INF4831 Information Security Comprehensive Review Examination 120 Questions
INF4831 Information Security
Comprehensive Review Examination
120 Questions | Detailed Rationales | Complete Coverage
<b>Examination</b> INF4831 Information Security
<b>Total Questions</b> 120
<b>Format</b> Multiple Choice (A-D)
<b>Cognitive Distribution</b> 30% Recall, 50% Application, 20% Analysis
<b>Content Coverage</b> CIA Triad, Risk Management, Network Security, Cryptography, Application Security, Clou
Instructions: Read each question carefully. Select the best answer from the options provided. Each question includes a detailed
rationale explaining the correct answer.
Page 1
,INF4831 Information Security Comprehensive Review Examination 120 Questions
1. Which access control model assigns permissions based on the user's role within an organization and enforces the
principle of separation of duties?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC) [CORRECT]
D. Rule-Based Access Control
Correct Answer: C
Rationale: This matches RBAC, which maps permissions to organizational roles rather than individual users, making it
especially effective for enforcing separation of duties and least privilege at the role level.
2. Which secure design principle recommends that security mechanisms should be simple, well-understood, and
thoroughly tested?
A. Economy of mechanism [CORRECT]
B. Fail-safe defaults
C. Complete mediation
D. Open design
Correct Answer: A
Rationale: This matches Saltzer and Schroeder's economy of mechanism principle, which states that simpler designs are easier to
verify and less likely to contain exploitable flaws.
3. Which type of surveillance technology uses card readers, keypads, or biometric devices to control and monitor entry
to secured areas?
A. Intrusion detection system
B. Physical access control system [CORRECT]
C. Network monitoring system
D. Video surveillance system
Correct Answer: B
Rationale: This matches physical access control systems, which use authentication mechanisms to regulate and track entry to
secure areas, creating an audit trail of physical access.
4. Which phase of the incident response process involves collecting and preserving evidence in a legally defensible
manner?
A. Preparation
B. Containment
C. Eradication
D. Forensic analysis and evidence collection [CORRECT]
Correct Answer: D
Rationale: Correct because the forensic analysis phase focuses on collecting, preserving, and analyzing evidence while
maintaining chain of custody to ensure legal admissibility.
5. An attacker researches an organization's personnel directory and sends targeted emails to specific employees that
appear to come from their IT department. Which attack is this?
A. Bulk phishing
B. Spear phishing [CORRECT]
C. Pharming
D. DNS spoofing
Correct Answer: B
Page 2
, INF4831 Information Security Comprehensive Review Examination 120 Questions
Rationale: Correct because spear phishing is a targeted attack that uses knowledge of the target's identity, role, and relationships
to craft convincing fraudulent communications.
6. During a threat modeling exercise, a team identifies that data flows between a web server and a database cross an
untrusted network boundary. Which countermeasure should be recommended FIRST?
A. Implement input validation on the web server
B. Encrypt the data in transit using TLS [CORRECT]
C. Install a host-based firewall on the database server
D. Implement database access logging
Correct Answer: B
Rationale: Priority is protecting data as it crosses an untrusted network boundary, making transport-layer encryption the most
critical first countermeasure for this specific threat.
7. Which environmental control is designed to protect against damage caused by electrostatic discharge (ESD) in data
centers?
A. Raised flooring
B. Humidity control and anti-static flooring [CORRECT]
C. Fire suppression systems
D. Uninterruptible power supplies
Correct Answer: B
Rationale: Correct because humidity control and anti-static materials reduce the buildup and discharge of static electricity,
protecting sensitive electronic components from ESD damage.
8. Tailgating is a physical security breach where an unauthorized person follows an authorized person through a secured
entrance. Which countermeasure is MOST effective against tailgating?
A. Security cameras
B. Mantraps or anti-tailgating turnstiles [CORRECT]
C. Security guards at the entrance
D. Visitor sign-in logs
Correct Answer: B
Rationale: Priority is physical access controls that enforce one-person-per-entry policies, as mantraps and turnstiles
mechanically prevent multiple individuals from passing through a single authorization event.
9. Endpoint Detection and Response (EDR) solutions differ from traditional antivirus by providing which additional
capability?
A. Signature-based malware detection only
B. Continuous monitoring, behavioral analysis, and automated response to threats [CORRECT]
C. File encryption for all endpoint data
D. Network traffic shaping and optimization
Correct Answer: B
Rationale: Correct because EDR goes beyond signature-based detection by continuously monitoring endpoint activity, analyzing
behavioral patterns, and providing automated investigation and response capabilities.
