Computer Knowledge · General Awareness

Information Security

4,634 Questions

Information security involves protecting computer systems and data from unauthorized access, cyber threats, and damage. It is a core part of the computer knowledge section in various banking and government exams. Practicing these concepts helps in understanding digital signatures, network security, and access control effectively.

Cybersecurity threatsAccess controlCryptography basicsSecurity risk managementDatabase protection

Information Security Questions

Multiple choice technology security

How many of following are security code review tools

  • OWASP WebScarab
  • Fortify
  • WebInspect
  • AppScan
  • Nikto
  • FindBugs

  1. 1

  2. 2

  3. 4

  4. 6
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Security code review tools analyze source code for vulnerabilities. Fortify (now Fortify Static Code Analyzer) and FindBugs (static analysis for Java) are genuine code review tools. OWASP WebScarab is a web application security assessment proxy, not a code review tool. WebInspect and AppScan are dynamic/black-box web application scanners, not code review tools. Nikto is a web server scanner.

Multiple choice technology security

What can go wrong in following code? 

#include  
int main(int argc, char *argv[]){
    if(argc != 3){
        printf("usage: %s [source] [dest]n", argv[0]);
        exit(1);
    }
    char buffer1[5];
    strcpy(buffer1, argv[1]);
    char buffer2[5];
    strcpy(buffer1, argv[1]);
    char x;
    FILE *file[2];
    file[0] = fopen(buffer1,"r+");
    file[1] = fopen(buffer2,"w+");
    for(x = 0; x < 2; x++){
        if(file[x] == NULL){
            printf("error opening file.n");
            exit(1);
        }
    }
    do {
        x = fgetc(file[0]);
        fputc(x,file[1]);
    }
    while(x != EOF);
    for(x = 0; x < 2; x++)         
        fclose(file[x]);
    return 0;
}

  1. XSS

  2. Arc Injection

  3. Buffer Overflow

  4. both 2 and 3
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

strcpy(buffer1, argv[1]) copies without length checking - buffer overflow if argv[1] exceeds 4 bytes (+ null terminator). Arc injection (aka pointer corruption) occurs because the overflow can corrupt the file[] array of FILE pointers stored after the buffers on the stack, redirecting file operations. Both vulnerabilities are present.

Multiple choice technology security 
try { 
    //code to do  IO operations 
    return var1; 
} Catch(Exception e) { 
    return var2; 
} finally{ 
    return var3; 
}

From security view point problem with above code is

  1. It is returning a value in finally block

  2. It is catching Exception

  3. Both a & b

  4. Nothing is wrong
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Returning in a finally block is problematic because it discards any exception that was thrown in the try/catch blocks and overrides return values from both try and catch. This can hide security-relevant exceptions. Catching the generic Exception instead of specific exceptions is also a security anti-pattern that can mask error conditions.

Multiple choice technology security

Please select which of the following statements are NOT true regarding the AccessController class?

  1. Can be used to mark code as being "privileged", thus affecting subsequent access determinations

  2. Can be to decide whether an access to a critical system resource is to be allowed or denied, based on the security policy currently in effect

  3. Can be used to obtain a "snapshot" of the current calling context

  4. Can be used to compute a cryptographically secure hash
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

AccessController is part of Java's security architecture for access control decisions. It can mark code as privileged (A), decide whether access should be allowed based on security policy (B), and obtain a snapshot of the calling context (C). However, computing cryptographic hashes is the domain of MessageDigest or crypto libraries, not AccessController.

Multiple choice technology security

Which of the following best describes how to sign a document using a digital signature?

  1. Create a hash of the document and encrypt the resulting hash using the signer's private key

  2. Encrypt the document using the signer's private key

  3. Encrypt the document using the signer's private key and create a hash of the encrypted document

  4. Encrypt the document using the signer's public key
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

To sign a document using a digital signature, the user needs to know the basic concepts of public key cryptography and digital signatures.

Now, let's go through each option and explain why it is right or wrong:

A. Create a hash of the document and encrypt the resulting hash using the signer's private key. This option is partially correct. To sign a document, the signer first creates a hash of the document to be signed. The hash is then encrypted using the signer's private key. However, the encrypted hash is not the signature itself; it is just one part of the signature. The encrypted hash, along with the signer's public key and other information, is used to create the digital signature.

