Computer Knowledge ยท General Awareness

Information Security

4,634 Questions

Information security involves protecting computer systems and data from unauthorized access, cyber threats, and damage. It is a core part of the computer knowledge section in various banking and government exams. Practicing these concepts helps in understanding digital signatures, network security, and access control effectively.

Cybersecurity threatsAccess controlCryptography basicsSecurity risk managementDatabase protection

Information Security Questions

Multiple choice

Which of the following is an incorrect statement about Web Application Firewall (WAF)?

  1. It protects against web-based application attacks.

  2. It identifies the potentially dangerous or malforms attacked towards a given web application.

  3. It uses many bypass techniques for such execution.

  4. It also identifies the malicious worms.

  5. It is a defensive measure implemented into most operating systems and prevents execute permission when an overwrite in the memory has occurred.
Reveal answer Fill a bubble to check yourself
E Correct answer
Explanation

Web Application Firewall (WAF) is not implemented in operating systems.

Multiple choice

Which of the following is a correct statement about SEH Overwrites exploit during Penetration test?

  1. It occurs due to improper coding techniques.

  2. It occurs due to closing of application by the exception handler.

  3. It is a technique of identifying what type of information is being sent.

  4. It uses data execution prevention (DEP) in its execution.

  5. This exploit is not present during penetration testing.
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

This is correct and SEH Overwrites exploit is caused when the structured exception handler begins to gracefully close an application.

Multiple choice

Which of the following is a true statement about Return Oriented Programming in Penetration testing?

  1. This technique uses DEP for the control of execution flow.

  2. It occurs when structured exception handler begins to gracefully close an application.

  3. It occurs due to improper coding techniques.

  4. In this exploit, the attackers goal is to control a crash and gain code execution on the given system.

  5. It is not an exploit during Penetration test.
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

In ROP, during a portion where the user has control of execution flow however data execution prevention (DEP) or other precluding defense mechanisms may be in place.

Multiple choice

Which of the following is a false statement about Threat modelling approach in penetration testing?

  1. To gather relevant documentation

  2. To encode the method of obfuscating data

  3. Identify and categorize primary and secondary assets

  4. Identify and categorize threats and threat communities

  5. Map threat communities against primary and secondary assets
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

This is not a part of Threat modelling approach. It does not encode any method.

Multiple choice

Which of the following is not tested in Network Penetration Test?

  1. Total number of IP addresses

  2. Attempt to gain the highest privileges

  3. Specific compliance requirement

  4. Status of the devices in place that may impact the results of a penetration test

  5. Physical security measures
Reveal answer Fill a bubble to check yourself
E Correct answer
Explanation

Network Penetration Test does not measure the physical security. It comes under Physical Penetration Test.

Multiple choice

Which of the following is a false statement about 'Human Angle' during Penetration test?

  1. It occurs during a physical penetration test.

  2. It provides the gaining access to the social engineer.

  3. Organisation business information is necessary for such exploit.

  4. It is an attempt to circumvent physical security controls.

  5. It is the part of intelligence gathering phase.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

This is true about 'Physical Access' exploit. 'Human Angle' does not check physical security controls.

Multiple choice

Which of the following is a false statement about 'Evasion' technique during the Penetration test?

  1. It is used in order to escape detection during a penetration test.

  2. It uses Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) to encode the request.

  3. It circumvents web application firewalls.

  4. This technique is necessary for a successful test.

  5. This technique uses a method to inject into an already running process.
Reveal answer Fill a bubble to check yourself
E Correct answer
Explanation

Evasion technique does not use such method for any running process. Process Injection technique is responsible for that.

Multiple choice

Which of the following is a false statement about 'Zero-Day Angle' exploit during Penetration testing?

  1. This type of attack often represents a highly advanced organization.

  2. It recreates a protocol or application and attempts to send data at the application.

  3. This attack is possible due to countermeasure technology.

  4. There should be some countermeasures and the relevant operating system to perform such exploit.

  5. Zero-day angle exploit is often a last resort for most penetration testers.
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

'Zero-Day Angle' does not recreate or attempt to send any protocol to any application. Fuzzing uses such protocols.

Multiple choice

Which of the following is called Whitelist Bypass technique?

  1. It is used to prevent the malicious software from being deployed on the system.

  2. It is used to obfuscate data in a way that the deployed piece of code does not appear the same.

  3. It is an attempt to re-arrange data to compress the application or pack it.

  4. It leveraged a trusted model for applications that have been seen on a given system at a time.

  5. It uses encryption methods.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

This technique takes a baseline of the system and identifies what is normal to be run on the system versus what is something foreign.

Multiple choice

Which of the following is an incorrect statement about 'Process Injection' technique during Penetration Testing?

  1. It uses a method to inject the running application.

  2. The information of the application can be hidden within a process.

  3. The running processes can not be inspected easily.

  4. It is implemented into most operating systems and prevents execute permission when an overwrite in memory has occurred.

  5. It is used to hide in a different process that the application would think is a trusted one.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

This is incorrect about 'Process injection'. Data Execution Prevention (DEP) is responsible for that.

Multiple choice

Which of the following best describes a digital signature?

  1. A scanned signature

  2. Handwritten signature in machine language

  3. Signature in binary form

  4. Encrypting information

  5. Electronic signature
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender such that the sender cannot deny having sent the message (authentication and non-repudiation) and that the message was not altered in transit (integrity).

Multiple choice

all of the above

  1. Privacy invasion

  2. hardware failure

  3. Fraudulent manipulation of data

  4. all of above
Reveal answer Fill a bubble to check yourself
A Correct answer