Computer Knowledge ยท General Awareness

Information Security

4,143 Questions

Information security involves protecting computer systems and data from unauthorized access, cyber threats, and damage. It is a core part of the computer knowledge section in various banking and government exams. Practicing these concepts helps in understanding digital signatures, network security, and access control effectively.

Cybersecurity threatsAccess controlCryptography basicsSecurity risk managementDatabase protection

Information Security Questions

Multiple choice technology security

Administrative pages for websites should be protected by

  1. A mechanism that requires only a password

  2. Basic authentication

  3. 2/3 factor authentication

  4. A mechanism with no lock-out, to prevent accidentally denying legitimate access
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Administrative pages are high-value targets for attackers and require stronger authentication than standard username/password. Basic auth and single-factor passwords are vulnerable to compromise. Multi-factor authentication (2/3 factors) provides defense-in-depth by requiring something you know plus something you have or are. No lockout would actually increase vulnerability.

Multiple choice technology security

In order to avoid information disclosure error messages containing stack traces, specific application information should be

  1. Sent to the user in a hidden field so that tech support can retrieve the information later

  2. Destroyed if it occurs to minimize the chances that this information might be inadvertently disclosed

  3. Logged on the server side

  4. A and C
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Detailed error messages with stack traces can reveal sensitive information about application internals, database structure, or security weaknesses. Sending this to users (even in hidden fields) risks exposure. Logging errors server-side preserves debugging information for technical support while preventing information disclosure to attackers. The user should see generic, safe error messages.

Multiple choice technology security

Which of the following is true?

  1. Servers are generally configured in a secure manner when they are first installed

  2. It is impossible to securely configure a web server

  3. Out of the box settings normally meet what is called minimum baseline security standards

  4. The default settings on web servers are not generally secure
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Web servers ship with default configurations designed for ease of setup and broad compatibility, not security. These out-of-box settings typically enable unnecessary services, use default credentials, and expose verbose error messages, creating vulnerabilities that administrators must explicitly address.

Multiple choice technology security

Which of the following is NOT recommended for securing Web Applications against malicious users?

  1. Filtering data with a default deny regular expression

  2. Running the application with the least privilege necessary

  3. Client side data validation

  4. Retrieving data from database using pre-compiled stored procedures
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Client-side validation can be easily bypassed by attackers using browser developer tools, proxy tools, or direct API calls. Security controls must be implemented on the server side where they cannot be manipulated by the client.

Multiple choice technology security

Phishing attacks are successful when

  1. The web server is not patched

  2. The attack entices a user to perform a certain action

  3. Users do not patch their machines

  4. Users share email accounts
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Phishing is a social engineering attack that tricks users into performing actions like clicking malicious links, entering credentials, or downloading malware. The attack succeeds when users are deceived, not because of technical vulnerabilities in systems.

Multiple choice technology databases

What is the default encryption method used to BB encryption?

  1. 3DES

  2. AED

  3. 4DES

  4. 3AED
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

BlackBerry's default encryption method for data transmission and storage was 3DES (Triple DES). This symmetric encryption standard provided strong security for enterprise data while balancing performance on mobile devices of that era. Option B 'AED' appears to be a typo for AES.

Multiple choice technology databases

Which BB service is responsible for data encryption and compression for all BB data?

  1. Blackberry Controller

  2. Blackberry messaging Agent

  3. Blackberry Dispatcher

  4. Blackberry Router
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

BlackBerry Dispatcher is responsible for compressing and encrypting all data traffic between BES and handheld devices. It ensures data security and optimizes bandwidth usage through compression before transmission.

Multiple choice technology databases

Which BB service is responsible for data encryption and compression for all BB data?

  1. Blackberry Controller

  2. Blackberry messaging Agent

  3. Blackberry Dispatcher

  4. Blackberry Router
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The BlackBerry Dispatcher handles the encryption, compression, and routing of data packets between the BlackBerry Enterprise Server and the BlackBerry Router. The Messaging Agent handles email synchronization, the Controller monitors services, and the Router manages external connections.

Multiple choice technology databases

What is the default encryption method used to BB encryption?

  1. 3DES

  2. AED

  3. 4DES

  4. 3AED
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

3DES (Triple DES) is correct because it was the default encryption method used in BlackBerry encryption for securing data transmission between the BlackBerry Enterprise Server and handheld devices. 3DES was the industry standard at that time, providing strong encryption for enterprise messaging. The other options (AED, 4DES, 3AED) are not standard encryption algorithms.

Multiple choice technology security

The identity management component that acts as a repository for user ID and user profile information, that plays a key role in user authentication is

  1. Authentication services

  2. Authorization services

  3. Directory services

  4. Personalization services
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Directory services (such as LDAP or Active Directory) serve as the central repository storing user IDs, profiles, and authentication data. When users authenticate, the system queries the directory to verify their credentials, making it fundamental to authentication processes.

Multiple choice technology security

A person has a total of 3 accounts - a LDAP based security system, Active Directory Server and a RADIUS server. An administrator will be responsible for adding the same user to multiple systems and maintaining those accounts. Identify the process that helps in automating the task of keeping the passwords same across various systems

  1. Password single sign on

  2. Password management

  3. Password self-help

  4. Password synchronization
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Password synchronization ensures that when a user changes their password on one system, the change propagates to all other systems where they have accounts. This maintains consistent passwords across LDAP, Active Directory, RADIUS, and other connected systems, unlike SSO which uses one credential for multiple systems without synchronizing passwords.

Multiple choice technology architecture

What is public key cryptography?

  1. Public Key Cryptography (PKC) uses two keys, a "public key" and a "private key", to implement an encryption algorithm that doesn't require two parties to first exchange a secret key in order to conduct secure communications

  2. Cryptography method which uses Public key for encryption and de-cryption of the message

  3. Choice 2 is correct

  4. Choice 1 and 2 is correct
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Public Key Cryptography (PKC) uses a key pair - a public key for encryption and a private key for decryption. The public key can be freely shared, while the private key must be kept secret. This eliminates the need for parties to exchange a secret key beforehand, solving the key distribution problem in symmetric cryptography.

Multiple choice technology architecture

What is phishing?

  1. Accessing protected resource by the user

  2. Deligating user access rights

  3. Accquiring stray network packets

  4. Acquiring sensitive information possing as trustworthy entity
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Phishing is a social engineering attack where attackers pose as trustworthy entities (banks, companies, colleagues) to acquire sensitive information like passwords, credit card details, or personal data. It typically involves fraudulent emails or websites that appear legitimate but are designed to deceive victims into revealing confidential information.

Multiple choice technology architecture

What is DoS attack ?

  1. Disk Operating System

  2. Denial Of Service

  3. Domain Of Service

  4. Department Of State
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

DoS (Denial of Service) attack is a cyber attack where the perpetrator seeks to make a machine or network resource unavailable to its intended users. This is typically accomplished by flooding the target with excessive requests or traffic, overwhelming its capacity and preventing legitimate users from accessing the service.