B. Encrypt the document using the signer's private key. This option is incorrect. Signing a document does not involve encrypting the entire document using the signer's private key. Instead, the document is hashed and a digital signature is created using the private key.

C. Encrypt the document using the signer's private key and create a hash of the encrypted document. This option is incorrect. Signing a document does not involve encrypting the document using the signer's private key. Instead, the document is hashed and a digital signature is created using the private key.

D. Encrypt the document using the signer's public key. This option is incorrect. Signing a document does not involve encrypting the document using the signer's public key. Instead, the document is hashed and a digital signature is created using the signer's private key.

The Answer is: A

Multiple choice technology security

Data returned by which of the following methods should be validated before using it

  1. getParameter ()
  2. getQueryString ()
  3. getCookies ()
  4. getHeaders ()

  1. 1

  2. 1 and 2

  3. 1,2 and 3

  4. 1,2,3 and 4
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

All four methods (getParameter, getQueryString, getCookies, getHeaders) return data from the HTTP request, which comes from an external source (the client/browser). This data is attacker-controlled and must be validated before use to prevent injection attacks, header manipulation, or other security issues. getParameter and getQueryString are obvious, but cookies and headers are also user-supplied and can be malicious.

Multiple choice technology security

Which of the following are countermeasures for XSS

  1. Releasing Resources after use
  2. Input Validation
  3. Running with least privilege
  4. URL based access control
  5. Output Encoding

  1. 1 and 4

  2. 2 and 4

  3. 2 and 5

  4. 3 and 5
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Cross-site scripting (XSS) attacks exploit insufficient output encoding and input validation. Input validation (2) helps reject malicious input patterns, and output encoding (5) ensures user-supplied data is safely rendered (e.g., escaping < to <). Least privilege (3) and releasing resources (1) are general security practices but don't specifically prevent XSS. URL-based access control (4) is for authorization, not XSS.

Multiple choice technology security

In the following code, which is the location of vulnerability? 

1  bIsAdmin = true; 
2  try  
3  { 
4  function (); 
5   bIsAdmin = isAdminUser(userName); 
6  } 
7  catch (Exception ex)  
8  { 
9   log.write(ex.toString()); 
10 }

  1. Line 9

  2. Line 5

  3. Line 7

  4. Line 1
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Line 1 sets bIsAdmin = true before any authentication occurs. If an exception is thrown in function() at line 4, execution jumps to the catch block and line 5 (the actual admin check) never executes. The exception is logged but bIsAdmin remains true, allowing unauthorized admin access. This is a vulnerable default-privileged design - sensitive flags should default to false.

Multiple choice technology security

In the following code, which is the location of vulnerability? 

1 String username = req.getParameter("loginID"); 
2 String password = req.getParameter("loginPassword"); 
3 String sql = "SELECT UserID from Employee WHERE Emp_ID = ? AND Password=?"; 
4 pstmt = con.prepareStatement(sql); 
5 pstmt.setString(1,username); 
6 pstmt.setString(2,password); 
7 pstmt.execute(); 
8 user = pstmt.getResultSet(); 
9 if(user!=null)  
10 { 
11  while (user.next()) 
12  { 
13   userInfo.add(user.getString(1)); 
14  }  
15 } 
16 else 
17 { 
18  log.debug(“Invalid Login: Login ID-”+ username+” Password-”+ password); 
19 }

  1. Line 5

  2. Line 4

  3. Line 18

  4. Line 11
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Line 18 contains a vulnerability because it logs the raw, sensitive password parameter. In contrast, the SQL query execution on lines 3-7 is secure since it uses a parameterized PreparedStatement which prevents SQL injection.

Multiple choice technology security

Give the name of the vulnerability resides in the below code: 

... 
Runtime rt = Runtime.getRuntime(); 
Process proc = rt.exec("cmd.exe /c type "+request.getParameter("path")); //path is an Input Parameter and contains the file name. 
InputStream stdin = proc.getInputStream(); 
InputStreamReader isr = new InputStreamReader(stdin); 
BufferedReader br = new BufferedReader(isr);              
...

