In a PKI (Public Key Infrastructure) system, the private key is used to _______ a message, while the public key is used to _______ it.
- Encode, Decode
- Encrypt, Decrypt
- Hash, Validate
- Sign, Verify
In a PKI system, the private key is used to sign a message, providing proof of the sender's identity and ensuring data integrity. The public key is used to verify the signature, allowing recipients to confirm the sender's identity and data authenticity.
What mechanism does IPsec use to ensure data integrity and confidentiality at the same time?
- AH (Authentication Header)
- ESP (Encapsulating Security Payload)
- PPTP (Point-to-Point Tunneling Protocol)
- SSL (Secure Sockets Layer)
IPsec uses ESP, the Encapsulating Security Payload, to provide both data integrity and confidentiality. ESP encapsulates the original packet and adds encryption and integrity checks.
A process in which an operating system ensures that an application only accesses the resources necessary for its legitimate purpose is called what?
- Clustering
- Multithreading
- Sandboxing
- Virtualization
The process in which an operating system ensures that an application only accesses the resources necessary for its legitimate purpose is called "Sandboxing." Sandboxing is a security mechanism that isolates applications, preventing them from making unauthorized changes to a system or accessing resources they shouldn't. It enhances security by containing potentially harmful processes.
Which of the following best describes a "zero-day" vulnerability?
- A vulnerability known for zero days
- A vulnerability that's been exploited zero times
- A vulnerability that's undisclosed to the vendor
- A vulnerability with no known exploits
A "zero-day" vulnerability is one that's undisclosed to the software or hardware vendor, meaning there are no patches or fixes available. It's called "zero-day" because it's effectively day zero of the vendor's awareness.
Which of the following is a primary goal of operating system hardening?
- Enhancing security by reducing vulnerabilities
- Expanding network connectivity
- Increasing system performance
- Simplifying user interfaces
The primary goal of operating system hardening is to enhance security by reducing vulnerabilities. This involves configuring the OS to minimize potential attack vectors and make it more resistant to security threats and exploits.
A company hired an ethical hacker to assess its security posture. After the assessment, the hacker provided a detailed report showing several vulnerabilities but did not exploit any. Which type of test did the hacker most likely perform?
- Penetration Test
- Red Team Exercise
- Security Audit
- Vulnerability Assessment
The hacker likely performed a Vulnerability Assessment, which identifies vulnerabilities without exploiting them. A Penetration Test would involve exploiting vulnerabilities.
In an incident reporting procedure, a _______ is typically designated to coordinate the response and recovery efforts.
- CEO
- CISO
- CSIRT
- CTO
In an incident reporting procedure, a CSIRT (Computer Security Incident Response Team) is typically designated to coordinate the response and recovery efforts. A CSIRT is a team of experts responsible for the protection against and management of cybersecurity incidents.
A financial institution wants to ensure that even if their data is intercepted during transmission, the intruder wouldn't be able to understand it. They decide to transform this data into a code to prevent unauthorized access. What process are they using?
- Compression
- Decryption
- Encryption
- Hashing
The financial institution is using encryption. Encryption is the process of transforming data into a code to prevent unauthorized access during transmission. It ensures that even if data is intercepted, it remains unintelligible to unauthorized individuals or intruders.
The U.S. federal law that requires financial institutions to explain how they share and protect their customers' private information is known as the _______.
- Computer Fraud and Abuse Act
- Gramm-Leach-Bliley Act
- Patriot Act
- Sarbanes-Oxley Act
The correct answer is the "Gramm-Leach-Bliley Act." This law mandates financial institutions to disclose their information-sharing practices and safeguard customers' private data.
In the context of CSP, what does the 'nonce' attribute help with?
- Controlling content caching
- Enforcing secure data transmission
- Handling session management
- Preventing Cross-Site Scripting (XSS) attacks
In the context of Content Security Policy (CSP), the 'nonce' attribute is used to prevent Cross-Site Scripting (XSS) attacks. It allows a server to generate a unique cryptographic nonce for each page load. The nonce is included in the CSP header, and the browser only executes scripts with a matching nonce, effectively blocking any unauthorized scripts from running on the page.