ITPEC FE Security Questions with Answers — Page 2

Security

137 questions · Fundamental Engineering · 51–100

Apr 2023 · Question 42

Which of the following is residual risk?

a)Amount of risk that is reduced by implementing risk treatmentb)Risk that exists prior to performing any risk management activitiesc)Risk that is identified prior to implementing risk treatmentd)Risk that remains after implementing risk treatment

Apr 2023 · Question 43

Which of the following is a security measure that allows users to run potentially malicious programs on a system with the purpose of observing their behavior, while restricting the programs from accessing outside of the system?

a)Firewallb)Honeypotc)IPSd)Sandbox

Apr 2023 · Question 44

A packet filtering firewall is installed at the connection point of an internal network and the Internet. Which of the following is the appropriate combination of filtering rules that enables PCs on the internal network to access a web server on the Internet (port number 80)?

SourceDestinationSourceport numberDestinationport number

a)PCWeb serverWeb serverPC80801024 or higher1024 or higherb)PCWeb serverWeb serverPC801024 or higher1024 or higher80c)PCWeb serverWeb serverPC1024 or higher80801024 or higherd)PCWeb serverWeb serverPC1024 or higher1024 or higher8080

Apr 2023 · Question 45

When a sender from domain A sends an e-mail to a recipient in domain B, which of the following is used by the mail server in domain A for authenticating the sender?

a)APOPb)POP3Sc)S/MIMEd)SMTP-AUTH

Oct 2022 · Question 35

The three properties of information security are confidentiality, integrity, and availability. Which of the following is an attack on integrity?

a)DDoSb)Phishingc)Shoulder surfingd)Website defacement

Oct 2022 · Question 36

When a system with a database is being developed, a security requirement states that the data must be encrypted with a key before being saved to the database, and the same key is required for decryption when the data is being read. Which of the following is an appropriate algorithm that can be used to satisfy the security requirement?

a)AESb)Diffie-Hellmanc)RSAd)SHA-256

Oct 2022 · Question 37

Which of the following is a cyber-attack that redirects a victim to a fake website by manipulating DNS to obtain personal information from the victim?

a)Pharmingb)Phishingc)Spammingd)Trojan horse

Oct 2022 · Question 38

When security risk management processes incorporate the approach of the PDCA (Plan, Do, Check, Act) cycle, which of the following is a process that belongs to Act?

a)Establish a security policy and develop a security risk management plan.b)Implement the security risk management plan.c)Maintain and improve the security risk management plan by learning from incidents.d)Monitor the security risks as planned in the risk management plan.

Oct 2022 · Question 39

Which of the following is the protocol that is used together with HTTP in HTTPS?

a)SHAb)SSHc)TLSd)VPN

Oct 2022 · Question 40

Which of the following is an appropriate term associated with the fraudulent action of impersonating an authorized person?

a)Destructionb)Falsificationc)Spoofingd)Tapping

Oct 2022 · Question 41

An attacker calls a corporate help desk, masquerading as an employee who has forgotten his password. The help desk staff resets the password to the company default “password1.” The attacker then uses this password to access the company network and information on the server. What is this type of attack called?

a)Buffer overflow attackb)Denial-of-Service attackc)Shoulder surfingd)Social engineering

Oct 2022 · Question 42

When a biometric authentication system is introduced, which of the following is the most appropriate point to be taken into account?

a)Adjusting the device by considering both the probability of incorrectly rejecting an authorized user and that of incorrectly accepting an unauthorized userb)Preventing the decrease in the probability of incorrectly rejecting an authorized user by using a product that frequently updates the malware definition filec)Requesting an entrusted third party to issue a digital certificate for the person to be authenticatedd)Setting the appropriate amount of knowledge for authentication to balance the amounts of knowledge that cannot be easily guessed and that can be memorized by a person to be authenticated

Oct 2022 · Question 43

Which of the following is the purpose of using a message authentication code?

a)To check the encryption method of a messageb)To check the overview of a messagec)To confirm that there is no falsification of a messaged)To secure the confidentiality of a message

Oct 2022 · Question 44

Which of the following is an explanation of WAF?

a)It centrally stores and manages operation logs from various systems to quickly detect and analyze an event that can be a security threat.b)It is a standard of encryption methods for wireless LAN, certified by the Wi-Fi Alliance, and supports AES encryption.c)It is equipped with firewall functions and has antivirus, intrusion detection, and other functions that work together to manage multiple security functions in an integrated manner.d)It monitors the accesses to a website, and when it detects a pattern that is likely from an attacker, it blocks those accesses.

Apr 2022 · Question 36

Which of the following is a direct result of SQL injection to a company’s web server?

a)Data packets to and from the web server are modified.b)Data that is on the web server but is not accessible via the web application is retrieved or modified.c)Every key stroke a user makes in the network is captured.d)The IP headers of packets in the network are captured and modified.

