Security in Computing Questions

Security in Computing Questions:
1. Full form of FUD?

Fear, Uncertainty, and Doubt.
2. Define 3d’s in security and full form?

3D’s : Defence, Detection, Deterrence
Defence : It is measure reduce the risk of attack.
Detection : In order to react to security incident you first know about it. So, that you can detect it &
apply proper strategy to shut it.
Deterrence : Many companies implements deterrence control for the employee using threats of discipline
& determination for evolution at policy & this will help in reducing the attack & miss using
the data.
3. Write steps to build a security program?

Authority, Framework, Assessment, Planning, Action, Maintenance
4. What are the components of authority and Assessment in security program?

Authority : Security Program Charter and Resourcing Plan
Assessment : Risk Analysis, Gap Analysis and Remediation Plans
5. Define Roadmap?
Roadmap is a plan of action for how to implement the security remediation plans.
6. What is the different medium chosen by the attacker to confidentiality information?

Malware, Backdoor, Remote Access, Web-mail, Trojan, Internet
7. Difference between strategy and tactic
8. Define threat and common computer threat?

A threat is a potential attack or a loop hole that could leave doors open for a tracker to break
confidentiality or availability of the system.
Common computer threats:
1. Physical Damage 2. Natural Events 3. Resource Unavailability 4. Technical Failure
5. Deliberate Type
9. Enlist threat vectors

 The network
 Users
 Email
 Web applications
 Remote access
 Mobile
10. MMC (Malicious Mobile code) and its diagram
MMC is any software program design to move from computer to computer and network to network in
order to damaged the system.
It has three variants : 1. Virus 2. Worms 3.Trojan
11. Define virus and its types. And define types in one word each
Virus : A virus is a self replicating program that uses other host file or code to replicate.
Types of Viruses:
1. Boot Sector Virus : It infects the master boot record
2. Direct Action Virus : It is non-resident virus, it gets installed or stays hidden in the computer
memory.
3. Resident Virus : It hides & stores itself within the computer's memory.
4. Multi partite Virus : It infects boot sector & executable files at the same time.
5. Overwrite Virus : It is use to destroy file or application data
6. Polymorphic Virus : It is difficult to identify with a additional anti-virus program.
7. File Infector Virus : It infect program files, such as applications, games or utilities.
8. Spacefiller Virus : It is a cavity virus.
9. Macro Virus : It particularly target macro language command.
12. Define worm and its types and what each type target on?
A Worm is a stand alone malware computer program that replicates itself in order to spread to
other computer.
Types of Worms:
1. Email Worm : Email Worms spread through malicious email as an attachment or a link.
2. Bot Worm : It attack to computer & turns them into Zombies.
3. IRC Worm : It spread by Internet Relay Chat (IRC) chat channels, sending infected files or links.
4. Internet Worm : It is self-replicated & distributes copies of itself to its network. It target low level
TCP/IP ports directly.
5. File Sharing Worm : File sharing Worms place a copy itself in a shared folder.
6. Instant Messaging Worm : It spreads via instant messaging applications by sending links.
13. Define Trojan and what action Trojan take place

Trojan is the type of malware which appears to be legitimate but attacks the system & gain access.
The Trojan do not self replicate.
The actions includes : Delete Data, Block Data, Modify Data, Interrupt the performance of the system
14. Define RAT(Remote Access Trojan)?

RAT is a malware program that includes backdoor access over the target computer.
15. What RAT Works on?
Monitor the system, Access confidential information, Activate system webcam & recording video,
Tracking screen-shorts, Destructing viruses & other malware deleting downloading the file system.
16. APT (Advance Persistent Threats) & its diagram?

It is a computer attack which person gain unauthorized access to the network & remains undetected for
an executed period of time.
17. How many steps APT has?

7
18. Enlist different types of attack

1. Physical Layer Attack
2. Data-link Layer Attack
3. Man-in-the-middle Attack
4. APR Spoofing
5. DoS (Denial-of -Service)Attack
19. Define ARP and its diagram?

ARP (Address Resolution Protocol) is a protocol used to map & IP address to a physical machine
address which can be identified on the local network.
20. Define sniffing and spoofing?

Sniffing : It is a process of monitoring & capturing all data packets passing through given network.
Spoofing : it is the act of facing the true identity of packets.
21. What does MAC Flood?

MAC (Media Access Control) Flooding is a type of cyber attack done in a network to compromise the
security of the network switches. In this attack the network is flooded with the fake MAC addresses.
22. Define DoS?

A Denial-of-Service (DoS) attack is an attack which shut down a machine or network, making it
inaccessible to its intended users.
23. Define SQL injection Attack?

In SQL injection an attacker connects to a website with a SQL server back-end database & it works with
SQL queries.
24. Define Risk?

Risk is defined as uncertainty of outcome whether positive opportunity or negative threats.
25. Security is never 100 % Sure.

26. Write Steps in Risk Analysis Process.
1. Conduct a risk assessment summary
2. Identify the risk
3. Analyze
4. Developer plan
5. Implement
6. Mentor
27. TYPES of Risk.

1. Qualitative Risk : It will occur based on subjective quality.
2. Quantitative Risk : It has a measurable data & high probability of calculating the risk.
28. How the risk values represented?

0 -1 -0
Low Medium High
29. Formula for ALE?

ALE = SLE * ARO
30. Full form SLE, ALE, ARO.

SLE : Single Loss Expectancy
ALE : Annual Loss Expectancy
ARO : Annual Rate of Occurrence
31. CIA Triad Security Model with diagram
32. How many defense model are there

2 Models : i. Lollipop Model
ii.Onion Model
33. Draw Lollipop & Onion Model

34. Difference between lollipop and onion model
Lollipop Model Onion Model
 It is harder from outside & chewy, soft  It is like online having many layers of
from inside security.
 It is less Secure.  It is more Secure.
 It has only 1 layer.  It has 5-6 layers.
35. Best Practices for network defense model

1) Secure the physical environment
2) Password project booting
3) Password protect CMOS
4) Disable booting from USB and CD
5) Harden the operating system
6) Use an antivirus scanner
7) Keep patches updated
8) Secure network share permission
9) Use Encryption
10) Secure application
11) Security configure application
12) Securing E-mail
36. Enlist Harden the Operating System

1) Update with the most recent security update.
2) Password management
3) Disable unnecessary accounts
4) Directory & File Protection
5) File system encryption
6) Disable unnecessary file sharing
7) Hardening the network
8) Password protection
9) Disable ports
10) Wireless security
37. Define antivirus?

Antivirus is a kind of software used to prevent, scan, detect & delete viruses from a computer.
38. Types of share permission

There are three types of share permissions:
1) Full Control
2) Change
3) Read.
39. Define RBAC

It is a mechanism that restricts system access. It involves setting permissions & privileges to enable
access to authorized users.
40. Roles of RBAC (Role-Based Access Control)

1) Role Assignment
2) Role Authorization
3) Permission Authorization
41. Define ACL (Access Control List)

Access Control List is a table that tells computer OS which access each right user has.
42. List Permission In ACL (For Windows)
1) Full Control
2) Modify
3) Read & Execute
4) List folder contents & Read it
5) Read
6) Write
7) Special permission
43. ISO Provisions

 11.2.1 User registration & deregistration procedure
 11.2.2 Allocation of privileges (Read, Write, Execute)
 11.2.3 Allocation & Re-allocation of password
 11.2.4 User right review
 11.3.1 Maintain secure password
 11.4.2 Authentication mechanism
 11.5.2 Unique identifiers
 11.5.3 Password management system
44. COBIT
45. Encryption is originated from Greek word Kryptos (meaning hidden or secret).
46. Convert into ceaser shift cipher following message: shift with 3 alphabets
“Hello I am in TYIT A”
“KHOOR L DP LQ WBLW D”
47. Difference between Symmetric & Asymmetric Key
Symmetric Asymmetric
 It only requires a one key for both  It requires two keys; one foe encryption &
encryption & decryption. other one to decryption.
48. Stream Shifter Process 1 bit at a time.

49. Block Shifter Process Blocks (Groups) bit at a time.
50. Recipient use Recipient Private key in PKC.
51. Sender use Recipient’s Public key in PKC.
52. PKI consist of

1) User
2) Registration Authority (RA)
3) Certificate Authority (CA)
4) Verifier
5) Central Destroy (CD)
6) Central Policy (CP)
53. Benefits of PKI

 Ensuring trust between participants in an electronic transmission
 Ensuring the confidentiality of data in transit over networks.
 Guaranteeing the authenticity of data transmitted electronically.
 Maintaining non-repudiation of transactions once complete; as well as ensuring authentication &
confidentiality of personal data.
54. Enlist storage security evolution line wise

1) Floppy Disk
2) Compact Disk (DVD)
3) Flash Drive
4) Plad Disk
5) Solid State Drive (SSD)
6) Cloud
55. Enlist what consist of fundamental storage infrastructure?

 Server Cage
 Network Cage
 Array
56. Define OLTP

OLTP (Online Transaction Processing) is a class of software program ‘capable’ of supporting
transaction-oriented applications on the internet. (eg. Railway Ticket)
57. Write four steps in Network-level security

1) Implement
2) Analyze
3) Test
4) Modify
58. Define Authentication

Authentication is the process of recognizing a user’s identity.
59. Types of Authentication
 Single Factor Authentication
 Two Factor Authentication
 Multi Factor Authentication
 Combination using Kerberos, biometric, OTP
60. How many types of Authentication are there?

