Fundamentals of Information Security Quiz
48 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What are the three primary components of the CIA Triad in Information Security?

  • Confidentiality, Integrity, Availability (correct)
  • Control, Integrity, Availability
  • Confidentiality, Intrusion, Availability
  • Confidentiality, Integrity, Authorization

What is the primary purpose of 'RAID' technology in data storage?

Data redundancy, performance improvement, or both

A stateful firewall only allows traffic that is part of a new or already established connection, while a packet filtering firewall examines the content of the traffic.

False (B)

What is the main goal of using a 'fuzzer' in security testing?

<p>To find vulnerabilities or weaknesses</p> Signup and view all the answers

The Gramm-Leach-Bliley Act (GLBA) focuses on protecting the privacy of customers' non-public personal information.

<p>True (A)</p> Signup and view all the answers

A brute force attack involves the use of multiple password attempts until the correct one is guessed.

<p>True (A)</p> Signup and view all the answers

The HIPAA law specifically governs the protection of information related to educational institutions.

<p>False (B)</p> Signup and view all the answers

Which component of the Parkerian Hexad is specifically concerned with the ownership or creator attribution of data?

<p>Authenticity (C)</p> Signup and view all the answers

In the context of attack types, which term describes an event that causes data to become unavailable or unusable?

<p>Interruption (C)</p> Signup and view all the answers

What is the correct order of steps in the risk management process?

<p>Identify Asset, Identify Threats, Assess Vulnerabilities, Assess Risk, Mitigate Risk (D)</p> Signup and view all the answers

Which type of authentication involves verifying a user based on their geographical location?

<p>Somewhere you are (C)</p> Signup and view all the answers

What process includes preparation activities performed before an incident occurs?

<p>Incident response (D)</p> Signup and view all the answers

Which of the following best defines a 'threat' in information security?

<p>Potential harmful event or action (B)</p> Signup and view all the answers

In mutual authentication, what is typically exchanged to verify each party?

<p>Digital certificates (D)</p> Signup and view all the answers

What is the primary objective of the containment process in incident management?

<p>To ensure the situation does not cause further damage (C)</p> Signup and view all the answers

Which act aims to promote the adoption of electronic health records by healthcare providers?

<p>Health Information Technology for Economic and Clinical Health (HITECH) (A)</p> Signup and view all the answers

Which access control model allows the system administrator to define access based on predetermined rules?

<p>Rule-based Access Control (D)</p> Signup and view all the answers

What is the primary purpose of compliance in an organizational context?

<p>To conform to relevant laws and regulations (C)</p> Signup and view all the answers

What does the principle of 'least privilege' aim to achieve in access control?

<p>Ensuring users have only necessary access rights (B)</p> Signup and view all the answers

In the context of access control, what does revoking access entail?

<p>Taking away access from a previously authorized user (D)</p> Signup and view all the answers

Which of the following describes the term 'phishing' in cybersecurity?

<p>An attack convincing a victim to provide personal information via email (A)</p> Signup and view all the answers

What does the term 'defense in-depth' refer to in security?

<p>Implementing multiple security measures to safeguard a system (C)</p> Signup and view all the answers

What is the main focus of post-incident activity in incident management?

<p>Determining the root cause and prevention strategies (B)</p> Signup and view all the answers

Which of the following is NOT a form of access control?

<p>Establishing backup media (B)</p> Signup and view all the answers

What kind of measures does a Network Intrusion Detection System (NIDS) specifically focus on?

<p>Monitoring for malicious activities within network traffic (B)</p> Signup and view all the answers

Which access control model gives the owner of the resources the authority to determine who gets access?

<p>Discretionary Access Control (DAC) (D)</p> Signup and view all the answers

What is a primary responsibility of accountability in access control?

<p>Making it possible to trace actions back to individuals (D)</p> Signup and view all the answers

Which term refers to measures taken to eliminate the effects of a security incident?

<p>Eradication (B)</p> Signup and view all the answers

What can be concluded about the confidentiality provided by hash functions?

