INSTRUCTOR GUIDE & MULTIPLE-CHOICE QUIZZES
SECURITY IN COMPUTING
6TH EDITION
CHAPTER 1: INTRODUCTION
MULTIPLE-CHOICE QUIZZES
1. Which of the following is considered an asset in computer security?
A) Computer hardware
B) Operating system
C) Email messages
D) All of the above
Answer: D) All of the above
Explanation: In computer security, assets refer to items of value needing protection.
Computer hardware, such as the device and associated components, is considered an
asset. Software assets include the operating system, utilities, device handlers, and
applications like word processors, media players, and email handlers. Furthermore,
data items stored on the computer, such as email messages, photos, papers, projects,
and contact information, are also considered assets. Therefore, all options listed in the
question (computer hardware, operating system, and email messages) are assets in
computer security.
2. Which of the following factors affect the value of an asset?
A) Replacement cost and timing
B) User's perspective and storage capacity
C) Paper and ink cost and owner's identity
D) Protection level and availability
Answer: A) Replacement cost and timing
Explanation: The value of an asset depends on factors such as replacement cost and
timing. The replacement cost refers to the effort or expense required to replace the
asset if lost or damaged. Assets like computer data can be difficult or impossible to
replace, while items like DVDs can be easily replaced. Furthermore, the timing also
,affects asset value. For example, plans for a company's new product line are highly
valuable before the release, but their value decreases significantly once the product is
released.
3. Which of the following is a security property that falls under the C-I-A triad?
A) Auditability
B) Accountability
C) Availability
D) Authentication
Answer: C) Availability
Explanation: The C-I-A triad refers to confidentiality, integrity, and availability, which
are the three fundamental security properties. Availability is one of the aspects that
make a computer valuable. It represents the ability of a system to be accessible and
operational when needed. Therefore, option C correctly identifies availability as a
security property falling under the C-I-A triad.
4. What is the nature of threats in the computer world and in life in general?
A) They are limited and predictable
B) They are limitless and largely unpredictable
C) They are only caused by natural disasters
D) They can be completely protected against
Answer: B) They are limitless and largely unpredictable
Explanation: The number and kinds of threats in the computer world and life, in
general, are practically unlimited and largely unpredictable. The causes of harm are
limitless and reflect the unpredictable nature of events like natural disasters, accidents,
health issues, and random acts of violence. Due to the many possible causes of harm, it
is impossible to protect ourselves or our computers entirely against all of them.
5. Which of the following factors is necessary for an attack to succeed?
A) Method, opportunity, and motive
B) Method, vulnerability, and motive
C) Opportunity, vulnerability, and motive
D) Method, opportunity, and vulnerability
,Answer: A) Method, opportunity, and motive
Explanation: For an attack to succeed, the attacker must have three things: method,
opportunity, and motive. Method refers to the skills, knowledge, tools, and resources
needed to perpetrate the attack. Opportunity is the time and access required to execute
the attack. Motive refers to the reason or incentive for wanting to carry out the attack.
Without any of these factors, the attack will fail.
6. Which of the following is NOT a way to deal with harm in the context of security
controls?
A) Prevent it
B) Deter it
C) Recover from its effects
D) Enhance physical security
Answer: D) Enhance physical security
Explanation: There are various ways to deal with harm, including preventing it,
deterring it, mitigating its impact, detecting it, and recovering from its effects. Enhancing
physical security, such as building castles or fortresses, is provided as an example to
understand traditional ways of enhancing security but is not mentioned as one of the
ways to deal with harm in the context of security controls.
7. Which class of controls uses tangible elements to stop or block an attack?
A) Physical controls
B) Procedural controls
C) Technical controls
D) Logical controls
Answer: A) Physical controls
Explanation: Physical controls use something tangible, such as walls, fences, locks,
guards, and fire extinguishers, to stop or block an attack. These controls rely on
physical elements to provide security measures.
8. What is the advantage of using overlapping controls or defense in depth?
A) They are more cost-effective
B) They work in different ways with different results
, C) They require fewer resources to implement
D) They eliminate the need for other classes of controls
Answer: B) They work in different ways with different results
Explanation: It can be effective to use overlapping controls or defense in depth,
employing more than one control or more than one class of control to achieve
protection. The advantage of this approach is that different controls work in different
ways, providing complementary layers of security and increasing the overall
effectiveness of the security measures.
INSTRUCTOR GUIDE
EXERCISES
1. Distinguish between vulnerability, threat, and control.
A threat is a potential to do harm. A vulnerability is a means by which a threat
agent can cause harm. A control is a protective measure that prevents a
threat agent from exercising a vulnerability.
2. Theft usually results in some kind of harm. For example, if someone steals
your car, you may suffer financial loss, inconvenience (by losing your mode of
transportation), and emotional upset (because of invasion of your personal
property and space). List three kinds of harm a company might experience
from theft of computer equipment.
Ideal answers will include both tangible harm (loss of valuable property)
and intangible harm (loss of—and need to reconstruct—important
data).
3. List at least three kinds of harm a company could experience from
electronic espionage or unauthorized viewing of confidential company
materials.
Possible answers include loss of competitive edge, loss of trade secrets,
public embarrassment or harm to reputation, legal liability for failing to
uphold confidentiality agreements with third parties.
4. List at least three kinds of damage a company could suffer when the
integrity of a program or company data is compromised.
Possible answers include inability to perform necessary business
functions (because of software modification), public embarrassment (e.g., if
a website is defaced), loss of employees’ time (to find and correct
modifications), possible loss of life or serious harm (if safety-‐critical
software is modified).
