SOLUTION MANUAL FOR
SECURITY AWARENESS APPLYING PRACTICAL C YBERSECURITY IN YOUR WORLD 6TH EDITION
BY MARK C IAMPA
CHAPTERS 1-6
CHAPTER 1
TABLE OF CONTENTS
Review Question Answers ...........................................................................................................................................2
Hands-On Project Solutions .......................................................................................................................................8
Project 1-1: Examine Data Breaches – Visual ..........................................................................................................8
Project 1-2: Configure Microsoft Windows Sandbox ...............................................................................................8
Project 1-3: Comparing Data Breach Notification Letters ........................................................................................8
Project 1-4: Are You a Victim? .................................................................................................................................8
Case Project Solutions .................................................................................................................................................9
Case Project 1-1: Personal Attack Experiences .........................................................................................................9
Case Project 1-2: Security Podcasts or Video Series ................................................................................................9
Case Project 1-3: Sources of Security Information ...................................................................................................9
,REVIEW QUESTION ANSWERS
1. Which of the following is NOT a reason why it is difficult to defend against today’s attackers?
a. Faster detection of vulnerabilities
b. Complexity of attack tools
c. Weak security update distribution
d. Greater sophistication of attacks
Answer: b
Analysis:
a. Incorrect. Faster detection of vulnerabilities is a valid reason for the difficulty in defending.
b. Correct. It is the simplicity, not complexity, of attack tools that makes it difficult to defend against
attackers.
c. Incorrect. Weak security update distribution is a valid reason for the difficulty in defending.
d. Incorrect. Greater sophistication of attacks is a valid reason for the difficulty in defending.
2. Which of the following accounts for the greatest difficulty in preventing attacks?
a. Availability and simplicity of attack tools
b. Delays in security updating
c. Distributed attacks
d. User confusion
Answer: d
Analysis:
a. Incorrect. Availability and simplicity of attack tools are not considered the greatest difficulty in
preventing attacks.
b. Incorrect. Delays in security updating are not considered the greatest difficulty in preventing
attacks.
c. Incorrect. Distributed attacks are not considered the greatest difficulty in preventing attacks.
d. Correct. The one factor that undoubtedly accounts for the greatest difficulty in preventing attacks
is user confusion. For many years, users have been called upon to make often difficult security
decisions and then perform complicated procedures on their devices—often with little information
to guide them.
3. In a general sense, what is security?
a. It is only available on specialized computers.
b. It is protection from only direct actions.
c. It is the steps necessary to protect a person or property from harm.
d. It is both an art and a science.
Answer: c
Analysis:
a. Incorrect. Security is available on all sorts of devices and not just on specialized computers.
b. Incorrect. Security is protection from both direct and indirect actions.
c. Correct. Sometimes security is defined as the state of being free from danger, which is the goal of
security. It is also defined as the measures taken to ensure safety, which is the process of security.
Since complete security can never be fully achieved, the focus of security is more often on the
process instead of the goal. In this light, security can be defined as the necessary steps to protect
from harm.
d. Incorrect. Security is considered both an art as well as a process.
4. Which of the following ensures that only authorized parties can view information?
a. Confidentiality
, b. Authorization
c. Integrity
d. Availability
Answer: a
Analysis:
a. Correct. Confidentiality ensures that only authorized parties can view the information.
b. Incorrect. Authorization is providing permission or approval to specific technology resources.
c. Incorrect. Integrity ensures that the information is correct and no unauthorized person or malicious
software has altered the data.
d. Incorrect. Availability ensures that data is accessible to only authorized users and not to
unapproved individuals.
5. Why can brokers command such a high price for what they sell?
a. Brokers are licensed professionals.
b. The attack targets are always wealthy corporations.
c. The vulnerability they uncover was previously unknown and is unlikely to be patched quickly.
d. Brokers work in teams and all the members must be compensated.
Answer: c
Analysis:
a. Incorrect. This reason is fictitious: brokers are not licensed professionals.
b. Incorrect. This reason is fictitious: attacks can target anyone, not just wealthy corporations.
c. Correct. The buyers are generally willing to pay a high price because this vulnerability is unknown
to the software vendor and thus is unlikely to be ―patched‖ until after new attacks based on it are
already widespread.
d. Incorrect. This reason is fictitious: brokers do not always work in teams.
6. Which of the following is NOT a successive layer in which information security is achieved?
a. Products
b. People
c. Policies and procedures
d. Purposes
Answer: d
Analysis:
a. Incorrect. Products is a valid layer: procedures enable people to understand how to use products to
protect information.
b. Incorrect. People is a valid layer: procedures enable people to understand how to use products to
protect information.
c. Incorrect. Policies and procedures is a valid layer: procedures enable people to understand how to
use products to protect information.
d. Correct. A purpose is not a successive layer in which information security is achieved.
