Principles of Computer Security Exam
Materials
Course Introduction
Principles of Computer Security introduces the foundational concepts, technologies, and practices essential to protecting information systems against threats and vulnerabilities. This course explores key security principles such as confidentiality, integrity, availability, risk management, and access control. Students will examine common attack vectors, security policies, cryptographic methods, authentication processes, and security best practices for networks, operating systems, and applications. By understanding both offensive techniques and defensive strategies, students develop the skills necessary to implement and maintain robust security in modern computing environments.
Recommended Textbook
Computer Security Principles and Practice 2nd Edition by William Stallings
Available Study Resources on Quizplus
24 Chapters
1078 Verified Questions
1078 Flashcards
Source URL: https://quizplus.com/study-set/3971
Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79799
Sample Questions
Q1) ________ assures that a system performs its intended function in an unimpaired manner,free from deliberate or inadvertent unauthorized manipulation of the system.
A)System Integrity
B)Availability
C)Data Integrity
D)Confidentiality
Answer: A
Q2) __________ assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed.
A)Availability
B)Privacy
C)System Integrity
D)Data Integrity
Answer: B
Q3) A __________ is data appended to,or a cryptographic transformation of,a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery.
Answer: digital signature
To view all questions and flashcards with answers, click on the resource link above.
Page 3
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79788
Sample Questions
Q1) The original message or data that is fed into the algorithm is __________.
A)encryption algorithm
B)secret key
C)decryption algorithm
D)plaintext
Answer: D
Q2) A __________ processes the plaintext input in fixed-size blocks and produces a block of ciphertext of equal size for each plaintext block.
Answer: block cipher
Q3) Triple DES takes a plaintext block of 64 bits and a key of 56 bits to produce a ciphertext block of 64 bits.
A)True
B)False
Answer: False
Q4) The purpose of the __________ algorithm is to enable two users to securely reach agreement about a shared secret that can be used as a secret key for subsequent symmetric encryption of messages.
Answer: Diffie-Hellman Key Agreement
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79782
Sample Questions
Q1) User authentication is the fundamental building block and the primary line of defense.
A)True
B)False
Answer: True
Q2) Depending on the application,user authentication on a biometric system involves either verification or identification.
A)True
B)False
Answer: True
Q3) In a biometric scheme some physical characteristic of the individual is mapped into a digital representation.
A)True
B)False
Answer: True
Q4) A __________ authentication system attempts to authenticate an individual based on his or her unique physical characteristics.
Answer: biometric
Q5) The __________ is the pattern formed by veins beneath the retinal surface.
Answer: retinal pattern
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79781
Sample Questions
Q1) T F 4.External devices such as firewalls cannot provide access control services.
A)True
B)False
Q2) Security labels indicate which system entities are eligible to access certain resources.
A)True
B)False
Q3) __________ is based on the roles the users assume in a system rather than the user's identity.
A)DAC
B)RBAC
C)MAC
D)URAC
Q4) A __________ dictates that a user can only be assigned to a particular role if it is already assigned to some other specified role and can be used to structure the implementation of the least privilege concept.
Q5) The authentication function determines who is trusted for a given purpose. A)True
B)False
Q6) The basic elements of access control are: subject,__________,and access right.
Page 6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Database Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79780
Sample Questions
Q1) In relational database parlance,the basic building block is a __________,which is a flat table.
A)attribute B)tuple
C)primary key D)relation
Q2) The database management system operates on the assumption that the computer system has authenticated each user. A)True
B)False
Q3) In a relational database rows are referred to as _________. A)relations
B)attributes C)views D)tuples
Q4) A _________ is a virtual table. A)tuple B)query C)view D)DBMS
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79779
Sample Questions
Q1) A virus that attaches to an executable program can do anything that the program is permitted to do.
A)True
B)False
Q2) A bot can use a __________ to capture keystrokes on the infected machine to retrieve sensitive information.
Q3) A __________ uses macro or scripting code,typically embedded in a document and triggered when the document is viewed or edited,to run and replicate itself into other such documents.
A)boot sector infector
B)file infector
C)macro virus
D)multipartite virus
Q4) A __________ is a collection of bots capable of acting in a coordinated manner.
