to exploit the company's vulnerable software. What is this action? | Attack |
| After the attack, the company loses access to important files for several days. What is this? | Impact/consequence |
| A company installs software that detects and blocks suspicious activity before it reaches the vulnerable server. What is this? | Countermeasure/control |
| A weak password exists on an employee's account, but nobody has attempted to use it maliciously yet. Is the weak password a threat or vulnerability? | Vulnerability |
| Someone attempts thousands of passwords against an employee's account. Is this a vulnerability or an attack? | Attack |
| A hacker wants to steal customer information but has not interacted with the company's system yet. Is the hacker a vulnerability or threat? | Threat/threat agent |
| Customer information is exposed after a successful attack. Is the exposed information the attack or the impact? | Impact |
| Someone quietly records network traffic passing through an unsecured network without changing the messages. Passive or active? | Passive |
| An attacker changes a message before it reaches its intended recipient. Passive or active? | Active |
| An attacker monitors when employees log into a system to learn their working schedules. They do not alter anything. Passive or active? | Passive |
| A program reserves space for 12 characters but accepts input of any length without checking it first. What security weakness does this create? | A buffer overflow vulnerability / missing bounds check |
| A user enters 30 characters into a field designed to hold only 12. The program writes all 30 characters into the buffer. What has occurred? | An out-of-bounds write |
| A programmer assumes users will never provide input larger than the allocated buffer. What assumption is unsafe? | That input will always fit within the buffer; the program needs to validate its size. |
| A programmer forgets to check the length of user input. What does this represent? | Programming mistake / bug |
| The missing check allows an attacker to overwrite memory outside the intended buffer. What does the exploitable condition represent? | Vulnerability |
| An attacker intentionally sends an unusually large input to trigger the weakness. What does this represent? | Attack |
| The program crashes after receiving the malicious input. What does the crash represent? | Consequence / result |
| A program crashes after receiving oversized input. Can you conclude that the attacker successfully controlled the program's execution? | No. A crash shows corruption or failure occurred, but it does not prove control-flow hijacking. |
| A program checks the length of input before copying it into a fixed-size buffer. Where does this defense act? | Before the dangerous copy; it prevents invalid input from reaching the buffer. |
| A program places a special value next to important stack data and checks it before returning from a function. What defense is being used? | Stack canary |
| A memory region is marked so that data stored there cannot normally be executed as instructions. What defense is this? | NX/DEP |
| A program's stack and libraries are placed at different memory locations each time it runs. What defense is this? | ASLR |
| A program checks whether an indirect jump or return goes to an approved destination. What defense is this? | CFI |
| A developer adds a stack canary to a program with an existing out-of-bounds write. Has the programming error been fixed? | No. The canary can detect some overwrites, but it does not remove the underlying bug. |
| A program uses ASLR. Does that prevent an attacker from causing an out-of-bounds write? | No. ASLR randomizes memory locations; it does not prevent the invalid write itself. |
| A program uses NX/DEP. Does that guarantee that every possible control-flow attack will fail? | No. NX/DEP blocks certain forms of executing data as code but does not eliminate every type of attack. |
| A company combines input validation, canaries, NX, ASLR, and CFI. Why use several defenses? | Each defense addresses a different part of the attack and has its own limitations |
| A person sends a message that is readable before protection but appears as meaningless data while being transmitted. What is the readable version called? | Plaintext |
| What is the protected, unreadable version of the message called? | Ciphertext |
| A system uses one secret key to transform data and the same secret key to recover it. What type of encryption? | Symmetric encryption |
| A company uses AES to protect files stored on its servers. Is AES primarily a hash function or encryption algorithm? | Encryption algorithm |
| Two people want to use symmetric encryption but have never communicated before. What major problem do they need to solve? | Securely sharing the secret key. |
| A toy cipher moves every letter forward by 5 positions. What is the key? | The shift of 5 |
| A Caesar cipher produces "MJQQT" using a shift of 5. What is the original message? | HELLO |
| Why could an attacker easily break a Caesar cipher? | There are very few possible shifts, so the attacker can simply try them all. |
| A website converts a password into a fixed-length digest before storing it. What security technique is being used? | Hashing |
| A developer changes one character in the input and the resulting SHA-256 digest changes completely. What property of cryptographic hashes does this demonstrate? | A small change in the input produces a significantly different output. |
| A developer receives a SHA-256 digest from a database and wants to "decrypt" it to get the original password. Is this how hashing works? | No. Hashing is designed to be one-way. |
| Two users choose the same password, but their stored password verifiers are different. What could explain this? | Each password was given a different random salt. |
| A website uses the exact same salt for every user's password. What security benefit is lost? | Unique salts prevent identical passwords from producing identical stored values. |
| A salt is stored next to the password verifier in the database. Does this make the salt useless? | No. A salt does not need to be secret |
| Why would a password-hashing system intentionally perform hundreds of thousands of iterations? | To make each password guess more expensive and slow down brute-force attacks. |
| A database stores plaintext passwords. An attacker steals the database. What can the attacker immediately see? | The actual passwords. |
| A database stores salted password verifiers instead of plaintext passwords. Does this make the database breach harmless? | No. Attackers can still attempt to guess passwords using the stolen data. |
| A website asks a user for a password to determine whether they are really the account owner. What process? | Authentication |
