Which secure coding principle emphasizes the importance of denying everything by default and only granting permissions intentionally?
- Defense in Depth
- Fail-Safe Defaults
- Principle of Least Privilege
- Security through Obscurity
The Principle of Least Privilege advocates limiting permissions to the minimum necessary, ensuring that by default, access is denied, and permissions are granted intentionally.
An encryption system that uses the same key to encrypt and decrypt information is known as _______ encryption.
- Asymmetric
- Private
- Public
- Symmetric
Symmetric encryption, also known as private-key encryption, uses the same key for both encryption and decryption. This means that the sender and the recipient must both have access to the same secret key. It is typically faster and less computationally intensive compared to asymmetric encryption.
Which of the following attacks involves the injection of malicious scripts into web pages viewed by other users?
- Cross-Site Scripting (XSS)
- Distributed Denial of Service (DDoS)
- Phishing
- SQL Injection
Cross-Site Scripting (XSS) is an attack where an attacker injects malicious scripts into web pages, which are then viewed by other users, potentially leading to data theft or manipulation.
The process of hiding a wireless network by not broadcasting its SSID is known as _______.
- MAC Filtering
- Network Masking
- SSID Concealing
- SSID Encryption
SSID Concealing, also known as SSID hiding, is a security measure where the network name (SSID) is not broadcast, making it less visible to potential attackers.
Regular _______ sessions are essential to ensure that employees are up-to-date with the latest security policies and practices.
- Evaluation
- Maintenance
- Reporting
- Training
Regular training sessions are essential to ensure that employees are up-to-date with the latest security policies and practices. Security training helps employees recognize and respond to security threats effectively.
Insider threats can be particularly challenging to detect because they often exploit legitimate _______ rather than external vulnerabilities.
- Permissions
- Software Bugs
- System Flaws
- Weak Passwords
Insider threats often exploit legitimate "Permissions" granted to them as part of their job. This can make it challenging to distinguish malicious behavior from regular activities, increasing the risk of data breaches.
In penetration testing, what is the significance of a "red team" versus a "blue team"?
- Red team consists of internal employees, blue team is external
- Red team defends, blue team simulates attackers
- Red team simulates attackers, blue team defends
- Red team tests for software vulnerabilities
In penetration testing, the "red team" simulates attackers, often from an external perspective, while the "blue team" defends, typically from an internal perspective, helping to identify security weaknesses and prepare for real-world threats.
Digital certificates often use the _______ format, which includes the certificate's public key and information about the key owner.
- DER (Distinguished Encoding Rules)
- PEM (Privacy Enhanced Mail)
- PGP (Pretty Good Privacy)
- SSL (Secure Sockets Layer)
Digital certificates often use the PEM (Privacy Enhanced Mail) format. This format typically includes the certificate's public key and information about the key owner. PEM is widely used for securing data through encryption and authentication processes, making it an essential part of secure communications.
Which part of a digital signature process involves generating a value that is unique to the signed data?
- Digital Certificate
- Hashing
- Private Key Decryption
- Public Key Encryption
In the digital signature process, a unique hash value is generated from the data to be signed. This hash value is then encrypted with the sender's private key to create the digital signature. The recipient can use the sender's public key to verify the signature and the integrity of the data.
Digital certificates are issued by trusted third parties called what?
- Certificate Authorities
- Domain Registrars
- Internet Service Providers
- Social Media Companies
Digital certificates are issued by trusted third parties known as Certificate Authorities (CAs). These entities validate the identity of individuals, organizations, or websites and issue digital certificates, which are used to establish trust and enable secure communication on the internet.