Cybersecurity Fundamentals

Risk is the potential for loss, damage, or destruction when a threat exploits a vulnerability. Option B describes threat, Option C describes vulnerability - these are distinct but related security concepts.

A vulnerability is a weakness or gap in security that can be exploited. Option B describes risk (potential for loss), Option C describes threat (what exploits vulnerabilities). Understanding these distinctions is fundamental to security analysis.

RSA provides encryption and digital signatures (statement ii is true), but is not primarily a key exchange protocol (statement i is false). Diffie-Hellman is exclusively a key exchange protocol (statement iv is true), not an encryption protocol (statement iii is false).

Spyware is a type of malicious software specifically designed to secretly monitor, gather, and transmit a user's private data or online browsing activities without authorization. While general malware can have other intents, spyware is defined by this surveillance behavior.

Malware is malicious software designed to gain unauthorized access or cause harm to systems. Options A, B, and C describe benign or legitimate software types - games, monitoring tools, and patches - not malicious programs.

A firewall is software or hardware that protects against malicious attacks by filtering network traffic. Options A, B, and D are incorrect - A is nonsensical (firewalls aren't literal fire protection), B is authentication, and D is physical security.

Phishing is a social engineering attack where attackers impersonate legitimate entities to trick victims into revealing sensitive information. The term comes from 'fishing' - attackers cast out many fraudulent emails hoping victims will 'bite' and provide their data. Option A correctly describes this as using spoofed emails and fake websites. Option B is incorrect because phishing is not a virus - it's a deception technique. Option C describes a security practice, not an attack.

Wireless network security requires layered protection. Encryption (WPA or WEP) protects network traffic from eavesdropping, while MAC address filtering restricts which devices can connect to the network. Using both provides defense-in-depth - if one protection fails, the other may still stop unauthorized access. Note that WEP is now considered weak and should be replaced with WPA2/WPA3 in practice, but both are encryption methods.

Standard Diffie-Hellman key exchange without authentication is vulnerable to man-in-the-middle attacks because the parties cannot verify they're communicating directly with each other. An attacker can intercept the exchange and establish separate keys with both parties, then relay (and potentially modify) communications between them. This is why authenticated Diffie-Hellman or protocols like TLS are used in practice.

Penetration testing (often called pen testing) is a simulated cyberattack launched against your computer system to identify exploitable security vulnerabilities. It is a software-based simulation of hacking, rather than a physical vibration or a tool that physically penetrates hardware.

A zero-day attack exploits a security vulnerability that is unknown to the software vendor and for which no patch exists yet - hence 'zero days' of protection available. The term refers to the amount of time the vendor has had to fix it (zero), not the timing of the attack. Options B and C incorrectly interpret it as referring to specific times or dates. Zero-day vulnerabilities are particularly dangerous because no defense exists until the vendor becomes aware and releases a patch.

Proper information handling requires: (i) sharing files only with authorized personnel using proper rights management (RMS ensures this), and (ii) declaring media before moving it in/out of office premises for audit purposes. Option iii is incorrect because confidential printed files must be disposed securely (shredding or secure bins), NOT in regular trash where they could be retrieved. The claimed answer B (I and ii only) correctly excludes the incorrect option iii.

In security terminology, a threat is anything that can exploit a vulnerability to cause harm - whether intentional (attackers) or accidental (natural disasters, mistakes). Option A describes 'vulnerability' (weakness), not threat. Option B describes 'risk' (the potential for loss from threat+ vulnerability). Option C correctly defines threat as the agent that could exploit vulnerabilities. These terms are often confused - remember: threat=what could attack, vulnerability=how it could succeed, risk=the likelihood and impact.

Security coordinators must focus on both threats (potential attackers/exploits) and vulnerabilities (weaknesses in systems). Understanding only threats is useless without knowing what vulnerabilities they could exploit. Conversely, knowing vulnerabilities without understanding threat scenarios makes it hard to prioritize what to fix. Option C correctly recognizes that effective security management requires understanding both sides of the risk equation.

A Trojan Horse is a type of malware that disguises itself as legitimate software but does NOT self-replicate. Unlike viruses or worms, Trojans cannot multiply or spread by themselves. They rely on user deception (e.g., downloading infected files) to propagate. The key distinction is that Trojans lack the self-replication capability inherent to viruses and worms.

Remote Access Trojans (RATs) typically connect back to the attacker using Dynamic DNS Update Clients (DUC). Since attackers' systems often have dynamic IP addresses, DUC services (like no-ip) maintain a consistent hostname that updates automatically when the IP changes. Port forwarding is required but doesn't actively maintain the connection; backtrack is a Linux distribution for testing; php scripts may be attack vectors but not the connection mechanism itself.

Crypters use stubs - small code sections that handle payload decryption and execution. To bypass antivirus detection, stubs are frequently changed or updated since antivirus signatures are often based on stub patterns. RunPE (Run Portable Executable) is a technique used by crypters but not what's updated; encryption algorithms and keys can be part of detection signatures but stub modification is the primary evasion method.

DDoS (Distributed Denial of Service) shells/bots utilize multiple flooding protocols to overwhelm targets. UDP flooding is common due to UDP's connectionless nature; TCP flooding exploits the TCP handshake process (SYN floods); HTTP flooding targets web applications with legitimate-looking HTTP requests. DOS is not a specific flooding technique but the overall attack category.