4
61. OTP is also called as?

One Time password or One Time Pin
62. Kerberos
63. Sequential keys

64. Certificate Based Authentication
65. SSL/ TLS (Secured Socket Layer / Transport Layer Security)
66. Smart Card
67. Define Biometric

Biometric are biological measurements or physical characteristics that can be used to identify individuals.
68. Define Authorization
Authorization is security mechanism used to determine user privileges & access level related to system
resource.
69. Enlist Object Level Security

Select, Insert, Update, Delete, Grant, Revoke, Deny
70. Define Backup. List down its Types.

Backup is a process of backing up the data in case of lost & setting up the system.
Types of Backup:
 Full Backup
 Incremental Backup
 Differential Backup
 Transactional Backup
71. Flow of Keeping Server Up to Date

 Backup your data
 The right environment
 Keeping everything updated
72. Database Security Layers

 Server Layer Security
 Network Layer Security
 Data Encryption
 Operating System Security
 Manage Database Logins
73. Database Level Security

 Roles & permission
 Object level security
 Stored procedure
 Trigger
74. Performance has 3 layers : 1. Core Layer 2. Distribution Layer 3. Access Layer
75. Network Availability means that system must be Robust & Available to the user as an when required.
76. Demilitarized Zone (DMZ) is made upo of one or more isolated LAN computer that contains shared
server resources. Eg : Email server & Proxy server
77. OSI model was introduced by ISO (International Oraganization for Stanadardization) it is a
concept of layering.
78. Types of Routers : 1. Static Router 2. Dynamic Router
79. Routing Protocols are classified by :

Purpose, Operations, Behavior
80. An Autonomous System (AS) is a collection of routers under a common adminstration such as a
company or an orgainzation.
81. Autonomous System (AS) is also known as a Routing Doamin.
82. Firewall prevent unauthorized users accessing private netwok connected to the internet.
83.
84. Wirless Vulnerabilities & Mitigations
1) Wired Side Leakage
2) Rogue Access Point
3) MisConfigured Access Points
4) Wireless Phishing
85. An Intrusion Detection System monitors the traffic flowing across the network & every packet against
known issue for attack & create a alert baseed result.
86. An IP Telephony is an aspect of communication that uses the internet to exchange voice messages, fox
& other types of information over the IP- Based netwoks.
87. H.248 is also called as Megaco

DDoS - Distributed Denial of Service
DHCP (Dynamic Host Configuration Protocol) Attack
CHAP - Challenge Handshake Authentication Protocol
NIST - National Institute of Standards and Technology
PKI - Public Key Infrastructure
PKC - Public Key Cryptography
PKI = PKC + Digital Signature
CA - Certificate Authority
OSI - Open System Interconnection
MAC - Media Access Control
IP - Internet Protocol
ARP - Address Resolution Protocol
IGP - Interior Gateway Protocol
EGP - Exterior Gateway Protocol
FHSS - Frequency Hopping Sprade Spectrum
DSSS - Direct-Sequence Spread Spectrum
TKIP - Temporal Key Integrity Protocol
EAP - Extensible Authentication Protocols
IPS - Intrusion Prevention System
IDS - Intrusion Detection System
HIDS - Host based Intrusion Detection System
NIDS - Network based Intrusion Detection System
SIEM - Security Information & Event Management
SIP - Session Initiation Protocol
RIP - Real-Time Transport Protocol
RICP - Real-Time Transport Control Protocol
SRTP - Secure Real-Time Transport Protocol
SDP - Session Description Protocol
COPS - Common Open Policy Service Protocol
SIC MCQ :
1. ______ means to include the right level of responsibility and authorization to be effective.
a) Assessment
b) Framework
c) Planning
d) Authority
2. _______ are the day-today practices of the individuals and technologies assigned to the protection of
assets.
a) Strategic planning
b) Security Strategy
c) Security Tactics
d) Security
3. _______ typically arrive in documents, executable files, and e-mail.

a) Threat
b) Trojan
c) Worm
d) Virus
4. If the virus stays in memory after it is executed, it is called a ________.

a) parasitic virus
b) overwriting virus
c) stealth viruses
d) memory-resident virus
5. Viruses placing themselves at the end of a file are called ________.

a) overwriting virus
b) parasitic virus Or file virus
c) appending virus
d) stealth virus
6. Which of the following is an example of content attack?

a) Email attack
b) packet Injector
c) SQL injection attacks
d) buffer overflow
7. What does CIA stand for _______

a) Confidentiality, Integrity, Availability
b) Central Intelligence Agency
c) Cyber security ,Investigation Agency
d) Cyber security, Internet, Accessibility
8. The attack surface of the operating system is reduced by _____________

a) Installing unnecessary software
b) Disabling unneeded services
c) Allowing access to everyone
d) Giving administrative privileges to everyone.
9. SSL stands for?

a) Secured Socket Layer
b) Secured Shell Layer
c) System Socket Layer
d) System Secured Layer
10. What is Authentication ?
a) Encryption
b) Proof of Identity
c) Access
d) Modification
11. Which list ACL is composed of ?

a) Access control entries
b) Permission
c) SID
d) Access control rejection
12. The process of transforming plain text into unreadable text.

a) Decryption
b) Encryption
c) Network Security
d) Information Hiding
13. What is the name of the group that IBM have formed in 1970's to design a block cipher to protect
customer data?
a) Crypto Group
b) Stream Cipher Group
c) Block Cipher Group
d) Cipher Suites Group
14. DES stands for?

a) Data Encryption Standard
b) Data Encryption Statistics
c) Data Encryption System
d) Data Encryption Sequence
15. What is full form of LUNs?

a) logical unit numbers
b) linear unit numbers
c) linear uniary numbers
d) linear union numbers
16. What is full form of NAS?

a) New-attached storage
b) New-available storage
c) Network-attached storage
d) Neutral attached storage
17. Using tools to capture network packets is called ________.

a) Packet spoofing
b) Packet sniffing
c) Packet relay
d) Packet replay
18. ________ Command specifies that a particular user or role will have access to perform specific action on
database objects
a) REVOKE
b) GRANT
c) UPDATE
d) DENY
lOMoARcPSD|13673010
SIC MCQ ALL - sic mcq
Bachelor of Engineering in Information Technology (University of Mumbai)
StuDocu is not sponsored or endorsed by any college or university

Downloaded by Sourabh Chavan (sourabhrchavan.2020@gmail.com)
lOMoARcPSD|13673010
UNIT 1
1. ____ is nothing but resisting attack (1 point)
⚫ Defence
◯ Detection
◯ Detterence
◯ None of the above
2. Three D's of the security are________ (1 point)
◯ Defence , Dynamic, Does
◯ Detect, Display, Dynamic
⚫ Defence ,Detection,Deterrence
3. _______model has multiple layer of security (1 point)
⚫ Onion
◯ Lolipop
◯ Both
4. _____ is a standalone computer program that replicate itself in order to spread itself. (1 point)
⚫ Worms
◯ Trojans
◯ Virus
5. DoS stands for (1 point)
◯ Data of security
⚫ Denial of service
◯ Denial on service

lOMoARcPSD|13673010
6. ________ means that the data has not been altered in an unauthorized way (1 point)
◯ Confidentiality
⚫ Integrity
◯ Availability
7. ________attack attempts to learn or make use of information from the system but does
not affect resources.
(1 point)
◯ Active Attack
⚫ passive attack
◯ User
8. ___________ is a measure how easily data and software can be transferred from one
organization to other organization
(1 point)
◯ Carriers
◯ Transport
⚫ Portability
9. _______is the process of identifying presence of some malicious activity which is
concealed
(1 point)
⚫ Detection
◯ Detterence
◯ Defence
10. _______is a path or tool used by the hacker to attack the sysytem (1 point)

lOMoARcPSD|13673010
◯ Threat
⚫ Threat Vector
◯ User
11. ________ means that only the authorized individual or system can view sensitive
information
(1 point)
⚫ Confidentiality
◯ Integrity
◯ Availability
12. _______model has only one layer of security (1 point)
◯ Onion
⚫ Lolipop
◯ Both
13. ________refers to the ability of the organization that allows it to respond rapidly to the
changes in the external and internal environment
(1 point)
⚫ Business Agility
◯ Portability
◯ Cost Reduction
◯ Security Methodology
14. _______is a malware that is disguised as legitimate software and which can be used to
gain backdoor access to users computer
(1 point)
◯ Worms

lOMoARcPSD|13673010
⚫ Trojan
◯ Virus

15. _______ is a self replicating program that uses other host files or code to replicate (1 point)
◯ Worms
◯ Trojans
⚫ Virus
16. ________attack attempts to modify the system resources or affect their operations (1 point)
⚫ Active Attack
◯ passive attack
◯ User
17. Every IP address is of ______bits (1 point)
◯ 40
⚫ 32
◯ 48
18. MAC stands for _______ (1 point)
⚫ Media access control
◯ Machine access control
◯ Man access control
19. ________is an effective method of reducing frequency of security compromises ,and
thereby total loss due to security incidents
(1 point)
◯ Detection

