Deck 4: Network Security

Question 1

________ is a flaw in a program that permits a specific attack or set of attacks.

A) Malware
B) A security error
C) A vulnerability
D) A security fault

Answer 1

C

Question 2

What kind of attack is most likely to succeed against a system with no technological vulnerabilities?

A) malware
B) social engineering
C) both A and B
D) neither A nor B

Answer 2

B

Question 3

________ is the most frequent type of company attack.

A) DoS
B) Hacking
C) Ransomware
D) Malware

Answer 3

D

Question 4

Users typically can eliminate a vulnerability in one of their programs by ________.

A) installing a patch
B) using an antivirus program
C) both A and B
D) neither A nor B

Question 5

________ are full programs.

A) Viruses
B) Worms
C) both A and B
D) neither A nor B

Question 6

Which of the following probably suffered the most financial damage from the Target breach?

A) Target
B) banks
C) consumers
D) retailers

Question 7

Which of the following sometimes uses direct propagation between computers?

A) viruses
B) worms
C) Trojan horses
D) downloaders

Question 8

Which of the following attach themselves to other programs?

A) viruses
B) worms
C) both A and B
D) neither A nor B

Question 9

Which of the following were able to recoup most of the money they lost from Target?

A) credit card companies
B) retailers
C) both A and B
D) neither A nor B

Question 10

How did the Target attackers obtain the stolen information?

A) Directly from the POS terminals
B) From the vendor service server
C) From the POS software download server
D) none of the above.

Question 11

The Target attackers sold stolen card information to ________.

A) crimeware shops
B) card shops
C) card counterfeiters
D) all of the above

Question 12

In ________ thinking,the opponent is primarily an intelligent attacker.

A) networking
B) security
C) both A and B
D) neither A nor B

Question 13

For consumers who suffered credit card fraud because of the Target breach and acted quickly,which of the following is true?

A) They received no compensation.
B) They received compensation from Target.
C) The credit card companies did not charge them for fraudulent purchasers.
D) The United States Treasury compensated them from an insurance fund.

Question 14

Viruses and worms propagate through ________.

A) social engineering
B) exploiting vulnerabilities
C) both A and B
D) neither A nor B

Question 15

A spear phishing attack is usually aimed at ________.

A) an individual
B) a group
C) everyone
D) all of the above

Question 16

Vulnerability-based attacks that occur before a patch is available are called ________ attacks.

A) indefensible
B) stealth
C) malware
D) zero-day

Question 17

The Target attackers probably first broke into Target using the credentials of a(n)________.

A) low-level Target employee
B) Target IT employee
C) Target security employee
D) employee in a firm outside Target

Question 18

Which of the following can spread very rapidly?

A) directly-propagating viruses
B) directly-propagating worms
C) both A and B
D) neither A nor B

Question 19

________ is the general name for a security flaw in a program.

A) A virus
B) Malware
C) A security fault
D) A vulnerability

Question 20

The general term for evil software is ________.

A) virus
B) worm
C) malware
D) all of the above

Question 21

Hacking is defined as using a computer resource without authorization or in excess of authorization.

Question 22

Trojan horses can spread by ________.

A) e-mailing themselves to victim computers
B) directly propagating to victim computers
C) both A and B
D) neither A nor B

Question 23

In a ________ attack,the attacker encrypts some or all of the victim's hard drive.

A) virus
B) DoS
C) ransom
D) lock

Question 24

________ is a program that can capture passwords as you enter them.

A) A keystroke logger
B) Data mining software
C) both A and B
D) neither A nor B

Question 25

Attack programs that can be remotely controlled by an attacker are ________.

A) bots
B) sock puppets
C) both A and B
D) neither A nor B

Question 26

You are concerned with the security of a site you use and run a vulnerability test against it.The test reveals a security threat.Is this hacking?

A) yes
B) no
C) We cannot say from the information given.

Question 27

________ is the general name for malware on a user's PC that collects sensitive information and sends this information to an attacker.

