Computer Knowledge ยท General Awareness

Information Security

4,634 Questions

Information security involves protecting computer systems and data from unauthorized access, cyber threats, and damage. It is a core part of the computer knowledge section in various banking and government exams. Practicing these concepts helps in understanding digital signatures, network security, and access control effectively.

Cybersecurity threatsAccess controlCryptography basicsSecurity risk managementDatabase protection

Information Security Questions

Multiple choice technology databases

. User Authentication most suitable in IntrAnet scenario

  1. Forms Authentication

  2. Passport Authentication

  3. Windows Authentication

  4. none of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Windows Authentication integrates with Active Directory and is ideal for intranets where all users are domain members. It provides seamless authentication without prompting for credentials. Forms Authentication is for internet applications, Passport is deprecated, and Windows is the correct intranet choice.

Multiple choice technology databases

In Web Farm scenarios, which Encryption provider is suitable for encrypting data in configuration files:

  1. DPAPI

  2. RSA

  3. Any of the above

  4. None
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

In Web Farm scenarios with multiple servers, RSA encryption is suitable because it uses machine-independent key containers that can be shared across servers. DPAPI relies on machine-specific keys and cannot work in a web farm environment. The question asks specifically about web farm scenarios, making RSA the correct choice.

Multiple choice technology web technology

What is the purpose of using Single User ID application?

  1. Used for transaction services

  2. Used for user authorization and authentication

  3. Used for user authentication

  4. Used for Data Entry System
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

A Single User ID application provides centralized user authentication (verifying identity) and authorization (controlling access permissions) across multiple systems.

Multiple choice technology security

Phishing is

  1. luring victims into attacks by using precisely targeted researched personal information schemes

  2. the practice of tricking a user into giving, or giving access to, sensitive information, thereby bypassing most or all protection; Use of propaganda by an authoritarian government to sway perceptions and attitudes of its own citizenry

  3. the act of someone who fishes as a diversion

  4. the act of sending email that falsely claims to be from a legitimate organization. This is usually combined with a threat or request for information.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Phishing is a social engineering attack where attackers send fraudulent emails pretending to be legitimate organizations. These emails often create urgency or threaten consequences to trick users into revealing sensitive information like passwords or financial details. Option D correctly describes this.

Multiple choice technology security

Cross Site Scripting is

  1. a mechanism of sharing scripts between two websites

  2. a code injection technique that exploits a security vulnerability occurring in the database layer of an application

  3. is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

  4. is a way to protect websites using JavaScripts
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Cross Site Scripting (XSS) is a vulnerability where attackers inject malicious scripts into web pages viewed by other users. It exploits insufficient input validation or output encoding. Option B describes SQL injection (database layer), while option A and D are incorrect characterizations.

Multiple choice technology security

Cross-site request forgery

  1. is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

  2. is an attempt to make a computer resource unavailable to its intended users by sending invalid/forged requests

  3. is a form of attack on a database-driven Web site in which the attacker executes unauthorized SQL commands by taking advantage of insecure code on a system connected to the Internet

  4. is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

CSRF is an attack that tricks a user's browser into making unwanted requests to a website where the user is already authenticated. The website trusts the request because it comes from a legitimate user's session, even though the user didn't intend to make that request. Unlike XSS which injects scripts, CSRF exploits the trust relationship between user and site.

Multiple choice technology security

Denial of service

  1. is an action taken by server when invalid credentials are supplied by users

  2. is an action taken by firewall to prevent access to malicious users

  3. is an attempt to make a computer resource unavailable to its intended users

  4. is a way to prevent Cross Site Scripting attacks
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Denial of Service attacks aim to make a computer resource unavailable to its intended users by overwhelming it with traffic or requests. This exhausts system resources like memory, CPU, or network bandwidth. DoS doesn't necessarily break security controls - it simply makes the service too slow or completely unavailable.

Multiple choice technology security

Social Engineering

  1. is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical hacking techniques (essentially a fancier, more technical way of lying).

  2. is a way to educate users about different security issues

  3. is a group formed by malicious users

  4. is a practice of engineering dealing with Social Security
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Social Engineering manipulates people into divulging confidential information or performing actions through psychological tactics rather than technical exploits. Attackers use deception, authority impersonation, or creating false urgency to trick victims. It exploits human trust and helpfulness rather than software vulnerabilities.

Multiple choice technology security

Most effective way to protect credentials in transit

  1. is by using complex passwords

  2. is to encrypt the entire login transaction using something like SSL

  3. is by not using public/shared PCs

  4. is by sending credentials by POST method
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

SSL/TLS encryption protects credentials during transmission by encrypting the entire communication channel between client and server. This prevents attackers from intercepting sensitive data even if they can monitor network traffic. POST alone doesn't encrypt data, and complex passwords only protect against guessing, not interception.

Multiple choice technology security

In what type of attack does an intruder manipulate a URL in such a way that the Web server executes or reveals the contents of a file anywhere on the server, including those lying outside the document root directory?

  1. cross-site scripting

  2. command injection

  3. path traversal attacks

  4. SQL injection
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Path traversal attacks involve manipulating file paths in URLs (using sequences like '../') to access files outside the web root. Unlike SQL injection (targets databases), cross-site scripting (injects scripts), or command injection (executes commands), path traversal specifically targets file system access.

Multiple choice technology security

Encrypted data is not at risk by keyloggers.

  1. True

  2. False
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Keyloggers capture keystrokes before encryption occurs. When you type encrypted data, the keylogger records the plaintext input, not the encrypted output. Encryption protects data in transit, not from input capture malware.

Multiple choice technology security

Which of the following is NOT recommended for securing Web applications against authenticated users?

  1. Client-side data validation

  2. Running the application under least privileges necessary

  3. Filtering data with a default deny regular expression

  4. Using parameterized queries to access a database
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Client-side validation is NOT security - users can bypass it using browser tools or by sending direct requests. Real security requires server-side validation, least-privilege execution, proper filtering, and parameterized queries to prevent injection attacks.

Multiple choice technology testing

Which of the following is the best example of reliability failure for an application?

  1. Slow Response Time

  2. Excessive Memory Consumption

  3. Random Application termination

  4. Failure to encrypt data
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Reliability refers to a system's ability to perform its intended functions correctly and consistently over time without unexpected failures. Random application termination represents a complete loss of service availability, which is a fundamental reliability issue. The other options represent different concerns: performance (slow response), resource management (memory consumption), and security (encryption).

Multiple choice technology platforms and products

Which of the following conditions should be true to enable biztalk to receive messages from web services?

  1. The port type responsible for receiving messages should be a public port

  2. The webservice should be running on the same machine where the SOAP Adapter is running

  3. The webservice should be running on the same machine where the biztalk message box is available

  4. The Webservice should run under a user account that has permissions to access the biztalk management database
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

For BizTalk to receive messages via web services, the receiving port type must be Public. This visibility is required for external SOAP requests to reach the orchestration. The web service and BizTalk server can be on different machines.