lOMoARcPSD|13673010
⚫ Detterence
◯ Defence

20. __________is an an important assets for any company or organization (1 point)
◯ Employees
⚫ Information
◯ Salary
UNIT 2
1. The process of converting encrypted form of text back to its original form is called (1 point)
◯ Encryption
⚫ Decryption
◯ Cryptosystem
2. _________is a security mechanism used to determine user previledges or access levels
related to system resources
(1 point)
◯ Authentication
⚫ Authorization
◯ Both the above
3. Biometrics is a method of _________ (1 point)
⚫ Authentication
◯ Authorization
◯ Both the above
4. ________factor authentication involves two level authentication (1 point)
◯ MFA
◯ SFA
⚫ Two factor authentication

lOMoARcPSD|13673010
5. Local storage and comparison is a method of _________ (1 point)
⚫ Authentication
◯ Authorization
◯ Both the above
6. User rights is a type of _______ (1 point)
◯ Authentication
⚫ Authorization
◯ Both the above
7. In Public key cryptography encryption is done using (1 point)
◯ Senders public key
⚫ Receivers public key
◯ Senders private key
8. ________ cryptography uses the same key for encryption and decryption (1 point)
⚫ Symmetric key cryptography
◯ Asymmetric key cryptography
◯ PKI
9. In ________cryptography system the key is shared to receiver before data transform (1 point)
◯ Asymmetric key cryptography
⚫ Symmetric key cryptography
◯ PKI
10. RBAC is a type of __________ (1 point)
◯ Authentication
⚫ Authorization
◯ Both the above
11. Use of OTP is __________type of authentication (1 point)
◯ MFA
◯ SFA

lOMoARcPSD|13673010
⚫ Two factor authentication
12. ________ cryptography uses the different key for encryption and decryption (1 point)
⚫ Asymmetric key cryptography
◯ Symmetric key cryptography
◯ PKI
13. ______ is a method of encoding a message into a non readable format (1
point) ◯ Conversion
⚫ Encryption
◯ Decryption
14. Kerberos is a method of _________ (1 point)
⚫ Authentication
◯ Authorization
◯ Both the above
15. The encrypted form of text is called as _____ (1 point)
◯ Encryption
◯ Decryption
⚫ Cipher text
16. In Public key cryptography decryption is done using (1 point)
⚫ Receivers private key
◯ Receivers public key
17. Username and password is a method of _________ (1
point) ⚫ Authentication
◯ Authorization
◯ Both the above
18. One time password system is a method of _________ (1 point)

lOMoARcPSD|13673010
⚫ Authentication
◯ Authorization
◯ Both the above
19. ________key is known to all (1 point)

◯ Private
⚫ Public
◯ Both
20. File access permission is a type of ________ (1
point) ◯ Authentication
⚫ Authorization
◯ Both the above
21. Central storage and comparison is a method of _________ (1 point)
⚫ Authentication
◯ Authorization
◯ Both the above
22. ________ is the process of determining who is the user (1
point) ⚫ Authentication
◯ Authorization
◯ Identification
23. In Public key cryptography decryption is done using (1 point)
⚫ Receivers private key
◯ Receivers public key
24. ACL stands for _______ (1 point)
◯ Access control line
◯ Access counter list
⚫ Access control list

lOMoARcPSD|13673010
25. ACL is a type of ________ (1 point)
◯ Authentication
⚫ Authorization
◯ Both the above

26. Username and password is __________ type of authentication (1 point)
◯ MFA
⚫ SFA
◯ Two factor authentication
27. System used for encryption and decryption is known as_______ (1 point)
◯ Encry decry system
◯ Transformation
⚫ Cryptosystem
21. ___________ comparers the desired state of security program with the actual current
state and identifies the difference
(1 point)
◯ Risk Analysis
⚫ Gap Analysis
◯ Both
22. _________is an attack where an application inject a specially crafted packet on to the
network repeatedly
(1 point)
◯ ARP Posoning
⚫ MAC Flooding
◯ DHCP poisoning
23. The act of capturing data packets across the computer network by an unauthorized

lOMoARcPSD|13673010
third party destined for computers other than their own is called _________ (1 point)
◯ Attack
⚫ Packet sniffing
◯ Theft
24. ________model was an open model (1 point)
◯ Government model
⚫ Academic model
◯ Both Gov and academic
25. ________ means that the dat a should be available as an when needed (1
point) ◯ Confidentiality
◯ Integrity
⚫ Availability
UNIT 3
1. _________device forward the packet received at one port to all other port without
storing
(1 point)
◯ Switch
◯ Router
⚫ Hub
2. ____ layer is responsible for host to host delivery (1 point)
⚫ Network
◯ Data link layer
◯ Transport layer
3. _______ is also private network controlled by organization and can be used for providing

lOMoARcPSD|13673010
application access to trusted external parties such as supplier, vendors,partners and
customers
(1 point)
◯ Internet
◯ Intranet
⚫ Extranet
4. It is possible to prevent direct connection between external and internal users via
______
(1 point)
◯ Firewall
⚫ Proxy services
◯ ACL
5. ______ is a hardware, software or combination of both that monitors and filters the
traffic that coming or going out the network
(1 point)
⚫ Firewall
◯ IPS
◯ ACL
6. IPV6 addresses are ______bit in a size (1 point)
◯ 48
⚫ 128
◯ 16
7. To send traffic ,sending device must have destination device _______ address (1 point)
◯ IP address
◯ MAC
⚫ Both the above
8. ________layer is concern with the syntax and symantics of the information (1 point)

lOMoARcPSD|13673010
◯ Application layer
⚫ Presentation layer
◯ Session layer
9. _________are the set of changes to a computer designed to update,fix or improve it (1 point)
⚫ Patches
◯ Protocol
◯ Standard
10. In Cisco H. Model _________layer aggregates traffic from all nodes and uplinks from
the access layer and provide policy based connectivity.
(1 point)
◯ Access layer
◯ Core layer
⚫ Distribution layer
11. ________layer is responsible for delivery of message from one process to other (1 point)
◯ Physical layer
◯ Data link layer
⚫ Transport layer
12. _______ is a private network of an organization which is accessible only to the members
of the organization
(1 point)
◯ Internet
⚫ Intranet
◯ Extranet
13. _______ provide the mechanism to reporting TCP/IP communication problems (1 point)
◯ ARP
◯ RARP
⚫ ICMP

lOMoARcPSD|13673010
14. MAC addresses are ____ bit hexadecimal colon separated numbers assigned to NIC by
the manufacturer
(1 point)
⚫ 48
◯ 32
◯ 16
15. High availability ,security, quality of service and IP multicasting are the features of
________layer
(1 point)
⚫ Access layer
◯ Core layer
◯ Distribution layer
16. An acceptable level of information systems risk depends on the individual organization
and its ability to tolerate risk
(1 point)
⚫ True
◯ False
17. _______device is used to connect two different network (1 point)
◯ Switch
⚫ Router
◯ Hub
18. ________device forward the received packet to only one port for its correct destination (1 point)
⚫ Switch
◯ Router
◯ Hub
19. In Cisco H. Model _________layer forms the network backbone and it is focused on
moving data as fast as possible between distribution layers

lOMoARcPSD|13673010
(1 point)
◯ Access layer
⚫ Core layer
◯ Distribution layer
20. ______ is a hardware, software or combination of both that monitors and filters the
traffic that coming or going out the network
(1 point)
⚫ Firewall
◯ IPS
◯ ACL
UNIT 4
1. TEM stands for _________ (1 point)
◯ Telephone expert management
◯ telecommunication expense manager
⚫ Telecom expense management
2. _________is a telephone services over Internet (1 point)
◯ Voice Internet
◯ VIP
⚫ VoIP
3. _________consist of an agent on a host that identifies and intrusion by analysing system
calls, application logs,etc
(1 point)
◯ SIDS
◯ NIDS
⚫ HIDS
4. ________ identifies packets when it going through TCP/IP stack (1 point)
⚫ SIDS

lOMoARcPSD|13673010
◯ NIDS
◯ HIDS
5. __________ type of security classification of computer system uses formal design
specification and variation techniques
(1 point)
⚫ Type A
◯ Type B
◯ Type C
6. ___________method of detection uses signatures ,which are attack patterns that are
preconfigured and predetermined
(1 point)
◯ Statistical anomly based detection
◯ Stateful protocol analysis decison
⚫ signature based detection
7. _______ method identifies deviations of protocol states by comparing observed events
with predetermined profile of generally accepted definition of begin activity (1 point)
⚫ Stateful protocol analysis decison
◯ signature based detection
◯ Click Statistical anomly based detection add a new answer choice 8.
__________is a telephone system within an enterprise that switches call between
enterprise users on local lines while allowing all users to share certain no. of external
phone lines
(1 point)
◯ Public branch exchange
⚫ PBX
◯ phone bank exchange
9. SAMM stands for _________ (1 point)

lOMoARcPSD|13673010
◯ Software as a multilayer module
⚫ Software assurance maturity model
◯ Software assurance model maturity
10. HIDS stands for (1 point)
Host based intrusion detection system
11. SIEM stands for ______ (1 point)
◯ security information protocol
◯ Secure information and event management
⚫ Security information and event management

