The 'Availability' component of the CIA triad primarily focuses on ensuring that information is only accessible by authorized individuals.
Correct Answer
False
Availability ensures that authorized users can access information and systems when needed. The principle primarily focused on restricting access to authorized individuals is Confidentiality.
Question 2
Ensuring that data remains accurate and unaltered during storage and transmission is the main goal of the Integrity principle in the CIA triad.
Correct Answer
True
Integrity specifically addresses the trustworthiness and correctness of data, ensuring it has not been tampered with or corrupted.
Question 3
Biometric authentication methods, such as fingerprint or facial recognition, fall under the 'something you know' category of authentication factors.
Correct Answer
False
Biometric authentication falls under the 'something you are' category, as it uses inherent physical or behavioral characteristics of the user. 'Something you know' refers to knowledge-based factors like passwords.
Question 4
Multi-factor authentication (MFA) requires a user to provide at least two different types of authentication factors, such as a password and a fingerprint, to gain access.
Correct Answer
True
MFA combines two or more distinct authentication factors (e.g., something you know, something you have, something you are) to enhance security by requiring multiple proofs of identity.
Question 5
Symmetric encryption uses a distinct key for encrypting data and a different, but mathematically related, key for decrypting the same data.
Correct Answer
False
Symmetric encryption uses the *same* secret key for both encryption and decryption. The description given, using distinct but related keys, applies to asymmetric (public-key) encryption.
Question 6
Hashing is a reversible cryptographic process that converts data into a fixed-size string, primarily used to encrypt sensitive information for storage.
Correct Answer
False
Hashing is a *one-way* cryptographic process, meaning it is irreversible. Its primary use is for data integrity verification, not for encrypting data for confidentiality.
Question 7
A digital signature uses the sender's private key to encrypt a hash of the message, providing authentication and integrity for the transmitted data.
Correct Answer
True
Digital signatures are created by hashing the message and then encrypting the hash with the sender's private key, which verifies the sender's identity (authentication) and ensures the message hasn't been altered (integrity).
Question 8
Phishing attacks primarily target network infrastructure to disrupt services, rather than individual users.
Correct Answer
False
Phishing attacks are a form of social engineering that primarily targets *individual users* by deceiving them into revealing sensitive information or performing actions, often through fraudulent communications.
Question 9
A Distributed Denial of Service (DDoS) attack involves a single attacker overwhelming a server with traffic from one source.
Correct Answer
False
A DDoS attack uses *multiple, compromised systems* (a botnet) to launch a coordinated attack, making it harder to mitigate than a single-source Denial of Service (DoS) attack.
Question 10
SQL Injection is a common web application vulnerability where an attacker can execute malicious SQL statements to control a database server.
Correct Answer
True
SQL Injection exploits vulnerabilities in input validation, allowing attackers to manipulate database queries and potentially gain unauthorized access or control over the database.
Question 11
A computer virus is a standalone malicious program that replicates itself and spreads across computer networks without requiring a host program.
Correct Answer
False
A virus requires a *host program* to attach itself to and execute. A *worm* is the standalone malicious program that replicates and spreads independently across networks.
Question 12
Worms are a type of malware that can self-replicate and spread independently across networks without needing to attach to an existing program.
Correct Answer
True
This accurately describes a worm's primary characteristic: self-replication and independent network propagation, distinguishing it from a virus.
Question 13
Ransomware is a category of malware that encrypts a victim's files and demands payment, typically in cryptocurrency, for the decryption key.
Correct Answer
True
This is the defining characteristic of ransomware, which holds data hostage until a ransom is paid.
Question 14
A Trojan horse is a type of malware that disguises itself as legitimate software but contains a hidden malicious payload.
Correct Answer
True
This describes how a Trojan horse operates, deceiving users into executing it under the guise of legitimate software.
Question 15
A firewall primarily functions by encrypting all outgoing network traffic to prevent unauthorized eavesdropping.
Correct Answer
False
Firewalls primarily function by *filtering network traffic* based on predefined rules, controlling what enters and leaves a network. Encryption is typically handled by other mechanisms like VPNs or SSL/TLS.
Question 16
An Intrusion Detection System (IDS) is designed to actively block or prevent detected malicious network traffic from reaching its target.
Correct Answer
False
An IDS *detects* and alerts on malicious activity but does not actively block it. An Intrusion *Prevention* System (IPS) is designed to actively block or prevent detected threats.
Question 17
A Virtual Private Network (VPN) creates an encrypted tunnel over a public network, allowing secure remote access to private network resources.
Correct Answer
True
This is the core function of a VPN, providing confidentiality and integrity for communications over untrusted networks.
Question 18
Effective patch management involves regularly applying software updates and fixes to systems to address known vulnerabilities.
Correct Answer
True
Patch management is a crucial security practice for mitigating risks associated with software flaws and security vulnerabilities by keeping systems updated.
Question 19
Confidentiality ensures that data is protected from unauthorized modification or deletion.
Correct Answer
False
Confidentiality ensures that data is protected from *unauthorized access or disclosure*. Protection against unauthorized modification or deletion falls under the Integrity principle.
Question 20
A security token or smart card used for authentication is an example of the 'something you have' factor.
Correct Answer
True
Physical tokens or smart cards are tangible items a user possesses, fitting the 'something you have' category of authentication factors.
Question 21
A rootkit is a type of malware designed to encrypt a user's files and demand a ransom for their release.
Correct Answer
False
A rootkit is designed to *hide its presence* and the presence of other malicious software on a system, maintaining persistent access. The description given is for ransomware.
Question 22
Network segmentation involves dividing a computer network into smaller, isolated sub-networks to limit the spread of potential security breaches.
Correct Answer
True
Network segmentation is a key security strategy to contain threats and reduce the attack surface by isolating different parts of the network, preventing lateral movement of attackers.