Q5) The ideal solution to the threat of malware is __________.
A)identification
B)removal
C)detection
D)prevention
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79778
Sample Questions
Q1) The best defense against broadcast amplification attacks is to block the use of _______ broadcasts.
Q2) ______ attempts to monopolize all of the available request handling threads on the Web server by sending HTTP requests that never complete.
A)HTTP
B)Reflection attacks
C)SYN flooding
D)Slowloris
Q3) Since filtering needs to be done as close to the source as possible by routers or gateways knowing the valid address ranges of incoming packets,an _______ is best placed to ensure that valid source addresses are used in all packets from its customers.
Q4) _______ bandwidth attacks attempt to take advantage of the disproportionally large resource consumption at a server.
A)Application-based
B)System-based
C)Random
D)Amplification
Q5) The standard protocol used for call setup in VoIP is the ________ Protocol.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79777
Sample Questions
Q1) Intrusion detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified.
A)True
B)False
Q2) A(n)________ event is an alert that is generated when the gossip traffic enables a platform to conclude that an attack is under way.
A)PEP
B)DDI
C)IDEP
D)IDME
Q3) A common location for a NIDS sensor is just inside the external firewall.
A)True
B)False
Q4) Snort can perform intrusion prevention but not intrusion detection.
A)True
B)False
Q5) The three classes of intruders are masquerader,clandestine user and _________.
Q6) An IDS comprises three logical components: analyzers,user interface and _____.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79776
Sample Questions
Q1) Snort Inline adds three new rule types: drop,reject,and _________.
Q2) Identified as a critical strong point in the network's security,the _________ serves as a platform for an application-level or circuit-level gateway.
Q3) The countermeasure to tiny fragment attacks is to discard packets with an inside source address if the packet arrives on an external interface.
A)True
B)False
Q4) ________ control controls access to a service according to which user is attempting to access it.
A)User
B)Direction
C)Service
D)Behavior
Q5) __________ scans for attack signatures in the context of a traffic stream rather than individual packets.
A)Pattern matching
B)Protocol anomaly
C)Traffic anomaly
D)Stateful matching
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79798
Sample Questions
Q1) A successful buffer overflow attack results in the loss of the function or service the attacked program provided.
A)True
B)False
Q2) The attacker can specify the return address used to enter code as a location somewhere in the run of NOPs,which is called a NOP ______.
Q3) The only consequence of a buffer overflow attack is the possible corruption of data used by the program.
A)True
B)False
Q4) Memory is requested from the ______ by programs for use in dynamic data structures,such as linked lists of records.
A)shell
B)heap
C)address space
D)ROM
Q5) ______ defenses aim to harden programs to resist attacks in new programs.
Q6) The _________ project produces a free,multiplatform 4.4BSD-based UNIX-like operating system.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79797
Sample Questions
Q1) There is a problem anticipating and testing for all potential types of non-standard inputs that might be exploited by an attacker to subvert a program.
A)True
B)False
Q2) A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.
Q3) __________ attacks are vulnerabilities involving the inclusion of script code in the HTML content of a Web page displayed by a user's browser.
A)PHP file inclusion
B)Mail injection
C)Code injection
D)Cross-site scripting
Q4) The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.
A)XSS reflection
B)chroot jail
C)atomic bomb
D)PHP file inclusion
To view all questions and flashcards with answers, click on the resource link above.
Page 13
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79796
Sample Questions
Q1) Ideally new systems should be constructed on an unprotected network in order to prevent installation restrictions.
A)True
B)False
Q2) ______ are resources that should be used as part of the system security planning process.
A)Texts
B)Online resources
C)Specific system hardening guides
D)All of the above
Q3) Security concerns that result from the use of virtualized systems include ______.
A)guest OS isolation
B)guest OS monitoring by the hypervisor
C)virtualized environment security
D)all of the above
Q4) Configuration information in Windows systems is centralized in the _______,which forms a database of keys and values.
Q5) The final step in the process of initially securing the base operating system is
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79795
Sample Questions
Q1) _________ is assurance that a system deserves to be trusted such that the trust can be guaranteed in some convincing way such as through formal analysis or code review.