12. _________is an independent platform that identifies intrusion by examining network
traffic and monitors multiple host
(1 point)
◯ SIDS
⚫ NIDS
◯ HIDS
13. As per U.S Department of users trusted computer systems evaluation criteria there are
________ security classifications in computer system
(1 point)
◯1
◯3
⚫4
14. IPS stands for _______ (1 point)
◯ intrusion protection system
⚫ intrusion prevention sysytem
◯ Intrusion private system
15. IDS stands for (1 point)
intrusion detection system

lOMoARcPSD|13673010
16. NIDS stands for (1 point)
Network intrusion decision system
17. _________is a open framework to help organizations formulate and implement a
strategy for software security that is tailored to the specific risk facing the organizations
(1 point)
⚫ SAMM
◯ PBX
◯ VOiP
18. ___________is a term used to define an approach to managing all telephone service
expense such as voice ,data,etc
(1 point)
⚫ TEM
◯ PBX
◯ VOiP
19. SIDS stands for (1 point)
Stack based intrusion detection system
20. _________attack is an attempt to make a system inaccessible to its legitimate users (1 point)
◯ passive attack
⚫ DDoS
◯ Active attack
UNIT 5
1. _______ virtual machine support the host computers physical resources between
multiple virtual machines,each running with its own copy of the operating system (1
point)
◯ Process virtual machine
⚫ system virtual machine
◯ none of the above

lOMoARcPSD|13673010
2. ______ phase if SDL consist of activities that occur prior to writing code (1
point) ◯ Requirment
⚫ Design
◯ Coding
3. ________provides us means by which we can access the applications as utilities over
the Internet
(1 point)
◯ virtual machine
◯ system virtual machine
⚫ Cloud computing
4. Yahoo messenger is not a example of thick client (1 point)

◯ True
⚫ False
5. Two tier thick client application uses user computer and ________ (1 point)
◯ Local computer
⚫ Server
◯ Database
6. _______of the following service provides companies with computing resources including
server, networking,storage and data center space etc
(1 point)
⚫ IaaS
◯ SaaS
◯ PaaS
7. SDL stands for_______ (1 point)
◯ Software development life cycle
⚫ Secure development life cycle
◯ standard life cycle

lOMoARcPSD|13673010
8. Three tier thick client application uses user computer ,application server and _______ (1 point)
◯ Local computer
◯ Remote Computer
⚫ Database
9. Full form of SaaS (1 point)
Software as a service
10. Microsoft outlook is a example of thick client (1 point)
⚫ True
◯ False
11. Depending on use and level of dependencies virtual machines can be devided into
________ categories
(1 point)
◯1
⚫2
◯3
12. _______of the following service provides a cloud based environment with everything
required to support the complete life cycle of building and delivering cloud based
application without the cost and complexity of buying and managing the underlying
hardware and software,provisios etc
(1 point)
◯ IaaS
◯ SaaS
⚫ PaaS
13. _________is designed to provide platform independent programming environment
that makes the information of the underlying hardware or OS and allows program
execution to take place in the same way on the given platform
(1 point)

lOMoARcPSD|13673010
⚫ Process virtual machine
◯ system virtual machine
◯ none of the above
14. Full form of PaaS (1 point)
Platform as a service
15. Yahoo.com is not a example of thin client (1 point)
◯ True
⚫ False
16. ________ clients are heavy applications which involve normally the installation of
application on the user computer
(1 point)
⚫ thick client
◯ thin client
17. Full form of IaaS (1 point)
Infrastructure as a service
18. Creating computer within a computer is known as _________ (1
point) ⚫ Virtual Machine
◯ Nested Computer
◯ Computer in Computer
19. _______ client applications are web based applications which can be accessed on the
Internet using a browser
(1 point)
◯ thick client
⚫ thin client
20. Write any one recommendation for Application-Focused security (1 point)

lOMoARcPSD|13673010
Treat infrastructure as unknown and insecure
21. ________ is a computer file typically called an image,which behave like an actual
computer
(1 point)
⚫ Virtual Machine
◯ computer image
◯ Computer in Computer
22. Google.com is a example of thin client (1 point)
⚫ True
◯ False
Security in Computing
Unit 1
1. is one of the most important assets a company possesses.
a) Employees
b) Resources
c) Information
d) Money
Ans: Information
2. Confidential information is available to external audiences only for business-related purposes and
only after entering
a or equivalent obligation of confidentiality.
a) Nondemocratic Agreement (NDA)
b) Nondisclosure Agreement (NDA)
c) National Democratic Alliance (NDA)
d) Nondisclosure Alliance (NDA)
Ans: Nondisclosure Agreement (NDA)
3. Originally, the academic security model was and the government security model was .
a) closed and locked, wide open

lOMoARcPSD|13673010
b) wide locked, open and closed
c) wide and open, wide and closed
d) wide open, closed and locked
Ans: wide open, closed and locked
4. A approach doesn’t work when you need to allow thousands or millions of people to have access to
the services on your network.
a) closed-door
b) open-door
c) wide-door
d) locked-door
Ans: closed door
5. An approach doesn’t work when you need to protect the privacy of each individual who interacts with
the services on your network.
a) closed-door
b) open-door
c) wide-door
d) locked-door
Ans: open-door
6. As more companies started doing business on the Internet, concepts such as were developed
to provide business services over the Internet.
a) Software-as-a-Service (SaaS)
b) Virtual private networks (VPNs)
c) Personally identifiable information (PII)
d) Storage as a Service (SaaS)
Ans: Software-as-a-Service (SaaS)
7. What can result in service outages during which customers cannot make purchases and the company
cannot transact
business?

lOMoARcPSD|13673010
a) virus outbreak
b) web site outage
c) denial of service (DoS) attack
d) All of the above
e) None of the above
Ans: All of the above
8. means that software and data can be used on multiple platforms or can be transferred/transmitted
within an organization, to a customer, or to a business partner.
a) Portability
b) Accessibility
c) Authority
d) Sharing
Ans: Portability
9. is concerned with protecting information in all its forms, whether written, spoken, electronic,
graphical, or using other methods of communication.
a) Software Security
b) Information Security
c) Network Security
d) Storage Security
Ans: Information security
10. is concerned with protecting data, hardware, and software on a computer network.
a) Software Security
b) Information Security
c) Network Security
d) Storage Security
Ans: Network security
11. The three Ds of security stand for:
a) Defense, dedication, and deterrence

lOMoARcPSD|13673010
b) Defense, detection, and discipline
c) Defense, detection, and deterrence
d) Defense, detection, and diligence
Ans: defense, detection, and deterrence
12. Without adequate a security breach may go unnoticed for hours, days, or even forever.
a) Detection
b) Deterrence
c) Defense
d) All of the above
Ans: Detection
13. The 3 aspects of Security are:
a) Defense, dedication, and deterrence
b) Defense, detection, and discipline
c) Defense, detection, and deterrence
d) Defense, detection, and diligence
Ans: defense, detection, and deterrence
14. provides a defensible approach to building the program.

a) Security program
b) Security framework
c) Planning
d) Security initiatives
Ans: Security framework
15. A security program defines the purpose, scope, and responsibilities of the security organization and
gives formal authority for the program.
a) Charter
b) Memo
c) Document
d) File

lOMoARcPSD|13673010
Ans: Charter
16. The provides a framework for the security effort.
a) Security program
b) Security framework
c) Security policy
d) Security initiatives
Ans: Security framework
17. change with each version of software and hardware, as features are added and functionality
changes,
and they are different for each manufacturer.
a) Standards
b) Rules
c) Application
d) Files
Ans: Standards
18. Guidelines for the use of software, computer systems, and networks should be clearly documented
for the sake of
the people who use these technologies.

a) Standards
b) Rules
c) Guidelines
d) Security
Ans: Guidelines
19. provides a perspective on current risks to the organization’s assets.
a) Risk Analysis
b) Planning
c) Guidelines
d) Security
Ans: Risk Analysis

lOMoARcPSD|13673010
20. compares the desired state of the security program with the actual current state and identifies the
differences.
a) Risk Analysis
b) Security Analysis
c) Comparison Analysis
d) Gap Analysis
Ans: Gap Analysis
21. is a plan of action for how to implement the security remediation plans.
a) Charter
b) Outline
c) Roadmap
d) Layout
Ans: Roadmap
22. The documents how security technologies are implemented, at a relatively high level.
a) Charter
b) Security architecture
c) Roadmap
d) Layout
Ans: security architecture
23. The actions that should be taken when a security event occurs are defined in? the incident response
plan.
a) Charter
b) Security architecture
c) Roadmap
d) Incident response plan
Ans: Incident response plan
24. is the process of defense, is the process of insurance, and is deciding that the risk
does not require any action.