Apr 2022 · Question 37

Which of the following is a program that is designed to block access to a computer or encrypt most of the data on that computer until a sum of money is paid?

a)Adwareb)Ransomwarec)Rootkitd)Spyware

Apr 2022 · Question 38

In a PKI system, which of the following is an algorithm that creates a key pair?

a)Hashing algorithmb)Key generation algorithmc)Signature verification algorithmd)Signing algorithm

Apr 2022 · Question 39

Which of the following is an appropriate description of a command and control (C&C) server?

a)A computer controlled and used by an attacker to send commands to other compromised computersb)A computer on a cloud service used to securely control the movement of data between on-premise storage and cloud storage using encrypted communicationc)A computer used to control the authentication of all users and computers in an organizationd)A computer used to control the distribution of processing among different computers in a high-performance computing environment, so that processing is not affected by cyber attacks

Apr 2022 · Question 40

Which of the following is an appropriate description of an advanced persistent threat (APT)?

a)It is a malware attack that keeps recreating malicious files even after repeated deletions.b)It is an attack that uses sophisticated techniques and goes undetected over a long time, e.g., months or years.c)It is an attack using malware in computer BIOS, affecting multiple operating systems on a computer that allows multi-booting.d)It is an attack using malware that disables all of a company’s computers and is difficult to delete.

Apr 2022 · Question 41

Which of the following is an appropriate description of footprinting in computer security?

a)Digital forensic analysis to find the hacker after a hacking incidentb)Gathering information about an organization and its systems in preparation for an attackc)Listing all affected files in the system in order to assess the impact of an attackd)Setting up an intrusion detection system in order to detect when an attacker breaks into the internal network

Apr 2022 · Question 42

Which of the following is an appropriate combination of definitions I through IV for authenticity and reliability in ISO/IEC 27000:2018 (Information security management systems – Overview and vocabulary)?

[Definitions]

IProperty of consistent intended behavior and resultsIIProperty that an entity is what it claims to beIIIProperty of being accessible and usable on demand by an authorized entityIVProperty that information is not made available or disclosed to unauthorized individuals, entities, or processes

AuthenticityReliability

a)IIIIb)IIIc)IIIVd)IVI

Apr 2022 · Question 43

When a mirror port is prepared to allow a LAN analyzer to be used for measurement in order to investigate the cause of a network failure, which of the following is a point to consider?

a)In preparation for a failure, it is necessary to inform network users of the storage location and usage method about the LAN analyzer.b)Since LAN cables must be temporarily disconnected during measurement, it is necessary to give network users advance notice of the measurement date and time.c)Since the LAN analyzer can display the packets that pass through the network, it is necessary to pay attention to misuse or abuse, such as wiretapping.d)Since the LAN analyzer disposes of packets, it is necessary to restrict the use of the non-target computers during measurement.

Apr 2022 · Question 44

There is a network that is divided into three (3) segments, namely an external segment, a DMZ, and an internal segment, by one (1) firewall. In this network, a service for users is published on the Internet using a system comprising a web server and a database server that contains critical data. Which of the following is the most appropriate server installation method for protecting critical data from unauthorized access via the Internet? Here, the web server performs front end processing for the database server, and the firewall allows only a specific protocol for communication between the external segment and the DMZ as well as between the DMZ and the internal segment. Direct communication between the external segment and the internal segment is not allowed.

a)The web server and the database server are installed in the DMZ.b)The web server and the database server are installed in the internal segment.c)The web server is installed in the DMZ and the database server is installed in the internal segment.d)The web server is installed in the external segment and the database server is installed in the DMZ.

Apr 2022 · Question 45

Which of the following is a system or network that is intentionally made vulnerable in order to investigate the behavior of an intruder or malware?

a)Botnetb)DMZc)Honey potd)SIEM

Apr 2021 · Question 34

Which of the following is classified as a web beacon?

a)A potential error of an application program used for a websiteb)A technique to collect user information, such as access trends, by embedding a small image in a web pagec)A virus that is downloaded from a website that deletes image files on a PCd)An abusive method of using a malicious script that is harmful to both client PC and web server

Apr 2021 · Question 35

When risk treatment is classified as risk avoidance, risk reduction, risk acceptance, and risk sharing, which of the following risk treatments is risk avoidance?

a)Applying appropriate controls to lower a riskb)Discontinuing some operations that have a riskc)Knowingly and objectively not taking any action on a riskd)Transferring a risk to other parties

Apr 2021 · Question 36

Which of the following is installed into an in-house network or server by an intruder to enter through an access path other than the normal path?