7. What is a class of attacks by state actors that use innovative attack tools to silently extract data over an
extended period of time?
a. RPP
b. XLX
c. APT
d. GOR
Answer: c
, Analysis:
a. Incorrect. RPP is fictitious and does not exist.
b. Incorrect. XLX is fictitious and does not exist.
c. Correct. State actors are often involved in multiyear intrusion campaigns targeting highly sensitive
economic, proprietary, or national security information. This has created a new class of attacks
called Advanced Persistent Threat (APT). These attacks use innovative attack tools (advanced)
and once a system is infected, they silently extract data over an extended period of time
(persistent).
d. Incorrect. GOR is fictitious and does not exist.
8. What is a person or element that has the power to carry out a threat?
a. Threat actor
b. Agent
c. Risk exploiter
d. Cyber invader
Answer: a
Analysis:
a. Correct. A threat actor is a term used to describe individuals or entities who are responsible for
cyber incidents against the technology equipment of enterprises and users.
b. Incorrect. An agent is fictitious and does not exist.
c. Incorrect. A risk exploiter is fictitious and does not exist.
d. Incorrect. A cyber invader is fictitious and does not exist.
9. In cybersecurity, what is a flaw or weakness that allows an attacker to bypass security protections?
a. Access
b. Vulnerability
c. Worm hole
d. Access control
Answer: b
Analysis:
a. Incorrect. Access does not apply to a flaw or a weakness.
b. Correct. Vulnerability is the correct term for applying to a flaw or weakness that allows an
attacker to bypass security protections.
c. Incorrect. A worm hole does not apply to a flaw or a weakness.
d. Incorrect. Access control does not apply to a flaw or a weakness.
10. Which of the following ensures that individuals are who they claim to be?
a. Demonstration
b. Authentication
c. Accounting
d. Certification
Answer: b
Analysis:
a. Incorrect. Demonstration is a fictitious method of ensuring that individuals are who they claim to
be.
b. Correct. Authentication ensures that the person is who she claims to be and not an impostor.
c. Incorrect. Accounting provides tracking or an audit trail of events.
d. Incorrect. The term ―certification‖ does not apply in the context of ensuring individuals.
SECURITY AWARENESS APPLYING PRACTICAL C YBERSECURITY IN YOUR WORLD 6TH EDITION
BY MARK C IAMPA
CHAPTERS 1-6
CHAPTER 1
TABLE OF CONTENTS
Review Question Answers ...........................................................................................................................................2
Hands-On Project Solutions .......................................................................................................................................8
Project 1-1: Examine Data Breaches – Visual ..........................................................................................................8
Project 1-2: Configure Microsoft Windows Sandbox ...............................................................................................8
Project 1-3: Comparing Data Breach Notification Letters ........................................................................................8
Project 1-4: Are You a Victim? .................................................................................................................................8
Case Project Solutions .................................................................................................................................................9
Case Project 1-1: Personal Attack Experiences .........................................................................................................9
Case Project 1-2: Security Podcasts or Video Series ................................................................................................9
Case Project 1-3: Sources of Security Information ...................................................................................................9
,REVIEW QUESTION ANSWERS
1. Which of the following is NOT a reason why it is difficult to defend against today’s attackers?
a. Faster detection of vulnerabilities
b. Complexity of attack tools
c. Weak security update distribution
d. Greater sophistication of attacks
Answer: b
Analysis:
a. Incorrect. Faster detection of vulnerabilities is a valid reason for the difficulty in defending.
b. Correct. It is the simplicity, not complexity, of attack tools that makes it difficult to defend against
attackers.
c. Incorrect. Weak security update distribution is a valid reason for the difficulty in defending.
d. Incorrect. Greater sophistication of attacks is a valid reason for the difficulty in defending.
2. Which of the following accounts for the greatest difficulty in preventing attacks?
a. Availability and simplicity of attack tools
b. Delays in security updating
c. Distributed attacks
d. User confusion
Answer: d
Analysis:
a. Incorrect. Availability and simplicity of attack tools are not considered the greatest difficulty in
preventing attacks.
b. Incorrect. Delays in security updating are not considered the greatest difficulty in preventing
attacks.
c. Incorrect. Distributed attacks are not considered the greatest difficulty in preventing attacks.
d. Correct. The one factor that undoubtedly accounts for the greatest difficulty in preventing attacks
is user confusion. For many years, users have been called upon to make often difficult security
decisions and then perform complicated procedures on their devices—often with little information
to guide them.
