Computer Knowledge ยท General Awareness

Information Security

4,634 Questions

Information security involves protecting computer systems and data from unauthorized access, cyber threats, and damage. It is a core part of the computer knowledge section in various banking and government exams. Practicing these concepts helps in understanding digital signatures, network security, and access control effectively.

Cybersecurity threatsAccess controlCryptography basicsSecurity risk managementDatabase protection

Information Security Questions

Multiple choice technology security

Non repudiation is a very desirable trait because

  1. It establishes traceability of every action to the doer

  2. In some critical situations it should be impossible to deny an action

  3. It is a forensic analysis mechanism

  4. All of the above
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Non-repudiation is a very desirable trait because it ensures that an action or transaction cannot be denied or disputed by the parties involved. Let's go through each option to understand why it is correct or incorrect:

Option A) It establishes traceability of every action to the doer - This option is correct because non-repudiation ensures that every action can be traced back to the person who performed it. This helps in establishing accountability and responsibility.

Option B) In some critical situations, it should be impossible to deny an action - This option is correct because non-repudiation prevents the ability to deny or dispute an action, especially in critical situations. This is important to ensure trust and reliability in such scenarios.

Option C) It is a forensic analysis mechanism - This option is incorrect. While non-repudiation can be used as a tool in forensic analysis, it is not the primary purpose of non-repudiation. Non-repudiation primarily focuses on preventing denial of actions or transactions.

Option D) All of the above - This option is correct because all the statements mentioned in options A and B are true. Non-repudiation establishes traceability, prevents denial in critical situations, and can be used in forensic analysis.

Therefore, the correct answer is D) All of the above. Non-repudiation is desirable because it establishes traceability, prevents denial in critical situations, and can be used as a forensic analysis mechanism.

Multiple choice technology security

The following are Application Security activities

  1. Requirements Analysis

  2. Vulnerability Assessment

  3. Code Review

  4. All of the above
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Application security activities span the entire software development lifecycle. Requirements analysis defines core security criteria, source code review identifies security flaws statically, and vulnerability assessment evaluates active systems. Therefore, all of these options represent application security activities.

Multiple choice technology security

To prevent from Database Access Control attack

  1. access control should be handled by the application and database layers

  2. Always include current authenticated username as part of the query.

  3. Never rely on presentation layer to restrict values submitted by the user

  4. All the above
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

All options are valid measures to prevent Database Access Control attacks. Access control must be enforced at both application and database layers (defense-in-depth). Including the authenticated username in queries ties operations to specific users. Never trusting presentation layer validation prevents bypass attacks. Option D correctly captures that all these practices are necessary.

Multiple choice technology security

A cross-site request forgery (CSRF) vulnerability occurs when

  1. If the request does not contain a nonce that proves its provenance

  2. The application acts on an HTTP request without verifying that the request was made with the user's consent

  3. A Web application uses session cookies

  4. All the above
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

CSRF vulnerabilities arise when applications rely on automatically transmitted session cookies, execute requests without explicit user consent checks, and fail to use unpredictable, transaction-specific nonces. Since all these conditions facilitate Cross-Site Request Forgery, all options are correct.

Multiple choice technology security

Use of readLine() method in java may lead to

  1. Sql Injection attack

  2. Denial of Service attack

  3. CSRF attack

  4. None of these
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

The readLine() method in Java reads input until a line delimiter is found. If an attacker sends a continuous stream of data without newlines, it can exhaust heap space and trigger an OutOfMemoryError, causing a denial of service.

Multiple choice technology security

Which of the following is essential information to a hacker performing a session-hijacking attack?

  1. Session ID

  2. Session number

  3. Sequence number

  4. Source IP address
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

In network-level TCP session hijacking, predicting or intercepting the TCP sequence number is critical for injecting unauthorized data packets into the active stream. Application-level hijacking relies on session IDs, while source IP addresses alone do not enable packet injection.

Multiple choice technology security

Which of the following is a countermeasure for a buffer overflow attack?

  1. Input field length validation

  2. Encryption

  3. Firewall

  4. Use of web forms
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Input field length validation directly checks that incoming data does not exceed buffer capacities, preventing buffer overflow vulnerabilities. Encryption protects confidentiality, firewalls control network access, and web forms are interface components; none of these address memory bounds directly.

Multiple choice technology security

Which of the following is the best countermeasure to session hijacking?