a)Backdoorb)Forensicc)Strict routingd)Thin client agent

Apr 2021 · Question 37

Biometric authentication includes a verification method that extracts physical characteristics and another verification method that extracts behavioral characteristics. Which of the following is the method that uses behavioral characteristics?

a)Performing authentication by extracting characteristics from pen speed and pressure when a signature is providedb)Performing authentication by extracting characteristics from the bifurcation angle of the bifurcation point of a blood vessel or from the distance between adjacent bifurcation pointsc)Performing authentication by extracting the characteristic point called minutia from the pattern formed by ridgesd)Performing authentication by extracting the characteristics of chaotic wrinkles in the eye from the pupil to the outside

Apr 2021 · Question 38

Which of the following is an encryption method that can be used for encrypting data managed in a database using the same key for encryption and decryption?

a)AESb)PKIc)RSAd)SHA-256

Apr 2021 · Question 39

A given application only has the functions of retrieving and displaying user information from a database that stores such information. Considering information security management, which of the following is the appropriate database access right assigned to an account that the application uses when it accesses the database? The names and scopes of rights are listed below.

[The names and scopes of rights]Reference right:Permits a record to be selectedUpdate right:Permits a record to be inserted, updated, and droppedAdministrator right:Permits a table to be displayed, created, altered, and dropped

a)Administrator rightb)Reference rightc)Update rightd)Update right and reference right

Apr 2021 · Question 40

A cybersecurity incident response plan is defined as a set of instructions to aid the cybersecurity team to detect, respond to, and recover from cybersecurity incidents. The cybersecurity incident response plan resolves issues, such as cybercrime, data loss, and service outages that threaten daily work. Which of the following is part of the cybersecurity incident response plan?

a)Attacking systems with scriptsb)Containmentc)Social engineering activitiesd)Stealing user credentials

Apr 2021 · Question 41

Between a client and web server, which of the following is used for inspecting the data that is sent from the client to the web server and blocking attacks, such as SQL injections?

a)Cluster configurationb)Load balancing functionc)SSL-VPN functiond)WAF

Apr 2021 · Question 42

Which of the following is an appropriate description of SSH?

a)It cannot use public key pairs, and it uses a password for authentication.b)It helps in securely loading web site pages over HTTPS.c)It provides a secure channel for server maintenance over a public network.d)Its use is required in the Intranet.

Apr 2021 · Question 44

Which of the following is an appropriate explanation of OP25B for email communication?

a)Blocking communication to port 25 to reduce mass-scale delivery of spam or junk emailsb)Blocking emails that are sent to more than 25 recipients at once due to organizational policyc)Blocking Simple Mail Transfer Protocol (SMTP) communication except those sent to port 25d)Blocklisting email addresses that send spams by monitoring email communication to port 25

Oct 2021 · Question 36

Which of the following properties for information security defined in ISO/IEC 27000:2018 refers to a guarantee that the message data received is the same as the message data sent?

a)Availabilityb)Confidentialityc)Integrityd)Non-repudiation

Oct 2021 · Question 38

A typical example of security threats is information leakage when a sender sends data containing important information to a receiver. Which of the following is the most appropriate measure to prevent information leakage?

a)The data is encrypted with a private key before being sent to the receiver via email. In a separate email, the private key is sent to the receiver so that the receiver can decrypt the data.b)The data is password-locked, and it is attached in an email that includes the password in the text part of the email. Before the email is sent, the receiver address is checked to make sure that the email is sent to the correct address.c)The receiver creates a pair of public/private keys and sends the public key to the sender. The data is encrypted with the public key and sent to the receiver via email. The receiver then decrypts the data with the private key.d)The sender compresses the data on a USB memory as much as possible before giving the USB memory to the receiver so that the receiver can utilize the rest of the memory space effectively.

Oct 2021 · Question 39

Which of the following is a type of malware that embeds itself within a program and inserts its copy into other programs?

a)Backdoorb)Trojan horsec)Virusd)Worm

Oct 2021 · Question 40

According to ISO/IEC 27000:2018 (Information security management systems - Overview and vocabulary), which of the following is the definition of “level of risk”?

a)Magnitude of a risk expressed in terms of the combination of consequences and their likelihoodb)Terms of reference for evaluating the significance of a riskc)The priority order assigned to the risks to be handledd)Weakness of an asset or control that can be exploited by threats

Oct 2021 · Question 41

Which of the following is dynamic analysis of malware?

a)Malware is identified by calculating the hash value of the subject for analysis and cross-checking it against a list of known malware hash values that are registered in an online database.b)On the basis of the file extensions and content of file headers on a hard disk, malicious program files with false extensions are detected.c)The subject for analysis is extracted from communication data on a network and reverse compiled, and the functions of the subject for analysis are investigated from the code obtained.d)The subject for analysis is run in a sandbox, and its behavior and external communication are observed.