A)TCB
B)Trustworthiness
C)Trusted computing
D)TPM
Q2) The Common Criteria for Information Technology and Security Evaluation are ISO standards for specifying security requirements and defining evaluation criteria.
A)True
B)False
Q3) Problems with providing strong computer security involve only the design phase.
A)True
B)False
Q4) _________ rules are built-in system security mechanisms that achieve the objectives of the certification rules.
Q5) "No read up" is also referred to as the _________ property.
Q6) A subject is said to have a security _________ of a given level.
Page 15
To view all questions and flashcards with answers, click on the resource link above.
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79794
Sample Questions
Q1) One asset may have multiple threats and a single threat may target multiple assets.
A)True
B)False
Q2) The _________ approach combines elements of the baseline,informal,and detailed risk analysis approaches.
Q3) Establishing security policy,objectives,processes and procedures is part of the ______ step.
A)plan
B)check
C)act
D)none of the above
Q4) IT security needs to be a key part of an organization's overall management plan.
A)True
B)False
Q5) The aim of the _________ process is to provide management with the information necessary for them to make reasonable decisions on where available resources will be deployed.
Page 16
Q6) _________ is sharing responsibility for the risk with a third party.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 15: It Security Controls, plans, and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79793
Sample Questions
Q1) An IT security ________ helps to reduce risks.
A)control
B)safeguard
C)countermeasure
D)all of the above
Q2) The follow-up stage of the management process includes _________.
A)maintenance of security controls
B)security compliance checking
C)incident handling
D)all of the above
Q3) Periodically reviewing controls to verify that they still function as intended,upgrading controls when new requirements are discovered,ensuring that changes to systems do not adversely affect the controls,and ensuring new threats or vulnerabilities have not become known are all ________ tasks.
A)security compliance
B)maintenance
C)incident handling
D)program management
Q4) Incident response is part of the ________ class of security controls.
Q5) A _________ on an organization's IT systems identifies areas needing treatment.
Page 17
To view all questions and flashcards with answers, click on the resource link above.
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79792
Sample Questions
Q1) ________ security protects computer-based data from software-based and communication-based threats.
A)Infrastructure
B)Premises
C)Physical
D)Logical
Q2) The optimal temperature for computer systems is between 10 and 32 degrees Fahrenheit.
A)True
B)False
Q3) _________ security,also called infrastructure security,protects the information systems that contain data and the people who use,operate,and maintain the systems.
Q4) Power utility problems can be grouped into three categories: undervoltage,overvoltage,and ________.
Q5) Unauthorized physical access can lead to other threats.
A)True
B)False
Q6) _______ threats encompass threats related to electrical power and electromagnetic emission.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79791
Sample Questions
Q1) Awareness only communicates information security policies and procedures that need to be followed and does not provide the foundation for any sanctions or disciplinary actions imposed for noncompliance.
A)True
B)False
Q2) Programmers,developers,and system maintainers require less advanced security training than other employees.
A)True
B)False
Q3) The _________ level focuses on developing the ability and vision to perform complex,multidisciplinary activities and the skills needed to further the IT security profession and to keep pace with threat and technology changes.
A)security basics and literacy
B)roles and responsibilities relative to IT systems
C)education and experience
D)security awareness
Q4) There is a need for a continuum of learning programs that starts with _______,builds to training,and evolves into education.
To view all questions and flashcards with answers, click on the resource link above.
Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79790
Sample Questions
Q1) Although important,security auditing is not a key element in computer security.
A)True
B)False
Q2) _________ audit trails may be used to detect security violations within an application or to detect flaws in the application's interaction with the system.
A)Application-level
B)System-level
C)User-level
D)None of the above
Q3) According to ISO 27002,the person(s)carrying out the audit should be independent of the activities audited.
A)True
B)False
Q4) ______ is detection of events within a given set of parameters,such as within a given time period or outside a given time period.
Q5) ________ audit trail traces the activity of individual users over time and can be used to hold a user accountable for his or her actions.
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79789
Sample Questions
Q1) Software is an example of real property.
A)True
B)False
Q2) ________ ensures that a user may make multiple uses of resources or services without others being able to link these uses together.