| After login, the website checks whether the user is allowed to edit a particular document. What process? | Authorization |
| A user successfully logs in but receives "Access Denied" when trying to edit a restricted file. Did authentication or authorization fail? | Authorization — the user's identity was accepted, but they did not have permission. |
| A login requires a password and a code from a hardware security token. Does this qualify as MFA? | Yes — something you know + something you have. |
| A login requires a password and a PIN. Does this qualify as MFA? | No. Both are "something you know." |
| A login requires a password and a fingerprint. What two factor categories are being used? | Something you know + something you are. |
| A stolen password alone is not enough to log into an account because the attacker also needs the user's phone. What security control is helping? | MFA |
| A student requests access to a grade record. In access-control terminology, what is the student? | Subject |
| The grade record the student wants to access is what? | Object |
| A system allows a user to read a file but prevents them from deleting it. What determines these allowed actions? | Permissions / authorization |
| A researcher creates a document and personally chooses which coworkers can access it. Which access-control model? | DAC |
| A military system uses centrally assigned security classifications to determine who can access documents. Which model? | MAC |
| A hospital gives nurses one set of permissions, doctors another, and receptionists another. Which model? | RBAC |
| A system decides whether a doctor can access a record based on their role, department, current location, device, and time. Which model? | ABAC |
| A company gives an employee access because they have the "Payroll Manager" role. What model? | RBAC |
| A system allows access only when role = Doctor, department = Cardiology, and device = Hospital Computer. What model? | ABAC |
| A student tries to access another student's transcript. Their role allows students to view transcripts, but only their own. Permit or deny? | Deny — the ownership requirement is not satisfied. |
| A professor tries to edit grades for a course they are not assigned to teach. Their role is "Professor." Should the role alone be enough? | No. Additional conditions such as course assignment may be required. |
| An employee can create purchase orders but another employee must approve them. What security principle is being used? | Separation of duties |
| A receptionist can view appointment information but cannot change it because changing appointments is not required for their job. What principle? | Least privilege |
| An employee is given administrator privileges even though their job only requires reading reports. What security principle is being violated? | Least privilege |
| A university employee receives a suspicious email containing a link to a fake login page. The employee enters their password. What attack occurred? | Phishing |
| The employee's password was also used for their personal email. What additional vulnerability exists? | Password reuse |
| The university adds MFA so that a stolen password alone is insufficient. What risk is this control reducing? | Unauthorized account access from stolen credentials. |
| A program accepts user input without checking its length. An attacker sends unusually long input. The program crashes. What can you conclude with certainty? | The input caused a crash, but you cannot conclude that control-flow hijacking succeeded. |
| The same program uses a canary, and the log reports that the canary was corrupted. What does this evidence tell you? | A stack overwrite was detected. |
| The program also uses ASLR. What does ASLR contribute? | It makes memory locations harder to predict. |
| A website stores passwords using PBKDF2 with a unique random salt for each user. Why is this better than storing plaintext passwords? | The original passwords are not directly stored, and unique salts make identical passwords produce different verifiers |
| A student logs into a portal successfully but is denied when trying to access another student's grades. Which security mechanism is responsible for the denial? | Authorization/access control |
| A portal gives students, professors, and administrators different permissions based on their assigned roles. What access-control model? | RBAC |
| A portal additionally checks the user's department, device, course assignment, and current semester before allowing access. What model can handle these conditions? | ABAC |
| A security system uses several independent defenses because each individual defense has limitations. What principle? | Defense in depth |
| A security analyst identifies a valuable database, a weak configuration, an attacker, an exploit, and the resulting data exposure. What security framework are they essentially building? | Asset → Vulnerability → Threat → Attack → Impact → Countermeasure chain |
| A security control stops an attack from happening before it reaches a vulnerable operation. Is the control primarily preventing, detecting, or responding? | Preventing |
| A security control notices that memory has already been corrupted and alerts/stops the program. Is it primarily preventing or detecting? | Detecting |
| A security control limits what an attacker can do after gaining access by restricting permissions. What principle is being applied? | Least privilege |
| Why is a weak password a vulnerability rather than an attack? | Because it is a weakness that could be exploited; the attack is the action of exploiting it. |
| Why doesn't a program crash prove control-flow hijacking? | A crash shows that something went wrong, but it does not prove that the attacker controlled where the program executed. |
| Why doesn't ASLR fix a buffer overflow? | ASLR changes memory locations, but the underlying invalid memory write still exists. |
| Why isn't a password plus PIN necessarily MFA? | Both are knowledge factors, so they are still the same type of authentication factor. |
| Why is authentication different from authorization? | Authentication determines who you are; authorization determines what you are allowed to do. |
| Why does a unique salt help protect password storage? | It causes identical passwords to produce different stored values and makes precomputed attacks less useful. |
| Why is least privilege useful for security? | If an account is compromised, the attacker has fewer permissions and therefore fewer things they can access or change. |
| Why is defense in depth useful? | If one security control fails or is bypassed, other controls can still reduce or limit the attack. |
Created by:
MinYoongi67