lOMoARcPSD|13673010
a) Planning, transference, acceptance
b) Planning, mitigation, acceptance
c) Transference, mitigation, acceptance
d) Mitigation, transference, acceptance
Ans: Mitigation, transference, acceptance
25. is a term used to describe where a threat originates and the path it takes to reach a target.
a) Threat vector
b) Origin vector
c) Target vector
d) Trojan vector
Ans: Threat vector
26. refers to a Trojan program planted by an unsuspecting employee who runs a program provided by a
trusted friend from a storage device like a disk or USB stick, that plants a back door inside the network.
a) Threat exploit
b) Friend exploit
c) Girlfriend exploit
d) Trusted exploit
Ans: Girlfriend exploit
27. Which are the generally recognized variants of malicious mobile code?
a) Viruses
b) Worms
c) Trojans
d) a and b
e) a, b and c
Ans: a, b and c
28. is a self-replicating program that uses other host files or code to replicate.
a) Virus
b) Worm

lOMoARcPSD|13673010
c) Trojan
d) None of the above
Ans: Virus
29. If the virus executes, does its damage, and terminates until the next time it is executed, it is known
as?
a) Temporary virus
b) Resident virus
c) Nonresident virus
d) Stealth virus
Ans: Nonresident virus
30. If the virus stays in memory after it is executed, it is called?
a) Permanent virus
b) Memory-resident virus
c) Memory Nonresident virus
Ans: Memory-resident virus
31. Which viruses insert themselves as part of the operating system or application and can manipulate
any file that is
executed, copied, moved, or listed?
a) Permanent viruses
b) Memory-resident viruses
c) Memory Nonresident viruses
Ans: Memory-resident virus
32. If the virus overwrites the host code with its own code, effectively destroying much of the original
contents, it is
called?
a) Overwriting virus
b) Stealth virus

lOMoARcPSD|13673010
c) Nonresident virus
d) Parasitic virus
Ans: Overwriting virus
33. If the virus inserts itself into the host code, moving the original code around so the host
programming still remains
and is executed after the virus code, the virus is called?
b) Stealth virus
c) Prepending virus
d) Parasitic virus
Ans: Parasitic virus
34. Viruses that copy themselves to the beginning of the file are called? prepending viruses
b) Appending virus
c) Prepending virus
d) Parasitic virus
Ans: Prepending virus
35. Viruses placing themselves at the end of a file are called?
b) Appending virus
c) Prepending virus
d) Parasitic virus
Ans: Appending virus
36. Viruses appearing in the middle of a host file are labeled? mid-infecting viruses.
a) Mid-infecting viruses
b) Appending viruses
c) Prepending viruses
d) Parasitic viruses
Ans: Mid-infecting viruses

lOMoARcPSD|13673010
37. Who works by posing as legitimate programs that are activated by an unsuspecting user?
a) Virus
b) Worm
c) Trojan
Ans: Trojan
38. Which type of Trojans infect a host and wait for their originating attacker’s commands telling them
to attack other hosts.
a) Directed Action Trojans
b) Zombie Trojans
c) Remote Access Trojans
Ans: Zombie Trojans
39. CIA stands for?
a) Confidentiality, Integrity, and Availability
b) Confidentiality, Integrity, and Accessibility
c) Confirmity, Integrity, and Accessibility
d) Confidentiality, Integrity, and Authority
Ans: Confidentiality, Integrity, and Availability
40. refers to the restriction of access to data only to those who are authorized to use it.
a) Confidentiality
b) Authority
c) Accessibility
Ans: Confidentiality
41.Onion model is also known as:
a) Perimeter Security
b) Defense in depth

lOMoARcPSD|13673010
c) Both of the above
Ans: Defense in depth
1) What control can be used to help mitigate identified risks to acceptable levels?
a. Authentication b. Authorization c. Decryption d. Management
Ans: Authentication
2) Which one is the key network design strategy?

a. Performance b. Cost of Security c. Routing d. Encryption
Ans: Cost of Security
3) Which technologies may be considered by the design team to prevent one application from
consuming too much of bandwidth?
a. Electronic Security Perimeter(ESP)
b. Software-as-a-Service(SaaS)
c. Public Switched Telephone Network(PSTN)
d. Quality of Service(QoS)
Ans: Quality of Service
4) How many layers does Cisco Internetworking model has?
a. Three b. Four c. Two d. One
Ans: Three
5) What is Core layer’s primary focus?
a. Filtering b. Encryption c. Performance d. Compressing Ans: Performance
6) __________ layer is composed of the user networking connections. a.
Access layer b. Core layer c. Distribution layer d. Firewall Ans: Access layer

lOMoARcPSD|13673010
7) Which architecturing approach offers higher performance and lower cost but also brings special
security considerations into play.
a. Single-tier b. Three-tier c. Multi-tier d. collapsed two-tier Ans: collapsed two-tier
8) What helps us to understand how to use routers and switches to increase the security of the
network?
a. Security Network Design
b. Wireless Network Security
c. Network Device Security
d. Firewalls
Ans: Security Network Design
9) The dominant internetworking protocol in use today is known as ______. a.
TCP/IP b. HTTPS c. FTP d. UTM
Ans: TCP/IP
10) MAC addresses are ____ bit hexadecimal numbers that are uniquely assigned to each
hardware network interface by the manufacturer.
a. 8 b. 24 c. 48 d. 64
Ans: 48
11) IPv4 addresses are ___ bits.
a. 8 b. 32 c. 64 d. 128
Ans: 32
12) IPv6 addresses are ____ bits.
a. 128 b. 32 c. 24 d. 64
Ans: 128
13) The host uses the ________ , which functions by sending a broadcast message to the network that
basically says, “ Who has 192.168.2.10, tell 192.168.2.15”.

lOMoARcPSD|13673010
a. Network Interface Card(NIC)
b. Domain Name Server(DNS)
c. Address Resolution Protocol (ARP)
d. Open System Connection (OSI)
Ans: Address Resolution Protocol (ARP)
14) How many layers does OSI model contain?
a. Five b. Six c. Four d. Seven
Ans: seven
15) ______ an OSI-model layer is used to convert application data into acceptable and compatible
formats for transmission. At this layer, data is encrypted and encoded and encrypted.
a. Presentation b. Application c. Transport d. Network
Ans: Presentation
16) Which is most well-known application-layer protocols in use today?
a. TCP/IP b. UDP c. HTTP d. FTP
Ans: HTTP
17) Which layer provides mechanism for two host to maintain network connections . a.
Data-link layer b. Session layer c. Physical layer d. Transport layer Ans: Session layer
18) Which layer provides unique address to every host on the network . a.
Application layer b. Physical layer c. Transport layer d. Network layer Ans: Network
layer
19) _____ layer is composed of two sub layers : Media Access Control (MAC) and Logical Link
Control (LLC).
a. Data-link b. Transport c. Application d. Physical
Ans: Data-link

lOMoARcPSD|13673010
20) As the size of the network increases, the distance and time a packet is in transmit over the
network also ________ , making collision more likely.
a. Increases b. Decreases c. All of the above d. None of the above Ans:
Increases
21) Routers and switches operate at layers ___ and ___ respectively.
a. Two and three b. Three and Two c. One and Two d. Three and Four. Ans: Three
and Two
22) In which two ways routers learn the locations of various networks ? a.
Dynamically and Statically
b. Dynamically and Manually
c. All of the above
d. None of the above
Ans: Dynamically and Manually

23) What are the two main types of layer three (Routing) protocols?
a. Dynamic and static
b. Distance-vector and Link-state
c. Manual and Static
Ans: Distance-vector and Link-state
24) Which one of the following is a network hardening method?
a. Remote Access Considerations
b. Network Modelling
c. The cost of Security
d. Patching
Ans: Patching

lOMoARcPSD|13673010
25) What can be configured to permit or deny TCP, UDP, or other types of traffic based on the source or
the destination address.
a. Disabling Unused Services
b. Access Control Lists
c. Patching
d. Switch Security Practices
Ans: Access Control List
26) Which one of the following comes under Disabling Unused Services?
a. Access Control Lists
b. Administrative Practises
c. Proxy ARP
d. Patching
Ans: Proxy ARP
27) _______ provides a mechanism for reporting TCP/IP communication problems, as well as utilities
for testing IP layer connectivity.
a. Simple Network Management Protocol (SNMP)
b. Internet Control Message Protocol (ICMP)
c. Centralizing Account Management (AAA)
d. Remote Command Line
Ans: Internet Control Message Protocol (ICMP)
28) Whose function is to screen network traffic for the purpose of preventing unauthorized access
between computer networks?
a. Firewalls
b. Network Analysis
c. Documentation

lOMoARcPSD|13673010
Ans: Firewall
29) Different types of software administrators are concerned about that could violate security policies.
a. Peer-to-peer file sharing
b. Web mail
c. Remote access
d. All of the above
30) Which one of the following is not a Must-have Firewall feature?
a. Remote Access
b. Application Awareness
c. Granular Application Control

d. Bandwidth Management (QoS)
Ans: Remote Access
31) Which one is not the core function of a firewall?
a. Network Address Translation
b. Auditing and Logging
c. a & b both
Ans: None of the above
32) What is the mask for IP address 192.168.0.0 as per Private Addresses specified in RFC1918?
a. 255.0.0.0
b. 255.240.0.0
c. 255.255.0.0

lOMoARcPSD|13673010
Ans: 255.255.0.0
33) In which of the following way Modern Firewalls assist other areas of network quality and
performance?
a. Enhance Network Performance
b. Intrusion detection and Intrusion Prevention
c. a & b both
Ans: Intrusion detection and Intrusion Prevention
34) Which of the following is true
a. Firewalls are used to restrict access specific services.
b. Firewall cannot enforce security policies that are absent or undefined. c. Firewalls
can alert appropriate people of specified events.
d. All of the above
35) Which layer holds the protocols for Telecommunicaton ?
a. Network layer
b. Physical layer
c. Data- link layer
d. Transport layer
Ans: Transport layer
36) Which of the following is a flaw of Data-link layer?
a. Battery operated
b. War driving
c. Evil Twin

lOMoARcPSD|13673010
d. Rogue Access Point
Ans: Battery operated
37) The threats to data link layer.
a. War chalking
b. WEP cracking
c. both a&b
Ans: both a&b
38) Select the mitigation technique from the following. a.
Disabling unused services
b. Switch Security practices
c. Policies and procedures
d. All of the above
Ans: Policies and procedures