<p>Hash functions provide integrity but not confidentiality. (C)</p> Signup and view all the answers

Which statement best describes digital signatures?

<p>They provide nonrepudiation for sent messages. (A)</p> Signup and view all the answers

What is the purpose of certificates in cryptography?

<p>To validate an individual's identity using a public key. (B)</p> Signup and view all the answers

What differentiates data at rest from data in motion?

<p>Data at rest is stored on a storage device, while data in motion is being transmitted. (A)</p> Signup and view all the answers

Which encryption method is the hardest to implement effectively?

<p>Encrypting data in use. (D)</p> Signup and view all the answers

What is a common characteristic of a DDoS attack?

<p>It overloads a network or website with traffic. (C)</p> Signup and view all the answers

What is the role of IPsec in network security?

<p>It creates a secure, encrypted tunnel between devices. (C)</p> Signup and view all the answers

Which of the following statements is true regarding keyless cryptography?

<p>It secures information using mathematical algorithms without a traditional key. (C)</p> Signup and view all the answers

How does the Family Educational Rights and Privacy Act (FERPA) protect individuals?

<p>By regulating the sharing of educational records and personally identifiable information. (D)</p> Signup and view all the answers

What distinguishes a man-in-the-middle attack from other cyber attacks?

<p>It intercepts and potentially alters communications between two parties. (B)</p> Signup and view all the answers

Which of the following best describes nonrepudiation?

<p>Confidently ensuring a user cannot deny an action (A)</p> Signup and view all the answers

What distinguishes an Intrusion Prevention System (IPS) from an Intrusion Detection System (IDS)?

<p>IPS takes action against threats, while IDS only monitors. (D)</p> Signup and view all the answers

Which of the following describes symmetric cryptography?

<p>Employs a single key for both encryption and decryption (C)</p> Signup and view all the answers

Which of the following is NOT a characteristic of Block Ciphers?

<p>Encrypts data one bit at a time (C)</p> Signup and view all the answers

Which of the following symmetric key algorithms is considered outdated and insecure?

<p>DES (A)</p> Signup and view all the answers

What is the primary function of Asymmetric Cryptography?

<p>To use public and private keys for encryption and decryption (B)</p> Signup and view all the answers

Which of the following protocols is primarily known for securing web and email traffic?

<p>PGP (B)</p> Signup and view all the answers

What key length options does AES support?

<p>128-bit, 192-bit, and 256-bit (B)</p> Signup and view all the answers

What is the main purpose of SSL and TLS protocols?

<p>To secure data transmission over networks (A)</p> Signup and view all the answers

Penetration testing is most accurately defined as?

<p>Simulating real-world attack techniques to identify vulnerabilities (C)</p> Signup and view all the answers

Flashcards

CIA Triad

A model of information security focusing on Confidentiality, Integrity, and Availability.

Confidentiality

Ensuring only authorized individuals access data.

Integrity

Maintaining data accuracy and preventing unauthorized changes.

Availability

Ensuring authorized users can access data when needed.

Signup and view all the flashcards

Parkerian Hexad

An expanded information security model, adding Possession, Authenticity, and Utility to the CIA Triad.

Signup and view all the flashcards

Threat

A potential danger or risk to an asset.

Signup and view all the flashcards

Vulnerability

A weakness in a system that can be exploited by a threat.

Signup and view all the flashcards

Authentication

Verifying a user's identity.

Signup and view all the flashcards

Mutual Authentication

Both parties in a transaction authenticate each other..

Signup and view all the flashcards

Risk Management Process

A structured approach to identifying, analyzing, and mitigating risks.

Signup and view all the flashcards

Incident Response Process

A structured approach to handling security incidents.

Signup and view all the flashcards

Authorization

Determining what accesses a user controls.

Signup and view all the flashcards

Least Privilege

Granting only the necessary access to perform a task.

Signup and view all the flashcards

Access Control

Managing who can access resources and how.