SECURITY IN COMPUTING
6TH EDITION
CHAPTER 1: INTRODUCTION
MULTIPLE-CHOICE QUIZZES
1. Which of the following is considered an asset in computer security?
A) Computer hardware
B) Operating system
C) Email messages
D) All of the above
Answer: D) All of the above
Explanation: In computer security, assets refer to items of value needing protection.
Computer hardware, such as the device and associated components, is considered an
asset. Software assets include the operating system, utilities, device handlers, and
applications like word processors, media players, and email handlers. Furthermore,
data items stored on the computer, such as email messages, photos, papers, projects,
and contact information, are also considered assets. Therefore, all options listed in the
question (computer hardware, operating system, and email messages) are assets in
computer security.
2. Which of the following factors affect the value of an asset?
A) Replacement cost and timing
B) User's perspective and storage capacity
C) Paper and ink cost and owner's identity
D) Protection level and availability
Answer: A) Replacement cost and timing
Explanation: The value of an asset depends on factors such as replacement cost and
timing. The replacement cost refers to the effort or expense required to replace the
asset if lost or damaged. Assets like computer data can be difficult or impossible to
replace, while items like DVDs can be easily replaced. Furthermore, the timing also
,affects asset value. For example, plans for a company's new product line are highly
valuable before the release, but their value decreases significantly once the product is
released.
3. Which of the following is a security property that falls under the C-I-A triad?
A) Auditability
B) Accountability
C) Availability
D) Authentication
Answer: C) Availability
Explanation: The C-I-A triad refers to confidentiality, integrity, and availability, which
are the three fundamental security properties. Availability is one of the aspects that
make a computer valuable. It represents the ability of a system to be accessible and
operational when needed. Therefore, option C correctly identifies availability as a
security property falling under the C-I-A triad.
4. What is the nature of threats in the computer world and in life in general?
A) They are limited and predictable
B) They are limitless and largely unpredictable
C) They are only caused by natural disasters
D) They can be completely protected against
Answer: B) They are limitless and largely unpredictable
Explanation: The number and kinds of threats in the computer world and life, in
general, are practically unlimited and largely unpredictable. The causes of harm are
limitless and reflect the unpredictable nature of events like natural disasters, accidents,
health issues, and random acts of violence. Due to the many possible causes of harm, it
is impossible to protect ourselves or our computers entirely against all of them.
5. Which of the following factors is necessary for an attack to succeed?
A) Method, opportunity, and motive
B) Method, vulnerability, and motive
C) Opportunity, vulnerability, and motive
D) Method, opportunity, and vulnerability
,Answer: A) Method, opportunity, and motive
Explanation: For an attack to succeed, the attacker must have three things: method,
opportunity, and motive. Method refers to the skills, knowledge, tools, and resources
needed to perpetrate the attack. Opportunity is the time and access required to execute
the attack. Motive refers to the reason or incentive for wanting to carry out the attack.
Without any of these factors, the attack will fail.
6. Which of the following is NOT a way to deal with harm in the context of security
controls?
A) Prevent it
B) Deter it
C) Recover from its effects
D) Enhance physical security
Answer: D) Enhance physical security
Explanation: There are various ways to deal with harm, including preventing it,
deterring it, mitigating its impact, detecting it, and recovering from its effects. Enhancing
physical security, such as building castles or fortresses, is provided as an example to
understand traditional ways of enhancing security but is not mentioned as one of the
ways to deal with harm in the context of security controls.
7. Which class of controls uses tangible elements to stop or block an attack?
A) Physical controls
B) Procedural controls
C) Technical controls
D) Logical controls
Answer: A) Physical controls
Explanation: Physical controls use something tangible, such as walls, fences, locks,
guards, and fire extinguishers, to stop or block an attack. These controls rely on
physical elements to provide security measures.
8. What is the advantage of using overlapping controls or defense in depth?
A) They are more cost-effective
B) They work in different ways with different results
, C) They require fewer resources to implement
D) They eliminate the need for other classes of controls
Answer: B) They work in different ways with different results
Explanation: It can be effective to use overlapping controls or defense in depth,
employing more than one control or more than one class of control to achieve
protection. The advantage of this approach is that different controls work in different
ways, providing complementary layers of security and increasing the overall
effectiveness of the security measures.
INSTRUCTOR GUIDE
EXERCISES
1. Distinguish between vulnerability, threat, and control.
A threat is a potential to do harm. A vulnerability is a means by which a threat
agent can cause harm. A control is a protective measure that prevents a
threat agent from exercising a vulnerability.
2. Theft usually results in some kind of harm. For example, if someone steals
your car, you may suffer financial loss, inconvenience (by losing your mode of
transportation), and emotional upset (because of invasion of your personal
property and space). List three kinds of harm a company might experience
from theft of computer equipment.
Ideal answers will include both tangible harm (loss of valuable property)
and intangible harm (loss of—and need to reconstruct—important
data).
3. List at least three kinds of harm a company could experience from
electronic espionage or unauthorized viewing of confidential company
materials.
Possible answers include loss of competitive edge, loss of trade secrets,
public embarrassment or harm to reputation, legal liability for failing to
uphold confidentiality agreements with third parties.
4. List at least three kinds of damage a company could suffer when the
integrity of a program or company data is compromised.
Possible answers include inability to perform necessary business
functions (because of software modification), public embarrassment (e.g., if
a website is defaced), loss of employees’ time (to find and correct
modifications), possible loss of life or serious harm (if safety-‐critical
software is modified).