39) In which of the following way(s) wireless network security can be enhanced a.
Use a strong password
b. Enable your router firewall
c. Turn off Guest networking
d. All of the above
40) Which of the following is/are fundamental component(s) of Wireless Intrusion Prevention System.

lOMoARcPSD|13673010
a. Sensors
b. Management Servers
c. Database server
d. All of the above.
1) A network IDS is referred to as _____ .

a. HIDS b. NIDS c. SIDS d. HIPS
Ans: NIDS
2) Which of the following is/are Intrusion Detection (ID) system when it checks files and disks for
known malware?
a. Firewalls b. Antivirus c. Both a & b d. None of the above
Ans: Both a&b
3) Which one of the following cannot be considered as an attack?

a. Buffer Overflows
b. Denial of Services
c. Password cracking
d. Patching
Ans: Patching
4) _____ is an independent platform that identifies intrusions by examining network traffic and
monitors multiple hosts.
a. Stack-Based Intrusion Detection System (SIDS)
b. Network Intrusion Decision System (NIDS)
c. Host-Based Intrusion Detection System (SIDS)
Ans: Network Intrusion Decision System
5) ______ identifies intrusion by analyzing system calls, application logs, file-system modifications
and other host activities.
a. Host-Based Intrusion Detection System (HIDS)
b. Stack-Based Intrusion Detection System (SIDS)
c. Network Intrusion Decision System (NIDS)
d. All of the above
Ans: Host-Based Intrusion Detection System (HIDS)

lOMoARcPSD|13673010
6) What kind of an activity the attacks are considered to be?

a. All of the below
b. Denial Of Service
c. Unauthorized
d. Buffer overflow
Ans: All of the below
7) Which of the following mean “False Positive”?

a. Incorrect ignorance of important events
b. Incorrect escalation of unimportant events
c. Correct ignorance of unimportant events
Ans: Incorrect escalation of unimportant events
8) Which type of system is an evolution of HIDS ?

a. Stack-Based Intrusion Detection System
b. Network Intrusion Decision System
c. Passive System
d. Rective System
Ans: Stack-Based Intrusion Detection System
9) Which systems comes under Intrusion Prevention System (IPS)?

a. Reactive Systems
b. Active Systems
c. Passive Systems
d. All of the above
Ans: Reactive System
10) Which of the following is true for Intrusion Detection System (IPS)?
a. They are placed in-line
b. They are able to actively block intrusions that are detected
c. Takes actions such as sending an alarm, dropping the malicious packets, etc.
d. All of the above
11) _____ is an approach to security management that combines SIM (Security Information
Management) and SEM (Security Event Management).
a. SIEM

lOMoARcPSD|13673010
b. SOAR
c. UEBA
Ans: SIEM
12) Which of the following is the most important feature to review when evaluating SIEM products?
a. Testing
b. Threat Intelligence feeds
c. Aggregation
d. All of the above
Ans: Threat Intelligence feeds
13) Which protocol is used for VoIP?

a. Skype protocol
b. Media Gateway Control Protocol
c. Session Initiation Protocol
d. All of the above
14) Which main function is performed by Media Server?

a. Provisioning of Media connection
b. Voicemail functionality
c. Managing Digital Signal Processing (DSP)
d. Free phone service
Ans: Voicemail functionality
15) Which main function is performed by Application server?

a. Support of customized private dialing plans.
b. Support of bandwidth policing mechanism
c. Support of MGCP and MEGACO
Ans: Support of customized private dialing plans
16) _____ switches calls between enterprises users on local lines while allowing all users to share
certain number of external phone lines.
a. POT
b. PBX
c. TEM
d. All of the above
Ans: PBX

lOMoARcPSD|13673010
17) Which one of the following is considered to be in Computer Security classification?

a. Type A
b. Type D
c. Both a&b
Ans: Both a&b
18) Which of the following defines Microsoft’s Trust worthy computing technique?
a. Memory curtaining
b. Remote attestation
c. Sealed storage
d. All of the above
19) Which of the following is a hardware attacking vector?

a. BIOS
b. PBX
c. POT
Ans: BIOS
20) Which of the following does not define Jericho Security Model?
a. Integration
b. Simplifies use of public networks
c. It has a real open security framework
d. Aimed for open solution building blocks
Ans: It has a real open security framework
SIC MULTIPLE CHOICE UNIT 4
1) What security device combines IOS firewall with VPN and IPS services?

lOMoARcPSD|13673010
a. ASA
b. ISR
c. Cisco Catalyst switches
d. IPS
ANS: B.
2) Which of the following is a standards-based protocol for authenticating network clients?
a. Cisco ISE
b. PoE
c. 802.1X
d. CSM
ANS: C.
3) The Cisco ________ is an integrated solution led by Cisco that incorporates the network
infrastructure and third-party software to impose security policy on attached endpoints
a. ASA
b. CSM
c. ISR
d. ISE
ANS: D.
4) What software-based solution can network security administrators use to configure

standalone ASA firewalls?

lOMoARcPSD|13673010
a. ISR
b. Cisco ISE
c. ASDM
d. IDM
ANS: C.
5) Cisco IOS Trust and Identity has a set of services that includes which of the following?
a. 802.1X
b. SSL
c. AAA
d. ASDM
ANS: A,B,and C.
6) IOS ______________ offers data encryption at the IP packet level using a set of
standards-based protocols.
a. IPS
b. IPsec
c. L2TP
d. L2F
ANS: B.
7) What provides hardware VPN encryption for terminating a large number of VPN tunnels
for ISRs?

lOMoARcPSD|13673010
a. ASA SM
b. WebVPN Services Module
c. Network Analysis Module 3
d. High-Performance AIM
ANS: D.
8) What are two ways to enhance VPN performance on Cisco ISR G2s?
a. SSL Network Module
b. IDS Network Module
c. Built-In Hardware VPN Acceleration
d. High-Performance AIM
ANS: C and D
9) Which Cisco security solution can prevent noncompliant devices from accessing the
network until they are compliant?
a. IPsec
b. ASA Service module
c. ACS
d. Cisco ISE
ANS: D.
10) Which of the following service modules do Cisco Catalyst 6500 switches support? (Select
all that apply.)
a. ASA SM
b. Network Analysis Module 3

lOMoARcPSD|13673010
c. High-Performance AIM
d. FirePOWER IPS
ANS: A and B
11) What provides packet capture capabilities and visibility into all layers of network data
flows?
a. Network Analysis Module 3
b. ASA Services Module
c. WebVPN Services Module
d. IPsec VPN SPA
ANS: A.
12) Which of the following are identity and access control protocols and mechanisms?
(Select all that apply.)
a. 802.1X
b. ACLs
c. CSM
d. NetFlow
ANS: A and B.
13) Which two of the following are Cisco security management tools?

lOMoARcPSD|13673010
a. CSM
b. IDS module
c. ACS
d. Cisco ISE
ANS: A,C, and D.
14) True or false: NetFlow is used for threat detection and mitigation?
ANS: True
15) True or false: Cisco ASAs, ASA SM, and IOS firewall are part of infection containment.
ANS: True
16) What IOS feature offers inline deep packet inspection to successfully diminish a wide
range of network attacks?
a. IOS SSH
b. IOS SSL VPN
c. IOS IPsec
d. IOS IPS
ANS: D.
17) What provides centralized control for administrative access to Cisco devices and
security applications?

lOMoARcPSD|13673010
a. CSM
b. ACS
c. NetFlow
d. ASDM
ANS: B.
18) Match each protocol, mechanism, or feature with its security grouping:
i. CSM
ii. IGP/EGP MD5
iii. NetFlow
iv. Cisco ISE
a. Identity and access control
b. Threat detection and mitigation
c. Infrastructure protection
d. Security management
ANS: i = D, ii = C, iii = B, iv = A
19) What Is IDS?
a. Intrusion prevention system

b. Intrusions Detection system
c. Intrusion Detection system d.
Intrusion Decision system
ANS: C.

lOMoARcPSD|13673010
20) Types of IDS
a. Host based
b. Network based
c. Application based
d. All of the above
ANS: A and B.
21) what is IPS
a. Intrusion prevention system b.