Signup and view all the flashcards

Network ACL

Rules governing network traffic.

Signup and view all the flashcards

Accountability

Ensuring actions are traceable to responsible parties.

Signup and view all the flashcards

Intrusion Detection (IDS)

Systems that monitor for malicious activity.

Signup and view all the flashcards

Intrusion Prevention (IPS)

Systems that take action against detected threats.

Signup and view all the flashcards

Symmetric Encryption

Using the same key for encryption and decryption.

Signup and view all the flashcards

Asymmetric Encryption

Using different keys for encryption and decryption.

Signup and view all the flashcards

Phishing

A social engineering attack tricking users into revealing sensitive info.

Signup and view all the flashcards

Tailgating

Unauthorized entry by following an authorized person.

Signup and view all the flashcards

Brute Force

Repeatedly trying passwords until correct.

Signup and view all the flashcards

Buffer Overflow

A vulnerability exploiting insufficient input validation.

Signup and view all the flashcards

SQL Injection

Injecting malicious code into SQL queries.

Signup and view all the flashcards

Cross-Site Scripting (XSS)

Injecting malicious script into web pages.

Signup and view all the flashcards

Discretionary Access Control (DAC)

A model where the owner of a resource controls who has access to it.

Signup and view all the flashcards

Mandatory Access Control (MAC)

A model where a separate authority (not the owner) determines access to resources.

Signup and view all the flashcards

Role-Based Access Control (RBAC)

A model where access is granted based on a user's role within an organization.

Signup and view all the flashcards

What are the three main principles of the CIA Triad?

Confidentiality, Integrity, and Availability are the three core principles. Confidentiality ensures only authorized individuals access data, integrity maintains data accuracy and prevents alterations, and availability guarantees authorized users can access data when needed.

Signup and view all the flashcards

What's a major difference between the CIA Triad and the Parkerian Hexad?

The Parkerian Hexad expands upon the CIA Triad by incorporating three additional principles: possession, authenticity, and utility. Possession refers to physical control of the data, authenticity verifies the data's source, and utility assesses the data's usefulness.

Signup and view all the flashcards

Interception Attack

An attacker gains unauthorized access to data, applications, or the network environment.

Signup and view all the flashcards

What's a Vulnerability?

A weakness in a system, application, or configuration that can be exploited by a threat to cause harm.

Signup and view all the flashcards

What is the purpose of Mutual Authentication?

Mutual authentication involves both parties in communication verifying each other's identities before exchanging data. This helps prevent 'man-in-the-middle' attacks where an attacker intercepts and alters communication.

Signup and view all the flashcards

Why is Risk Management Important?

Risk management is a structured process to identify, analyze, and mitigate potential threats and vulnerabilities to protect assets. It helps minimize potential damage and ensure security measures are effective.

Signup and view all the flashcards

What is an Incident Response Process?

The incident response process is a structured approach to handling security incidents. It includes preparation, detection, containment, eradication, recovery, and post-incident review.

Signup and view all the flashcards

HIPAA

A law requiring healthcare organizations to protect patient health information (PHI) confidentiality and integrity.

Signup and view all the flashcards

HITECH Act

Promotes electronic health record (EHR) adoption by healthcare providers to improve efficiency and data sharing.

Signup and view all the flashcards

SOX Act

Requires publicly traded companies to maintain accurate financial records and timely disclosures.

Signup and view all the flashcards

GLBA

Protects the privacy of customer financial information held by financial institutions.

Signup and view all the flashcards

PCI DSS

A set of security standards for companies that process credit card payments, to protect cardholder data.

Signup and view all the flashcards

Nonrepudiation

Ensuring that an individual cannot deny having made a statement or taken an action.

Signup and view all the flashcards

Intrusion Detection System (IDS)

A system that monitors network activity for malicious events and reports them.

Signup and view all the flashcards

Intrusion Prevention System (IPS)

A system that takes actions to prevent malicious events from occurring.