3. In a general sense, what is security?
a. It is only available on specialized computers.
b. It is protection from only direct actions.
c. It is the steps necessary to protect a person or property from harm.
d. It is both an art and a science.
Answer: c
Analysis:
a. Incorrect. Security is available on all sorts of devices and not just on specialized computers.
b. Incorrect. Security is protection from both direct and indirect actions.
c. Correct. Sometimes security is defined as the state of being free from danger, which is the goal of
security. It is also defined as the measures taken to ensure safety, which is the process of security.
Since complete security can never be fully achieved, the focus of security is more often on the
process instead of the goal. In this light, security can be defined as the necessary steps to protect
from harm.
d. Incorrect. Security is considered both an art as well as a process.
4. Which of the following ensures that only authorized parties can view information?
a. Confidentiality
, b. Authorization
c. Integrity
d. Availability
Answer: a
Analysis:
a. Correct. Confidentiality ensures that only authorized parties can view the information.
b. Incorrect. Authorization is providing permission or approval to specific technology resources.
c. Incorrect. Integrity ensures that the information is correct and no unauthorized person or malicious
software has altered the data.
d. Incorrect. Availability ensures that data is accessible to only authorized users and not to
unapproved individuals.
5. Why can brokers command such a high price for what they sell?
a. Brokers are licensed professionals.
b. The attack targets are always wealthy corporations.
c. The vulnerability they uncover was previously unknown and is unlikely to be patched quickly.
d. Brokers work in teams and all the members must be compensated.
Answer: c
Analysis:
a. Incorrect. This reason is fictitious: brokers are not licensed professionals.
b. Incorrect. This reason is fictitious: attacks can target anyone, not just wealthy corporations.
c. Correct. The buyers are generally willing to pay a high price because this vulnerability is unknown
to the software vendor and thus is unlikely to be ―patched‖ until after new attacks based on it are
already widespread.
d. Incorrect. This reason is fictitious: brokers do not always work in teams.
6. Which of the following is NOT a successive layer in which information security is achieved?
a. Products
b. People
c. Policies and procedures
d. Purposes
Answer: d
Analysis:
a. Incorrect. Products is a valid layer: procedures enable people to understand how to use products to
protect information.
b. Incorrect. People is a valid layer: procedures enable people to understand how to use products to
protect information.
c. Incorrect. Policies and procedures is a valid layer: procedures enable people to understand how to
use products to protect information.
d. Correct. A purpose is not a successive layer in which information security is achieved.
7. What is a class of attacks by state actors that use innovative attack tools to silently extract data over an
extended period of time?
a. RPP
b. XLX
c. APT
d. GOR
Answer: c
, Analysis:
a. Incorrect. RPP is fictitious and does not exist.
b. Incorrect. XLX is fictitious and does not exist.
c. Correct. State actors are often involved in multiyear intrusion campaigns targeting highly sensitive
economic, proprietary, or national security information. This has created a new class of attacks
called Advanced Persistent Threat (APT). These attacks use innovative attack tools (advanced)
and once a system is infected, they silently extract data over an extended period of time
(persistent).
d. Incorrect. GOR is fictitious and does not exist.
8. What is a person or element that has the power to carry out a threat?
a. Threat actor
b. Agent
c. Risk exploiter
d. Cyber invader
Answer: a
Analysis:
a. Correct. A threat actor is a term used to describe individuals or entities who are responsible for
cyber incidents against the technology equipment of enterprises and users.
b. Incorrect. An agent is fictitious and does not exist.
c. Incorrect. A risk exploiter is fictitious and does not exist.
d. Incorrect. A cyber invader is fictitious and does not exist.
9. In cybersecurity, what is a flaw or weakness that allows an attacker to bypass security protections?
a. Access
b. Vulnerability
c. Worm hole
d. Access control
Answer: b
Analysis:
a. Incorrect. Access does not apply to a flaw or a weakness.
b. Correct. Vulnerability is the correct term for applying to a flaw or weakness that allows an
attacker to bypass security protections.
c. Incorrect. A worm hole does not apply to a flaw or a weakness.
d. Incorrect. Access control does not apply to a flaw or a weakness.
10. Which of the following ensures that individuals are who they claim to be?
a. Demonstration
b. Authentication
c. Accounting
d. Certification
Answer: b
Analysis:
a. Incorrect. Demonstration is a fictitious method of ensuring that individuals are who they claim to
be.
b. Correct. Authentication ensures that the person is who she claims to be and not an impostor.
c. Incorrect. Accounting provides tracking or an audit trail of events.
d. Incorrect. The term ―certification‖ does not apply in the context of ensuring individuals.
