Access Control and Encryption Policies Quiz

<p>They can become excessively large and complex (C)</p> Signup and view all the answers

<p>It helps ensure consistent access rights for new users (B)</p> Signup and view all the answers

<p>The risk of key interception during sharing (B)</p> Signup and view all the answers

<p>The corresponding private key (A)</p> Signup and view all the answers

<p>They can be freely shared and published (B)</p> Signup and view all the answers

<p>A copy of the same encryption key (C)</p> Signup and view all the answers

<p>It requires the key to be securely exchanged between parties (B)</p> Signup and view all the answers

<p>It utilizes a pair of different keys for different processes (D)</p> Signup and view all the answers

<p>All past and future messages can be read (A)</p> Signup and view all the answers

<p>Private key (A)</p> Signup and view all the answers

<p>What data is collected and its purpose (B)</p> Signup and view all the answers

<p>It is a legal requirement to protect user rights (C)</p> Signup and view all the answers

<p>Data must be deleted if a user deletes their account (D)</p> Signup and view all the answers

<p>Discovery and error correction (A)</p> Signup and view all the answers

<p>Data must only be stored in countries with strong data laws (A)</p> Signup and view all the answers

<p>A privacy policy for data management (A)</p> Signup and view all the answers

<p>Maintaining secure storage to prevent unauthorized access (C)</p> Signup and view all the answers

<p>The potential for future marketing (B)</p> Signup and view all the answers

<p>To generate a common encryption key without direct exchange (C)</p> Signup and view all the answers

<p>HTTPS (C)</p> Signup and view all the answers

<p>Data stored without being accessed (B)</p> Signup and view all the answers

<p>It slows down system response time. (B)</p> Signup and view all the answers

<p>Thieves find it very difficult and expensive to use the data. (A)</p> Signup and view all the answers

<p>Knowledge-based authentication (A)</p> Signup and view all the answers

<p>By using the long random numbers they generated (B)</p> Signup and view all the answers

<p>Mobile device verification (C)</p> Signup and view all the answers

<p>Implementing a general search mechanism is impossible. (B)</p> Signup and view all the answers

<p>Password reuse across multiple sites (A)</p> Signup and view all the answers

<p>Encrypts the data before it gets processed (D)</p> Signup and view all the answers

<p>Attribute-based authentication (B)</p> Signup and view all the answers

<p>At least two different authentication methods (A)</p> Signup and view all the answers

<p>Using passwords that are easy to remember (B)</p> Signup and view all the answers

<p>They often need a password recovery mechanism (A)</p> Signup and view all the answers

<p>Phishing attack (D)</p> Signup and view all the answers

<p>To keep users logged in during a session (A)</p> Signup and view all the answers

<p>Cross-site scripting attacks and traffic monitoring (C)</p> Signup and view all the answers

<p>Using multi-factor authentication for sensitive actions (D)</p> Signup and view all the answers

<p>By protecting session cookies from being intercepted (C)</p> Signup and view all the answers

<p>Using ineffective passwords for user accounts (D)</p> Signup and view all the answers

<p>It uses numerous hijacked computers to overwhelm a service (C)</p> Signup and view all the answers

<p>To ensure users are logged out in case of inactivity (A)</p> Signup and view all the answers

<p>System unavailability for legitimate users (C)</p> Signup and view all the answers

A type of attack where an attacker obtains a user's session cookie and uses it to impersonate them.

An attack that uses malware to steal session cookies from a user's device.

An attack that involves monitoring traffic between a user and a server to identify and capture session cookies.

A type of attack that aims to make a system unavailable for normal use by overloading it with requests.

A type of DoS attack where many compromised computers (botnet) simultaneously target a server.

Encrypting network traffic between a client and server to make it difficult for attackers to monitor.

A security measure that requires users to provide multiple forms of identification (e.g., password and code from phone).

Setting a short time limit for a user session, automatically ending it if there's no activity.

A set of rules that outlines who has access to what information and what actions they are allowed to perform.

A table that maps users to resources and specifies their permissions.

The process of explicitly defining user access rights based on rules and policies.

A breach of security that can lead to legal consequences if the access control policy doesn't comply with data protection regulations.

Default access rights are automatically granted to new users based on their predefined role or group.

Authentication method that relies on the user remembering a secret piece of information, typically a password.

Authentication method that relies on the user possessing a physical device, like a phone, which can generate or display information known to the system.

Authentication method that relies on a unique biometric attribute of the user, like a fingerprint, which is registered with the system.

A type of attack that aims to trick users into revealing their passwords by using fake websites or emails that appear legitimate.

A situation where users use the same password for multiple accounts. If one account is compromised, it can lead to breaches in other accounts.

A common problem where users forget their passwords, requiring a reset mechanism.

A situation where users choose passwords that are simple or easy to guess, making it easier for attackers to compromise their accounts.

A security measure that combines two or more authentication methods, requiring users to provide more than one piece of evidence to prove their identity.

An encryption method where the same key is used to both encrypt and decrypt data.

A type of encryption where different keys are used for encryption and decryption. One key is public, the other is private.

The process of converting plain text into an unreadable format using an encryption key.

The process of converting encrypted text back into its original readable form using a decryption key.

A secret code that is used to encrypt and decrypt data.

In symmetric encryption, both parties need to securely share the same secret key.

This is the key that can be shared publicly, allowing anyone to encrypt messages.

This is the key that must be kept secret, used to decrypt messages that were encrypted with its corresponding public key.

The transmission of data between a client and a server is protected using cryptographic techniques. It's like putting a lock on your mail before sending it.

Data that is stored on devices is encrypted, making it difficult for unauthorized individuals to access it. Imagine locking your important files in a safe.

The process of encrypting data that is being actively used by a computer system. Protecting data even when it's being actively used.

A secure method for establishing shared encryption keys between a client and a server without exchanging those keys directly. It's like exchanging secret codes without revealing them.

A secure protocol that ensures the confidentiality and integrity of data transmitted over the internet using HTTPS. It's like putting a secure lock on your web browser.

A process that uses cryptography to transform data into an unintelligible form. It's like scrambling a message so only someone with the key can understand it.

Data protection laws are regulations that govern how personal information is collected, stored, and used by organizations. They exist to protect individuals' privacy and ensure responsible data handling.

Data subjects have the right to access, correct, or delete their personal data held by organizations. They also have the right to restrict or object to the processing of their data.

A data controller is an organization that is responsible for collecting and processing personal data. They are accountable for complying with data protection laws and ensuring the security of data.

A privacy policy is a document that outlines how an organization collects, uses, and protects users' personal information. It should be clear, concise, and easily accessible to users.

Data protection principles ensure that personal information is processed fairly, lawfully, and transparently. These principles include awareness and control, purpose limitation, consent, data lifetime, secure storage, discovery and error correction, and location.

Awareness and control means users should be informed about what data is collected and have the ability to manage their personal information.

Purpose limitation means data should only be collected and used for specific, legitimate purposes that are clearly communicated to users.

Consent means organizations must obtain explicit permission from individuals before using their personal data for any purpose other than the original one.