Signup and view all the flashcards

Auditing

The process of examining and reviewing an organization's records to ensure accountability.

Signup and view all the flashcards

Penetration Testing

Simulating a real-world attack to identify vulnerabilities in a system.

Signup and view all the flashcards

Cryptography

The practice of using codes and ciphers to secure information.

Signup and view all the flashcards

Symmetric Cryptography

Using the same key for both encryption and decryption.

Signup and view all the flashcards

Asymmetric Cryptography

Using a public key for encryption and a private key for decryption.

Signup and view all the flashcards

SSL (Secure Sockets Layer) and TLS (Transport Layer Security)

Protocols used to secure data transmission over networks by providing authentication and encryption.

Signup and view all the flashcards

What is the difference between IDS and IPS?

An IDS detects malicious activity and reports it, while an IPS takes action to prevent the activity from occurring.

Signup and view all the flashcards

Hash Function

A mathematical function that takes an input (message) and generates a fixed-length, unique output (hash) based on the input content. Hashes are used for integrity checks, ensuring the data hasn't been tampered with.

Signup and view all the flashcards

Keyless Cryptography

A method of securing data without using traditional keys. It relies on mathematical algorithms, like hash functions, to encrypt data, creating a unique 'signature' for it.

Signup and view all the flashcards

Digital Signature

A cryptographic technique used to verify the authenticity and integrity of a digital message. It ensures the message was sent by the expected sender and that it hasn't been tampered with during transmission.

Signup and view all the flashcards

Certificate

An electronic document that links a public key to a specific individual or organization. They act as digital identification, similar to a driver's license or passport.

Signup and view all the flashcards

IPsec and SSL VPN

Technologies that secure connections between devices by creating an encrypted tunnel. Think of sending data in a sealed, locked container.

Signup and view all the flashcards

Protecting Data at Rest

Securing data stored on devices like hard drives or servers. Often achieved through encryption.

Signup and view all the flashcards

Protecting Data in Motion

Securing data as it moves across networks, like when transferring a file or sending an email. Techniques like SSL VPN and TLS are used.

Signup and view all the flashcards

Protecting Data in Use

Securing data while it's being accessed or manipulated by users, which is often the most challenging aspect of data security.

Signup and view all the flashcards

DDOS Attack

A cyber attack where an attacker overwhelms a website or network with excessive traffic, making it inaccessible to legitimate users.

Signup and view all the flashcards

Man-in-the-Middle Attack

A type of cyber attack where an attacker intercepts communication between two parties, potentially reading, altering, or injecting false information.

Signup and view all the flashcards

Study Notes

Fundamentals of Information Security

  • CIA Triad: Confidentiality (only authorized access), Integrity (data unaltered), Availability (accessible when needed).
  • Parkerian Hexad: Confidentiality (authorized access), Integrity (unaltered without detection), Availability (accessible when needed), Possession (physical control of data), Authenticity (correct origin), Utility (usefulness of data).
  • Attack Types: Interception (affects confidentiality), Interruption (unavailable assets), Modification (tampering), Fabrication (false information).

Key Concepts, Identification, and Authorization

  • Authorization: Defining what a user can access, modify, and delete.

  • Least Privilege: Granting users only the minimum access required for their job.

  • Access Control: Allowing, denying, limiting, and revoking access to resources.

  • Access Control Models: Discretionary (DAC), Mandatory (MAC), Role-based (RBAC), Attribute-based (ABAC). Explains each by defining the entity that controls access, and what guides the process of resource access.

  • Accountability: Tracking actions for responsibility.

  • Nonrepudiation: Preventing denial of actions or statements

Access Control

  • Access Control List (ACL): Rules for permission on network traffic.

  • Cryptography: Using codes and ciphers for secure information.

    • Symmetric Cryptography: Uses a single key to encrypt and decrypt.
      • Block Cipher: Encrypts fixed-size blocks of data.
      • Stream Cipher: Encrypts data one bit at a time.
    • Asymmetric Cryptography: Uses a public and private key.
    • Secure Sockets Layer (SSL), Transport Layer Security (TLS): Protocols securing data transmission.

