CSC2570 - Exam Review (Part 1)

Question 1

This term refers to an action that causes a security violation to occur.

Accepted Answer

Attack

Question 2

This type of deception refers the presentation of false data to deceive an authorized entity.

Accepted Answer

Falsification

Question 3

This type of disruption hinders system operation without fully disabling them.

Accepted Answer

Obstruction

Question 4

This type of deception refers to an entity performing an action and then denying responsibility for it.

Accepted Answer

Repudiation

Question 5

Which of the following refers to the defensive side of cybersecurity?

Accepted Answer

Blue Team

Question 6

Which of the following refers to the states of a system which are considered secure?

Accepted Answer

Authorized States

Question 7

This type of disclosure refers to an unauthorized entity accessing data as it travels between authorized parties.

Accepted Answer

Interception

Question 8

This type of disclosure refers to an unauthorized entity circumventing security to gain access to stored data.

Accepted Answer

Intrusion

Question 9

The defender must defend all points, whereas the attacker can choose the weakest point.

Accepted Answer

True

Question 10

Offensive cyber operations are, by definition, illegal.

Accepted Answer

False

Question 11

This type of disclosure refers to an unauthorized entity indirectly accessing data by making reasonable assumptions.

Accepted Answer

Inference

Question 12

Zero-trust policies can be described as "never trust, always verify."

Accepted Answer

True

Question 13

This type of disruption fully disables some system component.

Accepted Answer

Incapacitation

Question 14

Which of the following permissions allows you to add to a file without modifying or deleting existing content?

Accepted Answer

Append (A)

Question 15

A security model is an explicit, formalized version of a security policy.

Accepted Answer

True

Question 16

This principle means: "The default state of a resource should be the state that is most secure."

Accepted Answer

Fail-Safe Defaults

Question 17

This standard involves ensuring that data is trustworthy and free from corruption or tampering.

Accepted Answer

Integrity

Question 18

This threat class refers to the falsification of data.

Accepted Answer

Deception

Question 19

Work factor can be easily calculated in computer systems.

Accepted Answer

False

Question 20

Which of the following is the implementation of a reference monitor?

Accepted Answer

Reference Validation Mechanism (RVM)

Question 21

This principle means: "An entity should be given only the privileges necessary to complete a task."

Accepted Answer

Least Privilege

Question 22

This principle means: "Security should not depend on secrecy."

Accepted Answer

Open Design

Question 23

This principle means: "Minimize the number of resources depended upon by multiple users."

Accepted Answer

Least Common Mechanism

Question 24

This term refers to an agent with the potential to inflict harm or cause a security violation.

Accepted Answer

Threat

Question 25

This type of disruption alters system operations by adversely modifying features or data.

Accepted Answer

Corruption

Question 26

Trust is a result of perception and is therefore the product of assumptions.

Accepted Answer

True

Question 27

Which of the following is the implementation that enforce security?

Accepted Answer

Mechanism

Question 28

Compromise recording refers to using detection methods in lieu of preventative methods.

Accepted Answer

True

Question 29

This principle means: "Require multiple conditions to grant a permission."

Accepted Answer

Separation of Privileges

Question 30

The defender's resources are limited; the attacker's resources are not.

Accepted Answer

False

Question 31

Government and/or military policies tend to prioritize which of the following?

Accepted Answer

Confidentiality

Question 32

Which of the following refers to the collection of all states relevant to security?

Accepted Answer

Protection States

Question 33

This threat class refers to preventing or interrupting legitimate access to a resource.

Accepted Answer

Disruption

Question 34

This type of disclosure refers to the direct release of sensitive data to unauthorized parties.

Accepted Answer

Exposure

Question 35

Attackers often look for assumptions of trust to find vulnerabilities.

Accepted Answer

True

Question 36

This standard involves preventing unauthorized parties from accessing information.

Accepted Answer

Confidentiality

Question 37

While defenders protect against known vulnerabilities, attackers can probe for unknown vulnerabilities.

Accepted Answer

True

Question 38

In most cases, defenders must play by the rules, whereas attackers can 'play dirty.'

Accepted Answer

True

Question 39

In cybersecurity, the defensive side often has the advantage.

Accepted Answer

False

Question 40

Which of the following is the concept of an abstract machine that mediates access control?

Accepted Answer

Reference Monitor (RM)

Question 41

Which of the following refers to the offensive side of cybersecurity?

Accepted Answer

Red Team

Question 42

This principle means: "Each access to an object must be validated every time it occurs."

Accepted Answer

Complete Mediation

Question 43

Which of the following are examples of security mechanisms? Select all that apply.

Accepted Answer

Multi-Factor Authentication (MFA), Security Guards, Encryption Algorithms, Firewall, Passwords, Intrusion Detection System (IDS)

Question 44

A capabilities list (CL) contains subjects and their associated permissions over objects.

Accepted Answer

True

Question 45

This threat class refers to entities gaining unauthorized access to information.

Accepted Answer

Disclosure

Question 46

This standard involves holding entities responsible for the actions they perform.

Accepted Answer

Accountability

Question 47

The defender must be constantly vigilant; the attacker can strike at will.

Accepted Answer

True

Question 48

Why are access control matrices (ACMs) impractical to implement literally? Select all that apply:

Accepted Answer

Large Amounts of Wasted Space, Redundant Information, Significant Memory Requirements, Low Scalability

Question 49

This term refers to a weakness in a system that may be exploited to cause a security violation.

Accepted Answer

Vulnerability

Question 50

This term refers to the likelihood that a weakness(s) will be exploited to cause harm.

Accepted Answer

Risk

Question 51

This type of usurpation involves an entity gaining logical or physical control over a resource.

Accepted Answer

Misappropriation

Question 52

This type of deception refers to one entity posing as another entity.

Accepted Answer

Masquerade

Question 53

Commercial policies tend to prioritize which of the following? Select all that apply.

Accepted Answer

Availability, Integrity

Question 54

This type of usurpation involves causing a system component to perform some detrimental action.

Accepted Answer

Misuse

Question 55

Which of the following provides a high-level statement of what is and is not allowed in a system?

Accepted Answer

Policy

Question 56

This principle means: "Keep a design as simple as possible."

Accepted Answer

Economy of Mechanism

Question 57

This threat class refers to entities gaining unauthorized control of a resource.

Accepted Answer

Usurpation

Question 58

This standard involves ensuring that resources are functional and can be accessed by authorized parties.

Accepted Answer

Availability

Question 59

This principle means: "Security mechanisms should not unreasonably affect legitimate users."

Accepted Answer

Psychological Acceptability

Question 60

An access control list (ACL) contains objects and the associated subjects that have permissions over them.

Accepted Answer

True

CSC2570 - Exam Review (Part 1)

Questions 60

CSC2570 - Exam Review (Part 1)

Questions 60