CSE 365: Final EXPECTED QUESTIONS WITH VERIFIED
ANSWERS
Question 1.
What does CIA stand for?
ANSWER
Confidentiality, Integrity, Availability
Question 2.
A business has an old system that needs to be restarted every night at 3AM. During the six minutes it
takes to restart, there is no password required to log in. Since no one is in the office and the system is
not used remotely, they're not too worried about this. What security principle does this violate?
ANSWER
Open Design
Question 3.
Which of the following are mechanisms for enforcing confidentiality?
ANSWER
Access Control & Encryption
Question 4.
If a virus takes control of the microphone in your smartphone, and listens to conversations you are
having, what computer security goal has been compromised?
ANSWER
Integrity
Question 5.
Which is NOT an element of calculating risk?
ANSWER
Cost
,Question 6.
What is one way(s) you might decide what risks to address first?
ANSWER
Calculate ROI and Rank them by severity
Question 7.
If integrity is the prima-
ry goal of an access control system, which model is most appropriate?
ANSWER
Biba Model
Question 8.
The potential issue with Hibernation files can be mitigated by?
ANSWER
Whole disk encryption
Question 9.
Brute Force Attack (most effective)
ANSWER
Large processing but limited storage
Question 10.
Dictionary Attack (most effective)
ANSWER
Large Storage but limited processing
Question 11.
Rainbow Tables (most effective)
ANSWER
Balanced storage and processing
,Question 12.
What was the underlying issue with the shellshock vulnerability?
ANSWER
A bug in the code and the fact that the system was unable to distinguish data from code
Question 13.
If you want a program to run as the owner without any other elevation of privilege, which permissions
would you set?
ANSWER
chmod 7xxx
Question 14.
What ways do botnets evade detection?
ANSWER
Rootkits, encryption, & compression
Question 15.
Which place is the safest place to store authorization role information?
ANSWER
Server side database
Question 16.
Which of the following represents a cross site request?
ANSWER
Clicking "like us on facebook" from a band's website
Question 17.
What is the best countermeasure for CSRF?
ANSWER
Using a secret token to validate transactions
, Question 18.
Which of the following are input channels that could lead to XSS vulnerabilities?
ANSWER
1. A login form for a web application that displays the username after login
2. A file that is uploaded to a web application that displays a directory of uploaded files
3. A social media site post form that allows comments using HTML markup to post images and
rich text
Question 19.
If DNS packets did not have a TTL flag in the DNS response, what problem(s) could be created?
ANSWER
1. DNS entries could resolve incorrectly for an indefinite time if a host's IP address changed
2. Spoofed entries could be cached forever, making it difficult to recover from a cache
poisoning attack
Question 20.
What is an attack that directs a DNS name to a malicious IP address that looks similar to site hosted at
the legitimate address called?
ANSWER
Pharming
Question 21.
What is the best countermeasure for SQL Injection Attacks?
ANSWER
Using Prepared Statements
Question 22.
Stream Cipher
ANSWER
Encrypted video, encrypted cell phone communication
ANSWERS
Question 1.
What does CIA stand for?
ANSWER
Confidentiality, Integrity, Availability
Question 2.
A business has an old system that needs to be restarted every night at 3AM. During the six minutes it
takes to restart, there is no password required to log in. Since no one is in the office and the system is
not used remotely, they're not too worried about this. What security principle does this violate?
ANSWER
Open Design
Question 3.
Which of the following are mechanisms for enforcing confidentiality?
ANSWER
Access Control & Encryption
Question 4.
If a virus takes control of the microphone in your smartphone, and listens to conversations you are
having, what computer security goal has been compromised?
ANSWER
Integrity
Question 5.
Which is NOT an element of calculating risk?
ANSWER
Cost
,Question 6.
What is one way(s) you might decide what risks to address first?
ANSWER
Calculate ROI and Rank them by severity
Question 7.
If integrity is the prima-
ry goal of an access control system, which model is most appropriate?
ANSWER
Biba Model
Question 8.
The potential issue with Hibernation files can be mitigated by?
ANSWER
Whole disk encryption
Question 9.
Brute Force Attack (most effective)
ANSWER
Large processing but limited storage
Question 10.
Dictionary Attack (most effective)
ANSWER
Large Storage but limited processing
Question 11.
Rainbow Tables (most effective)
ANSWER
Balanced storage and processing
,Question 12.
What was the underlying issue with the shellshock vulnerability?
ANSWER
A bug in the code and the fact that the system was unable to distinguish data from code
Question 13.
If you want a program to run as the owner without any other elevation of privilege, which permissions
would you set?
ANSWER
chmod 7xxx
Question 14.
What ways do botnets evade detection?
ANSWER
Rootkits, encryption, & compression
Question 15.
Which place is the safest place to store authorization role information?
ANSWER
Server side database
Question 16.
Which of the following represents a cross site request?
ANSWER
Clicking "like us on facebook" from a band's website
Question 17.
What is the best countermeasure for CSRF?
ANSWER
Using a secret token to validate transactions
, Question 18.
Which of the following are input channels that could lead to XSS vulnerabilities?
ANSWER
1. A login form for a web application that displays the username after login
2. A file that is uploaded to a web application that displays a directory of uploaded files
3. A social media site post form that allows comments using HTML markup to post images and
rich text
Question 19.
If DNS packets did not have a TTL flag in the DNS response, what problem(s) could be created?
ANSWER
1. DNS entries could resolve incorrectly for an indefinite time if a host's IP address changed
2. Spoofed entries could be cached forever, making it difficult to recover from a cache
poisoning attack
Question 20.
What is an attack that directs a DNS name to a malicious IP address that looks similar to site hosted at
the legitimate address called?
ANSWER
Pharming
Question 21.
What is the best countermeasure for SQL Injection Attacks?
ANSWER
Using Prepared Statements
Question 22.
Stream Cipher
ANSWER
Encrypted video, encrypted cell phone communication