  1. Race Condition

  2. Command Injection

  3. Denial of Service

  4. Cross Site Request Forgery
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

The parameter path is fetched directly from the request and concatenated into a shell command executed by Runtime.getRuntime().exec(). An attacker can manipulate this parameter (e.g., using &amp; or |) to execute arbitrary command line arguments on the host system.

Multiple choice technology security

What is the vulnerability in this code? 

    char output[20];  
    /*   Assume data is a character array with value %200d asdf   */  
    sprintf(output, data);

  1. Buffer overflow

  2. Off by one error

  3. Format string vulnerability

  4. No vulnerabilities are present in this code
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code passes data directly as the format string to sprintf. If data contains format specifiers like %200d, sprintf will interpret them as format directives rather than literal text. Attackers can supply malicious format strings like %n to write arbitrary values to memory, leading to code execution. This is a format string vulnerability, not a buffer overflow.

Multiple choice technology security

What is the vulnerability in this code? 

int main(int argc, char * argv[]) {   
    printf (argv[1]);  
}

  1. Buffer overflow

  2. Off by one error

  3. Format string vulnerability

  4. No vulnerabilities are present in this code
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code directly prints argv[1] as the format string to printf. Since argv[1] comes from the command line (user input), an attacker can supply format specifiers like %x to read stack data or %n to write arbitrary values. This allows reading memory contents and potentially executing arbitrary code. Always use printf(%s, argv[1]) instead.

Multiple choice technology security

What is the possible vulnerability in this code?

    unsigned int total, userinput1, userinput2;  
    userinput1 = receiveInput();  
    userinput2 = receiveInput();  
    total = userinput1 + userinput2;

  1. Integer overflow

  2. Buffer overflow

  3. Stack overflow

  4. Data type mismatch
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Adding two unsigned integers can cause integer overflow if the sum exceeds UINT_MAX (typically 2^32 - 1). The result wraps around modulo 2^32, producing an unexpectedly small value. This can lead to security issues like buffer allocation errors or logic bypasses. For example, if userinput1 = 4000000000 and userinput2 = 4000000000, total wraps to ~1.7 billion instead of the expected ~8 billion.

Multiple choice technology security

What can go wrong in following code? 

#include   
int main(int argc, char *argv[]) {

if(argc != 3) {
        printf("usage: %s [source] [dest]\n", argv[0]);
        exit(1);

    }

    char x;
    FILE *file[2];
    file[0] = fopen(argv[1],"r+");
    file[1] = fopen(argv[2],"w+");
    for(x = 0; x &lt; 2; x++) { 
        if(file[x] == NULL) {
            printf("error opening file.\n");
            exit(1);
        }
    }

    do {
        x = fgetc(file[0]);
        fputc(x,file[1]);
    } while(x != EOF);

     for(x = 0; x &lt; 2; x++)
        fclose(file[x]);
     return 0; 
}

  1. SQL Injection

  2. Arc Injection

  3. Buffer Overflow

  4. both 2 and 3
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code exhibits a classic buffer overflow vulnerability through its file handling approach. The variable 'x' is declared as char instead of int, which cannot properly represent EOF (-1). This causes an infinite loop because fgetc() returns EOF as an int, but storing it in a char truncates the value, preventing proper loop termination. Additionally, the lack of input validation on file sizes means the code blindly copies content without bounds checking. SQL Injection (A) and Arc Injection (B) are unrelated to this memory corruption issue.

Multiple choice technology security

Which statement creates a buffer over flow? (Line numbers are marked using comments /* */)

#include   
#include   
#include   
int main (int argc, char *argv[])  {   
    int i=0,j=1;   
    char ipstring[80];   
    for (;i&lt;=3;i++){    
        cout&lt;&lt;"\n entering a new character\n";    
        j=getchar();/*1*/     
        cout&lt;&lt;”enter a string”;    
        gets(ipstring);/*2*/    
        cout&lt;

  1. 1

  2. 2

  3. Both

  4. None
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Line 2 (gets(ipstring)) creates a buffer overflow because gets() reads input until newline without checking buffer size. Since ipstring is only 80 characters, any input longer than 79 characters will overflow the buffer, corrupting memory. Line 1 (getchar()) is safe as it reads a single character. The gets() function is inherently unsafe and has been deprecated precisely because it cannot prevent buffer overflows - it doesn't take a buffer size parameter.