A)Anonymity
B)Pseudonymity
C)Unobservability
D)Unlinkability
Q3) A ______ is a word,name,symbol,or device that is used in trade with goods to indicate the source of the goods and to distinguish them from the goods of others.
A)copyright
B)patent
C)trademark
D)none of the above
Q4) The U.S.legal system distinguishes three primary types of property: real property,personal property,and _________ property.
Q5) The three types of patents are: utility patents,design patents,and ________.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79787
Sample Questions
Q1) A symmetric encryption scheme has five ingredients: plaintext,encryption algorithm,ciphertext,decryption algorithm and _________.
Q2) An encryption scheme is _________ if the cost of breaking the cipher exceeds the value of the encrypted information and/or the time required to break the cipher exceeds the useful lifetime of the information.
Q3) For general-purpose stream-oriented transmission you would typically use _______ mode.
A)CTR
B)CFB
C)ECB
D)CBC
Q4) The most powerful,and most common,approach to countering the threats to network security is ________.
Q5) In using encryption,we need to decide what to encrypt and where the encryption gear should be located.
A)True
B)False
Q6) The three most important symmetric block ciphers are: 3DES,AES,and _____.
Page 22
Q7) _________ is the process of attempting to discover the plaintext or key.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79786
Sample Questions
Q1) "Must support hash value lengths of 224,256,384,and 512 bits" and "algorithm must process small blocks at a time instead of requiring the entire message to be buffered in memory before processing it" are requirements for ________.
Q2) The purpose of the __________ algorithm is to enable two users to exchange a secret key securely that can then be used for subsequent encryption of messages.
Q3) NIST has published FIPS PUB 186,which is known as the ___________.
Q4) The _________ attack exploits the common use of a modular exponentiation algorithm in RSA encryption and decryption,but can be adapted to work with any implementation that does not run in fixed time.
A)mathematical
B)timing
C)chosen ciphertext
D)brute-force
Q5) A ________ attack involves trying all possible private keys.
A)mathematical
B)timing
C)brute-force
D)chosen ciphertext
Page 23
To view all questions and flashcards with answers, click on the resource link above.
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79785
Sample Questions
Q1) The recipient of a message can decrypt the signature using DSS and the sender's public DSS key.
A)True
B)False
Q2) _____ defines a number of content formats,which standardize representations for the support of multimedia e-mail.
A)MEM
B)MIME
C)MSC
D)DKIM
Q3) The basic tool that permits widespread use of S/MIME is ________.
A)the domain key
B)the public-key certificate
C)the MIME security payload
D)radix-64
Q4) The SSL record protocol provides two services for SSL connection: message integrity and _________.
Q5) An ADMD is an Internet e-mail provider.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 24
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79784
Sample Questions
Q1) The focus of _________ is defining an identity for each user,associating attributes with the identity,and enforcing a means by which a user can verify identity.
Q2) _______ is a minimal set of conventions for invoking code using XML over HTTP that enables applications to request services from one another with XML-based requests and receive responses as data formatted with XML.
A)SOAP
B)SAML
C)HTML
D)WS-Security
Q3) _______ is the process whereby a user first makes itself known to a CA prior to that CA issuing a certificate or certificates for that user.
A)Authorization
B)Registration
C)Certification
D)Initialization
Q4) An obvious security risk is that of impersonation.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Page 25
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79783
Sample Questions
Q1) In order to accelerate the introduction of strong security into WLANs the Wi-Fi Alliance promulgated ________,a set of security mechanisms that eliminates most 802.11 security issues,as a Wi-Fi standard.
A)WPA
B)WEP
C)RSN
D)MAC
Q2) The lowest layer of the IEEE 802 reference model is the __________ layer.
Q3) A ____________ attack involves persuading a user and an access point to believe that they are talking to each other when in fact the communication is going through an intermediate attacking device.
Q4) The MPDU exchange for distributing pairwise keys is known as the _______.
A)pseudorandom function
B)cryptographic function
C)nonce
D)4-way handshake
Q5) The wireless environment consists of three components that provide point of attack: the wireless client,the transmission medium,and the _________.
Q6) The field following the MSDU field is referred to as the ___________.
Page 26
To view all questions and flashcards with answers, click on the resource link above.