Basic Computer Security Concepts

Which of the following best describes the 'Principle of Easiest Penetration' in computer security?

Which of the following is an example of 'prevention' as a classification of security protection?

In the CIA triad, what does 'Integrity' primarily ensure?

Which of the following best illustrates the concept of 'Availability' in the context of the CIA triad?

In security terms, if a person attempts to access a data item, which of the following is that person referred to as?

According to [Welke & Mayfield], which of the following is considered a particular aspect of integrity?

A denial-of-service (DoS) attack is most directly an attack on which aspect of the CIA triad?

Which of the following is the primary focus of the AAA system in computer security?

In the context of computer security, what is the difference between a 'threat' and a 'vulnerability'?

Which of the following best describes 'interception' as a security threat?

Which security threat is exemplified by a 'man-in-the-middle' attack?

Which of the following is an example of 'fabrication' as a security threat?

In security terminology, what is the term for the potential that a threat will exploit a vulnerability?

Which of the following is an example of a 'nonhuman' threat?

Which of the following would be classified as a hardware vulnerability?

What is the primary purpose of 'encryption' as a method of defense in computer security?

Which type of attacker is characterized by deep knowledge of operating systems but no intention to intentionally break any system?

According to the Method-Opportunity-Motive framework, what three elements must an attacker have to ensure their success?

Ensuring that unauthorized users cannot access a system relates to which of the following?

Which of the following is NOT a strong characteristic of a good password?

Computer security focuses on protecting assets, where an asset only includes hardware components.

The principle of easiest penetration suggests that an intruder seeks the most complex and protected entry points.

Prevention involves using mechanisms to detect how an asset has been damaged.

In the context of credit card fraud, using encryption when placing an order is an example of detection.

The CIA triad focuses on assets from the end user's perspective.

Confidentiality ensures assets of computing systems are available only to authorized third parties; this is also known as obscurity.

In the context of security, 'access' only refers to reading data, and not to viewing or printing it.

In the context of computer security, 'object' refers to person, process, or program.

Data integrity means ensuring data is stored in such a way that allows modification by any user.

Availability refers to preventing legitimate users from accessing particular system resources or data.

Denial of service is the condition opposite to availability.

The AAA system (Authentication, Authorization, and Accounting) focuses on the system's assets point of view.

Authentication verifies what a user can access; authorization confirms the user's identity.

A vulnerability in a computing system is a circumstance that has the potential to cause loss or harm.

A threat is blocked by exercising control on a vulnerability.

In the context of security threats, 'interruption' refers to an unauthorized party gaining access to an asset.

In the context of security threats, 'fabrication' refers to an unauthorized party tampering or modifying an asset.

A 'threat agent' is the potential for harm in a system, whereas a 'vulnerability' is the individual or group attempting to exploit a weakness.

If the attacker intends to target any computer or user, it is a directed attack.

Using a mix of upper- and lower-case letters is a good way to defend a password from certain attacks.