Intrusions prevention system c.
Intrusion Project system
d. Intrusion Partition system
Ans :- A
22) Which Layer Use in hostbased IDS
a. Application layer
b. Network layer
c. Presentation layer
d. Transport layer
ANS: a.
23) Which Layer Use in Network based IDS
a. Application layer
b. Network layer
c. Presentation layer

lOMoARcPSD|13673010
d. Transport layer
ANS: B.
24) HIDS can detect what?
a. Traffic of implementation
b. Traffic of interest
c. Traffic of detection
d. None of these
ANS: B
25) ….. Includes denial of services, virus,worm ,infection ,buffer overflow , malfunction ,
file corruption , unauthorised program
a. IDS
b. IPS
c. Attack
d. Both a and b
ANS: C.
26) Four categories of misused? (select appropriate ans)
a. True positive
b. False positive
c. True Negative
d. False Negative
e. A and B
f. C and D

lOMoARcPSD|13673010
Ans: A,B,C, and D
27) IDS Tools Can track ?
a. Internal maliciousness
b. External attacks
c. Permanent maliciousness
d. Both a and b
Ans :- D
28) when an ids misses a legitimate thread know as ?
a. False positive
b. False negative
c. True negative
d. True positive
Ans :- B
29) ids are plugin with higher ?
a. True positive
b. False negative
c. False positive
d. True negative
Ans:-c
30 ) first generation ids focused on
a. Accurate attack detection

lOMoARcPSD|13673010
b. Backend option
c. Bountiful array
d. None of these
Ans :- a
31) True Or false
second generation ids detect attacks more than short them, prevent them , attempt to add
value
Ans True
32 ) Hostbased IDS are static and dynamic
Ans :- true
33) two types of Hostbased IDS ?
a) File integrity
b) Behaviour monitoring
c) Static and dynamic
d) All of the above
Ans :- D
34) what was the file integrity?
a) Snap shot or checksum

b) Realtime monitoring
c) Behaviour monitoring
d) Sql Injection

lOMoARcPSD|13673010
Ans:- A
35) what was the behaviour monitoring
a) Snap shot or checksum

b) Realtime monitoring
c) Behaviour monitoring
d) None of these
Ans: B
36) behaviour monitoring on web server may monitor ?
a) Incoming request
b) Report maliciously
c) Html responses
d) Crossed side scripting attacks
e) Sql injection
f) A and D
g) C and E
h) All of the above
Ans: H
37) True or False
Network based ids they work By Capturing and analyzing network packet by on the wire
Ans:- True
38) network tabs dedicate appliances used to mirror a port or interface physically and swith

lOMoARcPSD|13673010
port analysis are two most common methods of ?
a) Hostbased
b) Network based
c) Both A and B
d) None of these
Ans:- B
39) What are types of detection model ?
a) Anomaly model
b) Signature detection model
c) Both A and B
d) All of these
Ans:- C
40) anomaly detection IDS looks only at ___________ ?\
a) Physical layer
b) Network packet
c) Network packet header
d) None of these
Ans :- C
41) anomaly detection IDS looks only at Network packet header is called protocol anomaly
detection
Ans :- True

lOMoARcPSD|13673010
42) true or false
Signature detection or misuse IDS are the most popular types of IDS
Ans :- True
43) in signature detection model attacker is looking for the presence of ?
a) Buffer overflow
b) Particular file
c) Particular directory
d) Both A and B
Ans:- D
44) The shortest possible sequence detect is related thread in signature detection model what
was needed ?
a) File
b) Directory
c) Bytes
d) None of these
Ans:- C
45) Disadvantages of IDS
a) Cannot recognize Unknown attack

b) Performance suffer as signature
c) Rules grow
d) All of the above
Ans:- D

lOMoARcPSD|13673010
46) what is fullform of SIEM
a) Security interface and event management

b) Security information and event management
c) Security information and event manager
d) Security interface and event manager
Ans :- B
47) feature of SIEM

a) Data aggregation
b) Analysis
c) Operation interface
d) Additional feature
e) A and C
f) B and D
g) All of the above
Ans:- G
48 ) what are the voice over Ip component
a) Call control elements

b) Gateway and gatekeepers
c) multi conference unit
d) Software clients and software end point
e) Contact center component
f) All of the above
Ans:- F
49) call control elements are runs on ________

lOMoARcPSD|13673010
a) Appliance
b) Hardware component
c) Server operating system
d) Software component
Ans :- C
50) voice and media gateway component is what allows

a) Termination to a PSTN
b) Transport in between TDM
c) Ip network
Ans:- A_B_C
51) gatekeepers which kind of security function use
a) AAA
b) IP PBX
c) Both A and B
d) None of these
Ans:- A
52) what are hardware endpoint
a) Mobile device
b) eavesdropping
c) Denial of service attack
d) All of the above

lOMoARcPSD|13673010
Ans:- D
53) hardware endpoint by registering to the call control element
Ans: True
54) what are two reason of software endpoint
a) Cost
b) Softclient
c) Both a and B
d) None of the
Ans:- C
55) two component of call center and contact center
a) Automatic call detection

b) Direct inward system
c) Interactive voice response
d) A and C
Ans:- D
56) what is PBX

lOMoARcPSD|13673010
a) Private branch exchange

b) Public branch exchange
c) Either a or B
d) All of the above
Ans :- A
57) feature of PBX
a) Multiple extension
b) Voice mail
c) Remote control
d) Call forwarding
e) All of the above
Ans:-e
58) common attacks on PBX
a) Administrative ports and remote access

b) Voice mail denial of service
c) Securing PBX
d) All of the above
Ans:- D
59) what is TEM
a) Telecom expense management

b) Telegram expense manager

lOMoARcPSD|13673010
c) Telecom extended management

d) All of the above
Ans :- A
60) effort in involved the set of TEM

a) Increasing the cost
b) Optimize of the billing
c) Both A and B
d) None of these
Ans:- B
61) the operating system security model also known as trusted computing base
Ans: True
62) what are security model
a) Set of rules
b) Security functionality
c) Both A and B
d) None of these
Ans:- C

lOMoARcPSD|13673010
63) The operating system security model comes under ?
a) Network protocol layer

b) Security protocol layer
c) Physical security layer
d) All of the above
Ans:- A
64) what are vulnerable; to spoofing are trust relation between

a) Source address
b) Destination address
c) Ip address
d) Both A and B
Ans: D
65) ____ Is carried out Dos Attack
a) Source address
b) Destination address
c) Ip address
d) Both A and B
Ans:- C
66) what is vulnerable to session Hijacking a

lOMoARcPSD|13673010
a) Attacker can take control of connection by the session key And Using it to insert is on
traffic
b) Establish TCP IP communication session
c) Combination with dos Attack
d) Man in Middle attack
e) All of the above
Ans:- E
67) in sequence guessing number used in TCP connection is

a) 16 bits
b) 32 bits
c) 64 bits
d) 128 bits
Ans:- B
68) what is measure weakness of TCP IP
a) No authentication
b) No encryption
c) Both A and B
Ans:- C
69) Different classing model

lOMoARcPSD|13673010
a) Bell-La-Padula
b) BiBa
c) Clark-wilson
d) All of the above
Ans:- D
70) Bell-La-Padula model consist of the following component

a) Set of subject
b) Set of object
c) Control metrics
Ans :- A_B_C
71) the subject can only read the object
a) Read only
b) Append
c) Execute
d) Read-write
Ans :- A
72) The Subject can Only Write to The object but it can not be read
a) Execute
b) Read-write
c) Append
d) Read only

lOMoARcPSD|13673010
Ans:- C
73) Subject can execute the object but can neither read or write
a) Read -write
b) Read only
c) Execute
d) Append
ans :- C
74) subject has both read and write permission to the object
a) Append
b) Read only
c) Execute
d) Read and write
Ans:- D
75) rules of biba model
a) Simple integrity ( no read down can not read the data from lower integrity level )
b) Star integrity ( no write cannot write data to a higher integrity level c) Invocation
property ( can not invoke a subject at a higher integrity level ) d) All of the above
Ans:- D
76) what is acl
a) Access control list

b) Access define list
c) Access definition list
d) All of the above

lOMoARcPSD|13673010
Ans:- a
77) how many ACL component List
a) Discretionary access control list( DACL)

b) System access control list (SACL)
c) Rule based access control (RBAC)
d) Identity based access control ( IBAC)
e) All of the above
Ans:- E
78) what is DAC and What is MAC
a) Discretionary access control and mandatory access control list

b) Directory access control and mobile access control list c) Both
A and B
d) None of these
Ans:- A
79) Dac Is more Secure than MAc
Ans:- False

lOMoARcPSD|13673010
80 ) MAC is More Flexible
Ans:- False
. ..