10. Immutable infrastructure in cloud environments refers to which security practice?
A. Servers that can be modified at runtime for patches
B. Infrastructure components that are replaced rather than modified, ensuring consistency and
auditability [CORRECT]
C. Using physical hardware that cannot be changed
D. Storing all data in read-only format permanently
Page 3
INF4831 Information Security
Comprehensive Review Examination
120 Questions | Detailed Rationales | Complete Coverage
<b>Examination</b> INF4831 Information Security
<b>Total Questions</b> 120
<b>Format</b> Multiple Choice (A-D)
<b>Cognitive Distribution</b> 30% Recall, 50% Application, 20% Analysis
<b>Content Coverage</b> CIA Triad, Risk Management, Network Security, Cryptography, Application Security, Clou
Instructions: Read each question carefully. Select the best answer from the options provided. Each question includes a detailed
rationale explaining the correct answer.
Page 1
,INF4831 Information Security Comprehensive Review Examination 120 Questions
1. Which access control model assigns permissions based on the user's role within an organization and enforces the
principle of separation of duties?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC) [CORRECT]
D. Rule-Based Access Control
Correct Answer: C
Rationale: This matches RBAC, which maps permissions to organizational roles rather than individual users, making it
especially effective for enforcing separation of duties and least privilege at the role level.
2. Which secure design principle recommends that security mechanisms should be simple, well-understood, and
thoroughly tested?
A. Economy of mechanism [CORRECT]
B. Fail-safe defaults
C. Complete mediation
D. Open design
Correct Answer: A
Rationale: This matches Saltzer and Schroeder's economy of mechanism principle, which states that simpler designs are easier to
verify and less likely to contain exploitable flaws.
3. Which type of surveillance technology uses card readers, keypads, or biometric devices to control and monitor entry
to secured areas?
A. Intrusion detection system
B. Physical access control system [CORRECT]
C. Network monitoring system
D. Video surveillance system
Correct Answer: B
Rationale: This matches physical access control systems, which use authentication mechanisms to regulate and track entry to
secure areas, creating an audit trail of physical access.
4. Which phase of the incident response process involves collecting and preserving evidence in a legally defensible
manner?
A. Preparation
B. Containment
C. Eradication
D. Forensic analysis and evidence collection [CORRECT]
Correct Answer: D
Rationale: Correct because the forensic analysis phase focuses on collecting, preserving, and analyzing evidence while
maintaining chain of custody to ensure legal admissibility.
5. An attacker researches an organization's personnel directory and sends targeted emails to specific employees that
appear to come from their IT department. Which attack is this?
A. Bulk phishing
B. Spear phishing [CORRECT]
C. Pharming
D. DNS spoofing
Correct Answer: B
Page 2
, INF4831 Information Security Comprehensive Review Examination 120 Questions
Rationale: Correct because spear phishing is a targeted attack that uses knowledge of the target's identity, role, and relationships
to craft convincing fraudulent communications.
6. During a threat modeling exercise, a team identifies that data flows between a web server and a database cross an
untrusted network boundary. Which countermeasure should be recommended FIRST?
A. Implement input validation on the web server
B. Encrypt the data in transit using TLS [CORRECT]
C. Install a host-based firewall on the database server
D. Implement database access logging
Correct Answer: B
Rationale: Priority is protecting data as it crosses an untrusted network boundary, making transport-layer encryption the most
critical first countermeasure for this specific threat.
7. Which environmental control is designed to protect against damage caused by electrostatic discharge (ESD) in data
centers?
A. Raised flooring
B. Humidity control and anti-static flooring [CORRECT]
C. Fire suppression systems
D. Uninterruptible power supplies
Correct Answer: B
Rationale: Correct because humidity control and anti-static materials reduce the buildup and discharge of static electricity,
protecting sensitive electronic components from ESD damage.
8. Tailgating is a physical security breach where an unauthorized person follows an authorized person through a secured
entrance. Which countermeasure is MOST effective against tailgating?
A. Security cameras
B. Mantraps or anti-tailgating turnstiles [CORRECT]
C. Security guards at the entrance
D. Visitor sign-in logs
Correct Answer: B
Rationale: Priority is physical access controls that enforce one-person-per-entry policies, as mantraps and turnstiles
mechanically prevent multiple individuals from passing through a single authorization event.
9. Endpoint Detection and Response (EDR) solutions differ from traditional antivirus by providing which additional
capability?
A. Signature-based malware detection only
B. Continuous monitoring, behavioral analysis, and automated response to threats [CORRECT]
C. File encryption for all endpoint data
D. Network traffic shaping and optimization
Correct Answer: B
Rationale: Correct because EDR goes beyond signature-based detection by continuously monitoring endpoint activity, analyzing
behavioral patterns, and providing automated investigation and response capabilities.
10. Immutable infrastructure in cloud environments refers to which security practice?
A. Servers that can be modified at runtime for patches
B. Infrastructure components that are replaced rather than modified, ensuring consistency and
auditability [CORRECT]
C. Using physical hardware that cannot be changed
D. Storing all data in read-only format permanently
Page 3
