Computer Knowledge · General Awareness

Information Security

4,143 Questions

Information security involves protecting computer systems and data from unauthorized access, cyber threats, and damage. It is a core part of the computer knowledge section in various banking and government exams. Practicing these concepts helps in understanding digital signatures, network security, and access control effectively.

Cybersecurity threatsAccess controlCryptography basicsSecurity risk managementDatabase protection

Information Security Questions

Multiple choice technology security

Which cookie flag, when set, will prevent their transmission over non secure channel?

  1. Secure

  2. Domain

  3. Expires

  4. Static
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

The Secure cookie flag ensures cookies are only transmitted over encrypted HTTPS connections, preventing them from being sent over insecure HTTP channels. The Domain flag (B) specifies which domains can receive the cookie. The Expires flag (C) sets cookie lifetime. 'Static' (D) is not a valid cookie attribute - this appears to be a distractor.

Multiple choice technology security

The main risk to a web application in a cross site scripting attack is …

  1. Compromise of users

  2. Loss of data integrity

  3. Destruction of data

  4. None of the above
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

The primary risk of XSS is compromise of users - their sessions are hijacked, credentials stolen, or they're redirected to phishing sites. The web application's data integrity (B) isn't directly threatened by XSS. Data destruction (C) requires different vulnerabilities like SQL injection or authentication bypass. 'None of the above' would incorrectly minimize XSS severity.

Multiple choice technology security

In which of the following exploits does an attacker insert malicious code into a link that appears to be from a trustworthy source?

  1. Cross-Site Scripting

  2. Buffer over flows

  3. Command injection

  4. Path traversal attack
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Cross-Site Scripting involves injecting malicious code into links or content from an apparently trustworthy source, exploiting the user's trust. Buffer overflows (B) are memory corruption vulnerabilities. Command injection (C) executes system commands directly. Path traversal (D) accesses files outside the web root. Only XSS involves the deceptive link characteristic.

Multiple choice technology security

Once an input data validation flags an input as “invalid” what would be the most secure response ?

  1. Escape the invalid characters and continue processing the input data

  2. Accept the input data without modifying it and log the validation error

  3. Delete the invalid characters and continue processing the input data

  4. Reject the entire input data and send an error message back to the user
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Rejecting invalid input entirely is the most secure response because it prevents any potentially malicious data from entering the system. Escaping or deleting characters might miss edge cases or introduce new vulnerabilities. Accepting invalid data without modification directly exposes the system to attack.

Multiple choice technology security

How can we prevent dictionary attacks on password hashes ?

  1. Hashing the password twice

  2. Encrypting the password using the private key

  3. Use an encryption algorithm you wrote your self so no one knows how it works

  4. Salting the hash
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Salting adds unique random data to each password before hashing, preventing attackers from using pre-computed rainbow tables or dictionary attacks. Hashing twice or custom encryption doesn't address the core vulnerability.

Multiple choice technology security

Implementing Access Control based on a hard coded IP address

  1. Can be done as it as an internal IP

  2. Can be done for internet facing servers as there are no chances of IP conflicts

  3. Is a good security practice

  4. Is a bad security practice
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

To solve this question, the user needs to understand the concept of access control and the potential risks associated with hard coding IP addresses.

Option A: Can be done as it is an internal IP

  • This option is partially correct. Internal IP addresses are typically static and can be hard coded for access control purposes within a private network. However, it is important to note that internal IPs can still be compromised by malicious actors who gain access to the network.

Option B: Can be done for internet-facing servers as there are no chances of IP conflicts

  • This option is incorrect. Internet-facing servers are exposed to a larger attack surface and are at risk of IP spoofing or IP address conflicts. Hard coding IP addresses for access control purposes can lead to security vulnerabilities and is generally not recommended.

Option C: Is a good security practice

  • This option is incorrect. While access control is an important security practice, hard coding IP addresses is not considered a good practice due to the potential risks involved, such as IP spoofing and IP conflicts.

Option D: Is a bad security practice

  • This option is correct. Hard coding IP addresses for access control purposes is generally not recommended as it can lead to security vulnerabilities. It is important to use more secure methods of access control, such as multi-factor authentication and role-based access control.

Therefore, the correct answer is: The Answer is D.

Multiple choice technology security

What is the common cause of buffer over flows, cross-site scripting, SQL injection and format string attacks?

  1. Unvalidated input

  2. Lack of authentication

  3. Improper error handing

  4. Insecure configuration management
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

To solve this question, the user needs to have knowledge about common vulnerabilities in software development.

Now, let's go through each option and explain why it is right or wrong:

A. Unvalidated input: This option is the correct answer. All four attacks listed in the question stem are caused by unvalidated input. Unvalidated input occurs when a program does not properly check the data that it receives as input, allowing attackers to inject malicious code or data into the program.

B. Lack of authentication: This option is incorrect. While lack of authentication can be a vulnerability in software, it is not the cause of buffer overflows, cross-site scripting, SQL injection, or format string attacks.

C. Improper error handling: This option is incorrect. Improper error handling can lead to vulnerabilities in software, but it is not the cause of the attacks listed in the question stem.