  1. Port filtering firewall

  2. Encryption

  3. Session monitoring

  4. Strong passwords
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Encryption (such as SSL/TLS or HTTPS) encrypts session communication, preventing attackers from sniffing or intercepting session tokens over the network. Firewalls, strong passwords, and session monitoring are insufficient because they cannot prevent passive sniffing of unencrypted IDs in transit.

Multiple choice technology security

What Vulnerablity does JilWIN_32 exploit ?

  1. Blank Password

  2. IP Printing buffer overflow

  3. SQL Injection

  4. None of the choices
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

The jill.c (or JilWIN_32) exploit targets a buffer overflow vulnerability (MS01-023) in Microsoft IIS 5.0's Internet Printing Protocol (IPP) ISAPI extension. It allows remote attackers to execute arbitrary system code, whereas blank passwords and SQL injection are unrelated.

Multiple choice technology security

An attack technique where a programming flaw allows an attacker to execute script in the victims's browser which can hijack user sessions, deface websites, possibly introduce worms, etc

  1. Broken authentication and Sesion Management

  2. Cross Site Request Forgery (CSRF)

  3. SQL Injection

  4. Cross Site Scripting (XSS)
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Cross-Site Scripting (XSS) occurs when vulnerable code executes malicious scripts in a victim's browser, enabling attackers to hijack sessions, deface sites, or distribute malware. SQL Injection targets databases, while CSRF triggers unauthorized actions, and broken session management exposes user tokens.

Multiple choice technology security

Security of application itself ensures absolute security of databases

  1. Yes

  2. No. Additional System Hardening is needed

  3. No.Additional Database hardening is needed.

  4. No. Additional Application hardening is needed.
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Application security alone is NOT sufficient for database security. Databases require additional hardening measures like encryption at rest, access controls, auditing, parameterized queries, and least-privilege configurations. Option C correctly identifies that database-specific hardening is still necessary. Options B and D are partially correct but C is the most precise answer.

Multiple choice technology security 
int main (int argc, char *argv[]){
    char chararray[3];
    int intarray[3];
    int i;
    strncpy(chararray, argv[1], sizeof(chararray) - 1);
    for (i=0;i<=3; i++){ /*1*/   chararray[i]= getchar();
        intarray[i]=i*i;/*2*/
    }
}

Is there a vulnerability in this code? If yes, which line(s) (Line numbers are marked using comments /* */)?

  1. 1

  2. 2

  3. 1 & 2

  4. No vulnerability
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

In line 1, the loop condition is i <= 3. Since chararray is of size 3 and intarray is of size 3, writing to index 3 (when i == 3) results in an out-of-bounds write (buffer overflow) for both arrays. Hence, line 1 is the source of the loop boundary vulnerability.

Multiple choice technology security 
int main(int argc,char* argv[]){
    int *ptr=new int;
    if(ptr==NULL)   exit(1);
    char *j;
    for(int i=1; i<=4;  i++) {
        j=argv[i];
        int k=atoi(j);
        if (k!=0){
            *ptr=k;
            delete ptr;
        }
    }
}

Will this program execute successfully ?

  1. program works when there is only 1 argument with program.

  2. program works when there are 3 arguments with program.

  3. program works when there are 4 arguments with program.

  4. program never executes successfully.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Inside the loop, ptr is deleted in the first iteration where k != 0. In subsequent iterations, if k != 0 again, the program attempts to dereference and delete the already freed pointer ptr, causing a double-free / undefined behavior. Thus, the program never executes successfully.

Multiple choice technology security

The application is receiving input from an external source. Which of the following external sources can be considered safe?

  1. Shell environment variables

  2. Data received via encrypted network channels

  3. argv[0] can only have either null or program name

  4. no external input must be trusted
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

A. Shell environment variables

Shell environment variables are not considered safe because they can be easily modified by the user. For example, a user could set the PATH environment variable to include a malicious directory, which would allow the application to execute arbitrary code.

B. Data received via encrypted network channels

Data received via encrypted network channels is considered more safe than other sources of external input, but it is still not completely safe. The encryption could be broken, or the data could be intercepted and modified before it is decrypted.

C. argv[0] can only have either null or program name

The argv[0] parameter is the name of the program that is being executed. It is not considered a safe source of input because it can be easily modified by the user. For example, a user could change the argv[0] parameter to a malicious program, which would then be executed instead of the intended program.

D. no external input must be trusted

The correct answer is D. No external input must be trusted, regardless of the source. Even if the input comes from a seemingly safe source, it is always possible that the input has been tampered with. Therefore, it is important to always validate and sanitize all external input before it is processed by the application.

The correct answer is therefore D.