A) A keystroke logger
B) Anti-privacy software
C) Spyware
D) Data mining software

Question 28

DoS attacks attempt to ________.

A) hack a computer
B) reduce the availability of a computer
C) steal information from a computer
D) delete files on a computer

Question 29

In a DDoS attack,a ________ sends messages directly to the victim.

A) botmaster
B) bot
C) command and control server
D) all of the above

Question 30

In which type of attack does the attacker gather extensive sensitive personal information about its victim?

A) identity theft
B) credit card number theft
C) both A and B
D) neither A nor B

Question 31

You click on a link expecting to go to a legitimate website but are directed to a website that contains information you are not authorized to see.You exit without looking around.is that hacking?

A) yes
B) no
C) We cannot say from the information given.

Question 32

Advanced persistent threats are ________.

A) inexpensive for the attacker
B) extremely dangerous for the victim
C) both A and B
D) neither A nor B

Question 33

Which of the following meets the definition of hacking?

A) to intentionally use a computer resource without authorization
B) to intentionally use a computer on which you have an account but use it for unauthorized purposes
C) both A and B
D) neither A nor B

Question 34

Which is more harmful to the victim?

A) identity theft
B) credit card number theft
C) both A and B are about equally harmful

Question 35

Malware programs that masquerade as system files are called ________.

A) viruses
B) scripts
C) root malware
D) Trojan horses

Question 36

Which of the following can be upgraded after it is installed on a victim computer (choose the most specific answer)?

A) Trojan horses
B) bots
C) viruses
D) worms

Question 37

You accidentally discover that you can get into other e-mail accounts after you have logged in under your account and only spend a few minutes looking at another user's mail.Is that hacking?

A) yes
B) no
C) We cannot say from the information given.

Question 38

In distributed DoS attacks,the attacker sends messages directly to ________.

A) bots
B) the intended victim of the DoS attack
C) a DOS server
D) none of the above

Question 39

Pieces of code that are executed after the virus or worm has spread are called ________.

A) vulnerabilities
B) exploits
C) compromises
D) payloads

Question 40

If you see a username and password on a Post-It note that anyone can see on a monitor,is it hacking if you use this information to log in?

A) yes
B) no
C) We cannot say from the information given.

Question 41

________ attackers are often well-funded.

A) Disgruntled employee
B) Cybercriminal
C) both A and B
D) neither A nor B

Question 42

In general,what type of attackers do the most damage?

A) criminal attackers
B) hackers driven by curiosity
C) employees and ex-employees
D) national governments

Question 43

Who mounts APTs today?

A) national governments
B) cybercriminals
C) both A and B
D) neither A nor B

Question 44

Secured packets typically receive ________.

A) confidentiality
B) authentication
C) message integrity
D) all of the above

Question 45

In terms of security thinking,"insiders" include ________.

A) employees
B) many contractors working for the company
C) both A and B
D) neither A nor B

Question 46

Who are the most dangerous types of employees?

A) financial employees
B) manufacturing employees
C) IT security employees
D) former employees

Question 47

In encryption,what must be kept secret?

A) the cipher
B) the key
C) both A and B
D) neither A nor B

Question 48

A specific encryption method is called a ________.

A) code
B) schema
C) key method
D) cipher

Question 49

Why are employees especially dangerous?

A) They are technically sophisticated.
B) They are trusted.
C) both A and B
D) neither A nor B

Question 50

Electronic signatures provide message-by-message ________.

A) authentication
B) confidentiality
C) both A and B
D) neither A nor B

Question 51

________ attacks typically extend over a period of months.

A) DDoS
B) Malware
C) APT
D) Spear phishing

Question 52

What type of attacker are most attackers today?

A) disgruntled employees and ex-employees
B) career criminals
C) hackers motivated by a sense of power
D) cyberterrorists

Question 53

In most encryption,keys must be at least ________ long to be considered safe.

A) 128 bits
B) 128 bytes
C) 1,280 bits
D) 1,280 bytes

Question 54

In general,what should an employer do whenever an employee leaves the firm?