D. Insecure configuration management: This option is incorrect. Insecure configuration management can lead to vulnerabilities in software, but it is not the cause of the attacks listed in the question stem.

The Answer is: A. Unvalidated input.

Multiple choice technology security

Out of the following which one can be considered as a possible solutions for SQL injection vulnerability?

  1. Data Validation

  2. Secure Cookies

  3. Encryption

  4. Comprehensive exception handling
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

SQL injection is a type of attack that occurs when malicious code is injected into a SQL query. This can be done by submitting specially crafted input to a web form or API. The malicious code can then be used to extract data from the database, modify data in the database, or even execute arbitrary commands on the server.

Data Validation is the process of checking user input for malicious content. This can be done by using regular expressions or other techniques to identify and filter out harmful characters. Data validation is an important part of preventing SQL injection attacks, but it is not a foolproof solution.

Secure Cookies can help to protect against SQL injection attacks by preventing attackers from accessing session cookies. Session cookies are used to track user sessions, and they can contain sensitive information such as user IDs and passwords. If an attacker is able to obtain a session cookie, they could use it to impersonate the victim and gain access to the victim's account.

Encryption can also help to protect against SQL injection attacks. Encrypted data cannot be easily read by attackers, even if they are able to inject malicious code into a SQL query. However, encryption is not a perfect solution, as it can be difficult to implement and maintain.

Comprehensive exception handling can help to prevent SQL injection attacks by catching and logging errors that occur during the execution of SQL queries. This can help to identify and fix vulnerabilities in the code that could be exploited by attackers.

The correct answer is A. Data Validation. Data validation is the most effective way to prevent SQL injection attacks. By carefully checking user input for malicious content, it is possible to block most SQL injection attacks before they even have a chance to succeed.

The other options, while helpful, are not as effective as data validation. Secure cookies can help to protect against session hijacking, but they do not prevent SQL injection attacks. Encryption can help to protect data, but it is not a foolproof solution. Comprehensive exception handling can help to identify and fix vulnerabilities, but it is not a preventive measure.

Therefore, the best way to prevent SQL injection attacks is to use data validation. By carefully checking user input for malicious content, it is possible to block most SQL injection attacks before they even have a chance to succeed.

Multiple choice technology security

Which of the following should be stored in the cookie?

  1. Session ID

  2. Account Privileges

  3. UserName

  4. Password
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

To solve this question, the user needs to know what information is appropriate to store in a cookie.

Now, let's go through each option and explain why it is right or wrong:

A. Session ID: This option is appropriate to store in a cookie. A session ID is a unique identifier assigned to a user's session and is used to keep track of session state. Storing the session ID in a cookie allows the server to identify the user's session on subsequent requests.

B. Account Privileges: This option is not appropriate to store in a cookie. Storing account privileges in a cookie is a security risk because cookies can be easily intercepted and manipulated. Instead, account privileges should be stored on the server and checked on each request.

C. UserName: This option is appropriate to store in a cookie. Storing the username in a cookie can improve the user experience by allowing the website to remember the user's preferences and customize the user's experience.

D. Password: This option is not appropriate to store in a cookie. Storing passwords in cookies is a significant security risk because cookies can be easily intercepted and manipulated. Passwords should never be stored in cookies or any other client-side storage.

The Answer is: A and C

Multiple choice technology security

What should be considered the most while doing data classification

  1. The type of users who would be accessing the data

  2. Availability, Integrity and Confidentiality

  3. The threat level the company faces

  4. Access controls protecting the data
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Data classification is fundamentally based on the CIA triad: Availability, Integrity, and Confidentiality. These core security principles determine how data should be protected and classified.

Multiple choice technology security

Requirements for administrator authentication should be

  1. Equivalent to normal users

  2. Less than those of normal users as all administrators are trustworthy

  3. No authentication is required for administrators

  4. Greater than those of normal users
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Administrator accounts have elevated privileges that can cause significant damage if compromised. Therefore, they require stronger authentication than normal users to protect against unauthorized access. Using equivalent or weaker authentication would create an unacceptable security risk.

Multiple choice technology security

Hard Coding credentials

  1. Cannot be treated as a secure practice

  2. Is a good way to hide passwords from hackers

  3. Is perfectly fine for internal applications

  4. Is perfectly fine for external user facing applications
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Hard-coding credentials in source code is a critical security vulnerability because anyone with access to the codebase or decompiled binaries can extract them. This practice violates the principle of credential secrecy and is flagged by security tools. Credentials should always be stored securely, not embedded in code.

Multiple choice technology security

Configuration Management Security principles apply to

  1. Commercial applications

  2. Custom built applications

  3. In house developed applications

  4. All of the above
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Configuration management security principles are universal best practices that apply regardless of application type or origin. Commercial apps, custom-built solutions, and in-house developed applications all need secure configuration management to prevent vulnerabilities. The security principles don't change based on who built the software.

Multiple choice technology security

Data hashing will

  1. Ensure that the data has not been tampered with

  2. Ensure that the session is valid

  3. Ensure that the user is valid

  4. All of the above
Reveal answer Fill a bubble to check yourself
A Correct answer