Oct 2021 · Question 44

To provide a guarantee to its online customers that all credit card information is protected when transferred between their PC and the web service over public networks, which of the following technologies should be used?

a)S/MIMEb)SSHc)TLSd)VPN

Apr 2020 · Question 37

Which of the following is an appropriate description of clickjacking?

a)An attacker gains remote control of the mouse of a computer and maliciously operates the computer.b)An attacker misleads the user to interact with a user interface and to perform unintended operations.c)An attacker remotely locks the mouse pointer to prevent the user from moving the pointer anymore.d)An attacker removes the mouse device driver of the system so that the user cannot stop doing malicious actions.

Apr 2020 · Question 38

Which of the following activities targets the DHCP server and exhausts all its available IP address pool so that it cannot provide any IP addresses to its clients?

a)DHCP MAC filteringb)DHCP snoopingc)DHCP spoofingd)DHCP starvation

Apr 2020 · Question 39

Man-in-The-Middle (MITM) attack means the attacker intercepts and alters the communication between the end-user (victim) and the server, which is shown below. In an MITM attack, when the victim sends packets to the server, the attacker receives the packets and then forwards them to the server while the server sends the packets to the victim via the attacker. In this communication channel, which of the following is the appropriate description concerning the MITM attack?

a)The attacker always uses the server IP during the communication and never uses the victim’s IP.b)The attacker always uses the victim’s IP during the communication and never uses the server’s IP.c)The attacker always uses the victim’s IP during the communication with the server and always uses the server IP during the communication with the victim.d)The attacker always uses the victim’s IP during the communication with the victim and always uses the server IP during the communication with the server.

Apr 2020 · Question 40

Which of the following is the result when person A sends an e-mail that is encrypted by person B’s public key to person B and person C? Here, these three persons have the public keys of all three persons, and all of them have their own private keys.

a)Both B and C can decrypt the encrypted e-mail using B’s public key.b)Both B and C can decrypt the encrypted e-mail using their own private keys.c)Only B can decrypt the encrypted e-mail using A’s public key.d)Only B can decrypt the encrypted e-mail using B’s own private key.

Apr 2020 · Question 42

Which of the following is the most appropriate countermeasure against cross-site scripting (XSS) attacks?

a)Avoiding running a program received in an e-mail from an unknown senderb)Closing all unnecessary ports apart from standard web server portsc)Filtering out the input that can be interpreted as a scriptd)Using HTTPS instead of HTTP as the default protocol on the web server

Apr 2020 · Question 43

Which of the following is a method to prevent damage caused by an SQL injection attack?

a)Preventing input characters from being interpreted as characters that have a special meaning in querying or manipulating data in a databaseb)Rejecting any input that contains a character string that specifies a higher-level directory (../)c)Rejecting any input whose total length exceeds the limitd)Replacing an HTML tag with another character string that is not interpreted as an HTML tag if any input contains an HTML tag

Apr 2020 · Question 44

Which of the following is the network security tool that is usually deployed by a network or system administrator and presents itself as a target machine trying to lure attackers to observe their behavior and attack methodology without harming other systems?

a)Honeypotb)Logic analyzerc)Protocol analyzerd)Rootkit

Apr 2020 · Question 45

SSL/TLS is the industry-standard security technology creating encrypted connections between a web server and a web browser. This is used to maintain data privacy and to protect the information in online transactions. The steps for establishing an SSL/TLS connection are randomly listed as follows:

1.The web server sends a copy of its SSL/TLS certificate to the web browser.2.SSL/TLS encrypted communication takes place between the web browser and the web server.3.The web server sends the web browser an acknowledgment to start an SSL/TLS encrypted connection.4.The web browser checks if the SSL/TLS certificate is trustworthy or not. If it is trustworthy, then the web browser sends a message to the web server requesting to establish an encrypted connection.5.A web browser tries to connect to the web server secured with SSL/TLS.

Which of the following is the correct step sequence?

a)1 → 5 → 2 → 3 → 4b)1 → 5 → 4 → 3 → 2c)5 → 1 → 2 → 3 → 4d)5 → 1 → 4 → 3 → 2

Oct 2020 · Question 35

Which of the following attacks is classified as DNS cache poisoning?

a)False domain information is injected into the DNS server that is referenced by a PC, and it leads the user to a fake server.b)The version information of the DNS server software is obtained to identify a security hole.c)To interrupt the target service, the attacker uses the DNS server as a steppingstone to send a large number of recursive queries.d)To obtain internal information, the zone information stored in the DNS server is compiled and transferred.

Oct 2020 · Question 36

Which of the following is a type of public-key cryptography that utilizes the difficulty of factorizing extremely large numbers into primes?

a)AESb)DHc)DSAd)RSA