  • Hash Functions: Create unique hash values from data.

       -  Hashes provide integrity (not confidentiality) useful for verifying data integrity. Keyless cryptographic methods relying on mathematical algorithms to secure information.
    • Keyless Cryptography: Uses mathematical algorithms for security without a key.

  • Digital Signatures: Ensure message authenticity and prevent denial of sending.

  • Certificates: Link a public key to a specific entity, for electronic identification.

  • IPsec and SSL VPN: Technologies securing connections between devices.

Operations and Human Element Study

  • Pretexting: Convincing someone by impersonation.
  • Phishing: Tricking users with deceptive emails or websites.
  • Tailgating: Following an authorized person into a secure area.
  • Brute Force: Repeatedly trying passwords until correct.

Physical and Network Security

  • Physical Threats: Extreme temperatures, gases, liquids, living organisms, projectiles, movement, energy, people, toxins, and smoke or fire.

  • Defense-in-Depth: Using multiple security layers for protection.

  • RAID: Data storage technology improving redundancy, performance, and improvement.

  • Intrusive Detection System (IDS): Monitors networks, hosts, or applications for unauthorized activity.

  • Network Intrusion Detection System (NIDS): Detects malicious network activity.

  • Anti-Threat Software & Hosts: Includes firewalls, anti-virus, and spyware detection.

  • Network Segmentation: Dividing a network into smaller, more manageable units.

Protecting data at rest and in motion.

  • Data Protection at Rest: Encrypting data stored in a resting state.
  • Data Protection in Motion: Encrypting data during transmission.
  • SSL/TLS & DDOS Attacks: used in networks.

Laws and Regulations

  • FISMA (Federal Information Security Modernization Act): Protecting government information.
  • FERPA (Family Educational Rights and Privacy Act): Protecting student information.
  • HIPAA (Health Insurance Portability and Accountability Act): Protecting health information.
  • HITECH Act: Promoting health information technology adoption.
  • SOX (Sarbanes-Oxley Act): Financial records are accurate and timely revealed.
  • COPPA (Children's Online Privacy Protection Act): Protecting child data.
  • Gramm-Leach-Bliley Act (GLBA): Protecting customer information.
  • PCI DSS (Payment Card Industry Data Security Standard): Protecting credit card information.

Operating System and Application Security

  • OS Hardening: Reducing vulnerabilities through software removal, altering accounts, and timely updates.
  • Nessus: Vulnerability assessment tool identifying and assessing system vulnerabilities.
  • Buffer Overflows: Exploits insufficient data validation.
  • Race Conditions: Vulnerabilities where multiple processes access shared resources simultaneously.

Penetration Testing

  • Penetration Testing: Mimicking real-world attack methodologies in controlled environments.

Network Tools for Security

  • Firewalls: Controlling network traffic flow.
  • Packet Filtering: Allowing or blocking specified traffic types.
  • Stateful Firewalls: Monitoring connection states.
  • Deep Packet Inspection: Analyzing packet content.
  • Proxy Servers: Filtering traffic and serving as intermediaries.
  • DMZ (Demilitarized Zone): Separating internet-reachable services from the internal network.
  • Port Scanners (Nmap): Identifying open ports on a system.
  • Packet Sniffers (Wireshark, Tcpdump): Analyzing network traffic.
  • Honeypots: Systems designed to attract hackers and monitor their activities without affecting the safety of the main system.

Additional Security Tools

  • SQL injections and XSS (Cross-Site Scripting): Security vulnerabilities.
  • Fuzzers (Nikto or Wireshark): Security testing methodology.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

WGU C836 Study Guide PDF

Description

Test your understanding of essential concepts in information security, including the CIA Triad and the Parkerian Hexad. Explore key elements such as authorization, access control models, and types of attacks. This quiz will challenge your knowledge on how to protect and manage data effectively.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser