stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
COMP2108 Midterm Flashcards | StudBud
Explore
/
COMP2108 Midterm
COMP2108 Midterm
53 terms
·
StudBud Administration
·
7 plays
Imported from external platform
Flashcards
53 cards
F
Practice quiz
P
Host live
L
Questions
53
Answers
1
Shoulder surfing is an example of a password capture attack.
True
False
2
Attack aiming to break into any account by trying many or all accounts.
Trawling Attack
Targeted Attack
3
For Brute-Force Guessing, what is the success of guessing correctly on average?
b/2n
b/2
bn/2
4
Storing passwords in a hashed format prevents all types of attacks.
False
True
5
Which of the following is NOT a direct approach to defeating password authentication?
Two-factor authentication
Password capture attacks
Online password guessing
Offline password guessing
6
Salt and Peppers can be used together.
False
True
7
Cryptographic tools and primitives can help achieve which of the 6 high-level computer security goals?
Confidentiality
Authentication
Authorization
Integrity
8
What is the main purpose of a cryptographic hash function?
Generate a fixed-length output from any input
Encrypt messages
Generate random numbers
Compress files
9
If an attacker can make G guesses pet time T time units, what is the probability of a password being guessed if GT > R?
0
0.5
1.0
10
Why are user-chosen passwords often vulnerable?
They are too long
They are hashed before storage
They are stored securely
They follow predictable patterns and are not random
11
Why do secret questions fail as a security measure?
People forget their answers over time
All of the above
Answers can often be found online
Answers can be easily guessed due to limited choices
12
Secret questions are considered a strong security measure.
True
False
13
It should be infeasible to find any pair of distinct inputs m
1
, m
2
such that H(m
1
) = H(m
2
).
(H3) Collision Resistance
(H1) One-Way Property (Preimage Resistance)
(H2) Second-Preimage Resistance
14
What is the output of a cryptographic hash function commonly called?
Encryption key
Digital signature
Hash value or message digest
Plaintext
15
Which technique helps defend against offline password attacks?
Using shorter passwords
Rate-limiting
Password stretching
Storing passwords in plain text
16
Determining whether a requested privilege or resource access should be granted to the requesting entity.
Identification
Accountability
Authentication
Authorization
17
Why is accountability important in cybersecurity?
It helps track and identify who is responsible for actions
It ensures high system availability
It ensures unauthorized users cannot access data
It protects against integrity violations
18
It should be infeasible to find any m such that H(m) = h.
(H3) Collision Resistance
(H1) One-Way Property (Preimage Resistance)
(H2) Second-Preimage Resistance
19
Which of the following is an example of authorization?
Entering a password to log in
An administrator granting file access to a specific user
Checking a document for alterations
Encrypting a message before sending
20
Non-public information remaining accessible only to authorized parties, whether stored or in transit.
Accountability
Confidentiality
Integrity
Availability
21
The process of using supportive evidence to corroborate an asserted identity.
Authorization
Identification
Authentication
Accountability
22
The property of data, software or hardware remaining unaltered, except by authorized parties.
Integrity
Accountability
Confidentiality
Availability
23
A hacker modifies the contents of a file without permission. Which security principle has been violated?
Availability
Integrity
Authentication
Confidentiality
24
Using a phone number as a backup for password recovery adds an extra layer of security.
False
True
25
Passwords are the strongest form of authentication.
True
False
26
Which of the following helps protect data integrity?
Multi-factor authentication
Backup storage
Firewalls
Cryptographic checksums
27
What is a common defense against online password attacks?
Using simple passwords
Rate-limiting and throttling login attempts
Storing passwords in plain text
Allowing unlimited login attempts
28
What is the purpose of authorization?
To verify the identity of a principal
To ensure data integrity
To restrict access to computing resources based on permissions
To prevent denial-of-service attacks
29
A hash value is an efficiently computable, compact representation intended, and to associated with a unique input.
False
True
30
What is the key difference between salt and pepper in password hashing?
Salt makes hashing faster
Salt is stored, but pepper is not
Pepper is used only in offline attacks
Salt is secret, while pepper is public
31
The ability to identify principles responsible for past actions.
Confidentiality
Accountability
Integrity
Availability
32
Assumed that an attacker has somehow acquired the system password hash file.
Offline Password Attack
Online Password Attack
33
What is the purpose of a recovery password link?
To store passwords securely
To authenticate users who forgot their passwords and allow them to reset it
To allow users to log in without a password
To provide an alternative login method
34
What is a salt?
A random t-bit value si that isn't stored
A random t-bit value si
35
Using a password manager can help users manage multiple complex passwords securely.
True
False
36
After hashing a password once with hash function H, rather than storing H(p
i
), the result is itself hashed again.
Password Stretching
Salt
Pepper
37
What does integrity in cybersecurity refer to?
Making resources available
Verifying a user's identity
Ensuring data remains unaltered except by authorized parties
Preventing unauthorized access
38
Storing secret question answers in plaintext is a good security practice.
True
False
39
Which of the following is a common method to ensure confidentiality?
Error detection codes
Data encryption
Transaction logging
Denial of service protection
40
Which of the following is NOT a common method of password recovery?
Using a secondary email
SMS verification code
Email recovery link
Guessing until correct
41
What is the primary goal of confidentiality in cybersecurity?
To maintain system availability
To ensure data is unaltered
To prevent unauthorized access to information
To verify user identities
42
What is a key concern of availability in cybersecurity?
Verifying data integrity
Ensuring resources are accessible to authorized users
Encrypting stored files
Preventing unauthorized access
43
A human attacker or automated program is assumed to know one or more valid userids.
Offline Password Attack
Online Password Attack
44
What is the main goal of authentication?
To prevent denial-of-service attacks
To grant access to computing resources
To verify that a principal is who they claim to be
To ensure data remains unaltered
45
What is the main risk of storing passwords in cleartext?
Hackers can easily steal and use them
It makes logging in slower
It takes too much storage space
Users might forget them
46
Email recovery links require users to enter their old password before resetting.
False
True
47
Given any first input m
1
, it should be infeasible to find any distinct second input m
2
such that H(m
1
) = H(m
2
).
(H2) Second-Preimage Resistance
(H3) Collision Resistance
(H1) One-Way Property (Preimage Resistance)
48
The property of information, services and computing resources remaining accessible for authorized use.
Availability
Accountability
Confidentiality
Integrity
49
Establishes an identity from available information without an explicit identity having been asserted.
Authorization
Identification
Accountability
Authentication
50
Attack specifically aimed at pre-identified users.
Trawling Attack
Targeted Attack
51
Which of the following is an example of a poor secret question?
All of the above
"What is your favorite color?"
"What is the name of your high school?"
"What is your mother’s maiden name?"
52
What is a major security issue with secret questions?
They are too expensive to implement
They take too long to answer
They are difficult for users to remember
They are often stored as plaintext
53
Requiring multiple secret questions improves security without any drawbacks.
False
True
