security Online Quiz - 6

Multi-factor authentication uses two or more independent categories: something you know (password), something you have (token), something you are (biometric). This question describes the combination of knowledge and possession factors. Passwords (A) are one factor, credentials (C) are the authentication data itself, and identities (D) are who is being authenticated.

Web application firewalls require careful configuration to balance security coverage with performance impact, and improper rules can degrade application performance. They can detect attacks (A), enforce policies (C), and require security knowledge (D), but configuration complexity and performance overhead are the primary drawbacks.

To solve this question, the user needs to have knowledge about security concerns related to programming languages.

Authentication and session management are security concerns that are relevant to web applications. They ensure that users are who they claim to be and that the information stored on the server is secure.

Now, let's go through each option and explain why it is right or wrong:

A. Java: This option is correct. Java is a popular programming language for web applications, and it has built-in features for authentication and session management. Java web applications use a session ID to identify each user's session, and the server uses this ID to retrieve the user's session data.

B. .NET: This option is also correct. .NET is a framework for building web applications, and it includes features for authentication and session management. .NET web applications use cookies to store session information, and the server retrieves this information using the session ID in the cookie.

C. Managed Code: This option is too broad to be correct or incorrect. Managed code refers to code that is executed by a runtime environment, such as Java or .NET. While both Java and .NET use managed code, this option does not specify which language or framework is being referred to.

D. C: This option is incorrect. C is a programming language that is not commonly used for web applications, and it does not have built-in features for authentication and session management. While it is possible to implement these features in C, it would require more manual coding than using a language like Java or .NET.

The Answer is: A or B

Telephone numbers operate at different layers depending on the technology: in PSTN they represent circuit identifiers at layer 1-2, while in VoIP they function as application-layer addressing at layer 5-7. The OSI model was designed for packet-switched networks, so traditional circuit-switched telephony doesn't map cleanly.

When a virus saturates network capacity, the network itself is the victim (congested bandwidth), not the target. The actual target is the infected endpoint systems. In contrast, DoS attacks on servers (A), router hacking (B), and man-in-the-middle attacks (D) directly target network infrastructure or use it as the attack surface.

NIDS should be placed on segments with business-critical systems to detect attacks targeting high-value assets. Perimeter placement (A) generates too many alerts and may miss internal threats. The NOC (C) is a location, not a network segment, and external provider placement (D) delays detection of internal attacks.

Fiber-optic cables are much more difficult to wiretap than copper because they transmit light rather than electrical signals, requiring physical intrusion that is easily detectable. Fiber provides higher bandwidth (A), but is not immune to wiretapping (C). Network security does depend on the physical layer (D), making fiber the more secure medium.

SSID hiding, obscuring, or not broadcasting provides no meaningful security protection as the SSID is easily discovered in management frames and traffic. These are security through obscurity measures that don't prevent unauthorized access. Real WLAN security requires WPA2/WPA3 encryption and strong authentication.

The primary risk is that home broadband provides always-on connectivity to systems that users often lack expertise to secure properly. This creates a large pool of vulnerable machines that attackers can exploit as bots or entry points. The other options describe secondary risks (spam, file-sharing issues) or incorrect scenarios (dialers on DSL).

DNS was originally designed without authentication mechanisms, making it vulnerable to cache poisoning and spoofing attacks where malicious actors can inject false DNS records. DNSSEC was later developed to address this weakness by adding digital signatures to verify record authenticity. Options B and C describe characteristics that are not security weaknesses, while D confuses email spoofing with DNS vulnerabilities.

Configuration decisions directly impact security posture - incorrect settings can introduce vulnerabilities, weak controls, or exposure of sensitive data. While documentation (A) and version control (D) are good practices, they are not the primary reason for creating detailed security configuration instructions. Option B is incorrect because end users should be involved in security configuration processes.

Social engineering involves manipulating people to gain confidential information, such as tricking employees into revealing passwords through phone calls or impersonation. This attack targets human psychology rather than technical controls. Options B, C, and D refer to technical security mechanisms, not psychological manipulation techniques used in social engineering attacks.

Change management and security both focus on managing risk, controlling modifications, and preventing unauthorized changes to systems. Both functions require documentation, approval processes, and monitoring to ensure stability and security. Data entry, database administration, and network management are operational functions that don't share the same risk management philosophy as security.

The Kerberos Key Distribution Center (KDC) is a single point of failure - if it fails, no authentication can occur, potentially disrupting entire network services. Kerberos uses symmetric cryptography (not asymmetric), and dynamic passwords with limited lifetimes are actually security strengths, not vulnerabilities. The single point of failure is why production environments typically deploy multiple KDCs for redundancy.

To solve this question, the user needs to know the benefits of setting clear security roles.

Option A: Establishes personal accountability. This option is a benefit of setting clear security roles. When roles are clearly defined, it is easier to identify who is responsible for specific tasks, which leads to personal accountability.

Option B: Enables continuous improvement. This option is also a benefit of setting clear security roles. When roles are clearly defined, it is easier to identify areas that need improvement and implement measures to address them, which leads to continuous improvement.

Option C: Reduces cross-training requirements. This option is not a benefit of setting clear security roles. In fact, having clear security roles may lead to an increase in cross-training requirements, as it allows for better coordination and collaboration between team members with different roles.

Option D: Reduces departmental turf battles. This option is a benefit of setting clear security roles. When roles are clearly defined, it reduces the likelihood of conflicts arising from overlapping responsibilities and reduces departmental turf battles.

Therefore, the correct answer is:

The Answer is: C. Reduces cross-training requirements.

The principle of least privilege states that users and processes should only have the minimum access necessary to perform their functions, reducing potential damage from accidents or attacks. Discretionary access control allows owners to set permissions, separation of duties splits tasks among multiple people, and rotation of duties involves periodically changing role assignments - these are related but distinct concepts.

In Mandatory Access Control (MAC), the system enforces access based on security labels and clearances, while data owners determine who has a legitimate need to know the information. The system controls technical access validation, but need-to-know is a business decision made by owners. Validation, consensus, and verification are system functions, not owner determinations in MAC models.

Biometric characteristics cannot be revoked or changed - if your fingerprint data is compromised, you cannot get a new fingerprint like you can change a password. This creates a permanent security risk. Encryption, communications, and sensor placement are practical challenges but not fundamental disadvantages. The revocation problem is considered the most significant limitation of biometric authentication.

Single sign-on creates a single point of failure - if a user's password is compromised, the attacker gains access to all systems and resources that SSO covers, amplifying the damage. Options A and D describe advantages or features, while C is incorrect because SSO actually reduces the number of passwords users need to remember. The security trade-off is convenience versus centralized risk.

Availability ensures information is accessible when needed by protecting against disruptions like DoS attacks, natural disasters, and data loss from unreadable backups. Unauthorized transactions (D) are a confidentiality and integrity issue, not an availability issue - they can occur even when systems are fully available. The CIA triad treats availability, confidentiality, and integrity as separate security goals.