A) Their accounts should be disabled instantly
B) They should be given no prior notice that they are being released
C) both A and B
D) neither A nor B

Question 55

Cyberwar attacks are made by ________.

A) major cybercriminal gangs
B) national governments
C) both A and B
D) neither A nor B

Question 56

Employees often attack ________.

A) for revenge
B) for money
C) both A and B
D) neither A nor B

Question 57

Electronic signatures also provide ________ in addition to authentication.

A) message integrity
B) message encryption
C) both A and B
D) neither A nor B

Question 58

The messages of VPNs ________.

A) share the same transmission lines used by other VPNs
B) are encrypted
C) both A and B
D) neither A nor B

Question 59

SSL/TLS is used for ________.

A) Web applications
B) almost all applications
C) both A and B
D) neither A nor B

Question 60

Using encryption,you make it impossible for attackers to read your messages even if they intercept them.This is ________.

A) authentication
B) confidentiality
C) both A and B
D) neither A nor B

Question 61

In digital certificate authentication,the verifier decrypts the challenge message with ________.

A) the supplicant's private key
B) the true party's private key
C) the supplicant's public key
D) the true party's public key

Question 62

Facial recognition is controversial because ________.

A) it can be fooled very easily
B) it can be used surreptitiously
C) both A and B
D) neither A nor B

Question 63

Fingerprint recognition is generally acceptable for ________.

A) laptops
B) corporate databases
C) resources involving private information about customers
D) all of the above

Question 64

Using SSL/TLS for Web applications is attractive because SSL/TLS ________.

A) is essentially free to use
B) offers the strongest possible cryptographic protections
C) both A and B
D) neither A nor B

Question 65

In digital certificate authentication,the supplicant encrypts the challenge message with ________.

A) the supplicant's private key
B) the verifier's private key
C) the true party's private key
D) none of the above

Question 66

The supplicant claims to be ________.

A) the true party
B) an impostor
C) either A or B
D) neither A nor B

Question 67

Authentication should generally be ________.

A) as strong as possible
B) appropriate for a specific resource
C) the same for all resources
D) different for every different resource

Question 68

In authentication,the ________ is the party trying to prove his or her identity.

A) supplicant
B) verifier
C) true party
D) all of the above

Question 69

For sensitive assets,reusable passwords ________.

A) should be especially long
B) should contain a truly complex mixture of characters
C) should be difficult to remember
D) should not be used

Question 70

The supplicant is ________.

A) the true party
B) an impostor
C) either A or B
D) neither A nor B

Question 71

Iris scanning is attractive because of its ________.

A) low cost
B) precision
C) both A and B
D) neither A nor B

Question 72

In digital certificate authentication,the verifier gets the key it needs directly from the ________.

A) supplicant
B) verifier
C) true party
D) certificate authority

Question 73

Biometrics,and other new authentication methods,are being created with the goal of getting rid of reusable passwords.

Question 74

NIST guidelines for reusable passwords permit ________.

A) entirely lower-case passwords
B) the use of the same password at different sites
C) both A and B
D) neither A nor B

Question 75

Requiring someone prove his or her identity is ________.

A) confidentiality
B) authentication
C) authorization
D) both B and C

Question 76

In authentication,________ are the general name for proofs of identity.

A) credentials
B) authorizations
C) digital certificates
D) all of the above

Question 77

Traditionally,we have told users that passwords ________.

A) should have a mix of characters (uppercase and lowercase letters, digits, other keyboard characters)
B) should be easy to remember
C) both A and B
D) neither A nor B

Question 78

For reusable passwords,NIST now recommends ________.

A) that passwords be easy to remember
B) that passwords should be changed monthly
C) both A and B
D) neither A nor B

Question 79

Using bodily measurements for authentication is ________.

A) illegal
B) biometrics
C) mandatory for good security
D) all of the above

Question 80

For reusable passwords,NIST now recommends ________.

A) that passwords be easy to remember
B) that passwords be long phrases instead of being about 8-12 characters long
C) both A and B
D) neither A nor B