Sr No Question Option 1 Option 2 Option 3 Option 4 Correct Answer
Confidentiality, Content, Intervention, Compatibility, Integration, Confidentiality,

1 What does CIA stand for? Content,interface,Advancement Integrity,Availability Agility Ability Integrity,Availability
2 What is an important Asset in an organization? Communication Synergy Information Mobility Information
General public, employees,contractors,service employees,contractors,service

3 Who is intended to see or use Information for internal use? Students government officials Teachers, PTA members providers providers
4 VPN stands for? Virtual private network Visually paired network Vital prevention network Virtual public network Virtual private network
5 SaaS stands for? Software as a setup Software as a service Softnet as a service Signal as a service Software as a service
6 PaaS Stands for? Platform as a setup Project as a service Platform as a service Projection as a software Platform as a service
7 IaaS standd for? Infrastructure as a Service Infrastructure as a setup Input as a setup Infrastructure as a software Infrastructure as a Service
Which attack doesn’t allow a person who is legitimate or

8 authenticated and authorized to use a service? Virus BUGS Trojan horse Denial of service attack(dos) Denial of service attack(dos)
platforms or can be transmitted Cannot be used on Is at a fixed place and it cannot or can be transmitted / transferred
9 What is Portability? / transferred across. Cannot be transmitted. multiple platofrms be transferred. across.
10 Which field is concerned with protecting assests in general? Software Security Service Platform Security
Which type of Security is concerned with protecting data,

11 hardware and software on a computer network? Software security Network Security Mobile Security Internet Security Network Security
informationin all its form , whether

12 written,spoken,electronic,graphical or using other methods of Internal Security Software security Mobile Security Information Security Information Security
event or action by instilling fear The action that leads to The action of encouraging event or action by instilling fear
13 What is Deterrence? or doubt of the consequences. Having no opinions at all no consequences. everything. ordoubt of the consequences.
everyone is denied all the where authorization is which must include the level of responsibilty is not include the right level of
14 What is Authority in building a security program? services. not need. right level of required. responsibilty and authorization to
provide a defensible required to build a defensible approach to build approach to build the security
15 What is a framework in building a security program? Framework is an attack approach to build a security program. the security program. program.
protected,why and how it leadsto required to build a Assessment is only for protected,why and how it leads to
16 What is Assessment in building a security program ? a strategy for improving the Assessing the techniques. security program. documentational purposes. a strategy for improving the
Planning doesn't provde producing priorities and Planning delays the provide in building a security priorities and timelines for
17 What does Planning provide in building a security program? priorities or timilines. timelines for security tasks to be completed. program securityinitiatives.
produce the desired results team donot produce the donot follow the palns No actions are taken in produce the desired results based
18 What is the role of Action in building a security program? based on the plans. desirable results laid out. building a security program. on the plans.
Miantanance of secuirty required by the security that have reached the maintenance structure laid out reached the end stage is now to
19 What is Maintenance in building a security program? program is optional program. end stage is now to for a security program. maintain them.
Which plan defines the actions to be taken when a security
20 event occurs? Theft plan Introduction plan induction plan Incident Response Plan Incident Response Plan
partners and other stakeholders about the desired behaviour and

21 the actions to be taken in various circumstances to comply Security awareness program Deterrence program Theft program Decision program Security awareness program
Where a threat can't be and the path it takes to Where a Threat orginates and Where a treat originates and the
22 What is threat vector? No threats exists. found. reach a target. ends there. path it takes to reach a target.
Preventive controls donot block blocks the security block the security threat Preventive controls donot security threats before they can
23 What are Preventive controls? the vulnerability. threats before they can after they have block the security threats. exploit a vulnerability.
Restores the availability of the Cannot use the servicesit Restores the availability of the
24 What are Recovery controls? service Denies the service. restores. Doesn't restore anything. service
Find, Exploit, Infect,
25 What is the life cycle of Malicious mobile code? find,lost,repeat fail, find,repeat Repeat lost,failed,exploit,repeat Find, Exploit, Infect, Repeat
The three generally recognised variants of malicious mobile

26 code are…. viruses,worms and trojans bugs,defect,outage outage,fail,bugs main-in-the-middle,bugs,dos viruses,worms and trojans
Depends on another program and are are activated by an unsuspecting

27 What are Trojans or Trojan horse pograms? Self replicating code to infect activated by an like man-in-the-middle attack user.
Adavanced Persistent Add-ons producingthreats
28 What Does APT stand for? Advanced Performance threats Threats Ad-hoc Performance threats Adavanced Persistent Threats
It doesn't allow the attacker to Does not reveal the transmitted content and transmitted content and may
29 What does Packet Sniffing do? look at the transmitted content. passwords and content. Denial of service may reveal passwords and reveal passwords and confidential
The attacker floods the server the applications and then which application is application is running on a application is running on a
30 What are content attcks? with content. sniffs the information running on a particular particular server and then particular server and then
sends
program expecting input does when a program when a program Buffer overflows occur when a program expecting input does not
31 What is buffer Overflow? not do input validation. expecting an input expecting an output program is expecting nothing. do input validation.
32 ARP Stands for…. Attacker resolution protocol Address Result protocol Attacker result protocol Address Resolution Protocol Address Resolution Protocol
ARP Poisoining works by responding to the ARP responding to the ARP responding to the ARP responding to the ARP
33 How does ARP Poisoning work? responding to the ARP packets. requests with Attackers requests with Attackers requests with systems port requestswith Attackers MAC
address.
is the probablity of an event that the risk is the probablity the risk is the probablity risk is the probablity of an the probablity of an undesired
34 What is the formal Definition of RISK? occurs. of an undesired event to of an undesired event to desired event to cause an event to cause an undesired result
of vulnerability) * Cost of the Profit(Threat+theft) * RISK= Loss(Threat+theft) Profit(vulnerabilityt+theft) *Asset vulnerability) * Cost of the
35 What is the formal Definition of Risk? Asset damaged Cost of the Asset * Cost of the Asset Assetdamaged
Restriction to access for all the data only to those who those who are not authorisedto to those who are authorised to use
36 What is Confidentiality? users. No Restriction of access. are authorised to use it. use it it.
been altered in an unauthorized Assurance that the data modified and altered by been altered in an unauthorized
37 What is Integrity? way. has been altered. an unauthorized user. The data is not in use. way.
Assurance that the services are services will never be services will be not be will be available when it's Assurance that the services will
38 What is Availability? no longer in use. needed. available when it's needed. beavailable when it's needed.
39 FTP stands for….. file transmit protocol File Transfer Protocol folder transit protocol Folder transfer protcol File Transfer Protocol
Secure Shell or Secure

40 SSH stands for… Security shell Secure hardware Socket Shell Secure socket hardware Secure Shell or Secure Socket
Shell
through a port is monitored passing through a port is passing is stopped and through a port is not through a port is monitored
41 What is Port Rate Limiting? during a given length of time, if halted. dropped. monitored. duringa given length of time, if
the
Dynamic Host Configuration Domain Host Dynamic Host Conflict Data Host Configuration Dynamic Host
42 DHCP stands for.. protocol Configuration protocol protocol protocol Configurationprotocol
43 DNS stand for… Dynamic network system Data name system Dynamic name system Domain Name System Domain Name System
Process of analyzing Process of decoding

44 What is Encryption? Process of encoding information information information Caligraphy Process of encoding information
Process of analyzing Process of decoding

45 What is Decryption? Process of encoding information information information Caligraphy Process of decoding information
Basic input/output
46 BIOS stands for… Basic input system Basic output System system Basic input Server Basic input/output system
47 What is an Alternative term for Onion Model? Defense in depth Dynamic defense Defense in Domain Domain in defense Defense in depth
physical wall around objects of or physical wall around virtual or physical wall physical wall around objects of physical wall around objects
48 What is perimeter security? no importance. no objects around objects of value. no great value ofvalue.
What are the laws that cover network intrusions that results in
49 theft,fraud or damage are referred as? Public laws Hacking laws Private laws Key laws Hacking Laws
The assurance that the service service will be available service will not be will be available when it's not The assurance that the service
50 What is Uptime? has expired. when it's needed. available. needed. willbe available when it's
needed.
mechanism determines
the user's identitybefore
1 Authorization Authentication Encryption Availability Authentication
revealing the sensitive
Information.
In process,the user
makes a provable claim about
2 Authentication Encryption Availability Authorization Authentication
individual identity or an entity's
identity.
In ,The credentials or
3 claim could be a username, Encryption Authorization Authentication Encryption Authentication
password, finger etc.
The inefficient
mechanism could significantly
4 Availability Authentication Encryption Authorization Authentication
affect the availability of the
service.
An intruder may intercept,
modify and replay the document
in order trick or steal the
5 Intergrity Denial of Service Man-in-the middle Fabrication Fabrication
information this typeof attack is
called as
.
The mechanism to ensures that

the sender and receiver are Data-origin Peer entity Data-origin
6 Fabrication Cryptography
righteous people is knownas . authentication authentication authentication
The mechanism to ensures the

security of the established
connection between sender and Data-origin Peer entity Peer entity
7 Cryptography Fabrication
receiver with the help of secret authentication authentication authentication
session key is known as
.
Attackers who are able to

access to the file for a
8 system can use brute force Data Password Virtual Authentication Password
attacks against the hashed
passwords.
Attackers who are able to access
to the password file fora system
9 can use Denial-of-service Brute force Man-in-the middle Non-repudiation Brute force
attacks against the hashed
passwords.
authentication requires
that a user provide asecond
10 Two-factor Three-factor Biometric Mobile Two-factor
authentication factor in
addition to the password.
Select incorrect type of

11 biometric authentication from Fingerprint scan Retina scan Security token Voice recognition Security token
the giveen list of options.
Select correct type of

12 possession factor from the Fingerprint scan Security Token Password biometric Security Token
given list of options.
Select correct type of
13 knowledge factor from the Security Token Biometric password Security key Password
given list of options.
is an automatically
generated numeric or
14 alphanumeric string of Security Token One-time password Security key Pin One-time password
characters that authenticates
a uset.
authentication is the
process of verifying user via
15 Two-factor Three-factor Mobile Continuous Mobile
their devices or verifying the
devices themselves.
In authentication, a
company's application
16 Two-factor Mobile Continuous Three-factor Continuous
continually computes an
authentication score.
In authentication, the
server requests
17 authentication Information API Key Mobile HTTP basic one-time password HTTP basic
i.e. a username and password
from the client.
In authentication
method, a first-time user is
18 assigned a unique generated HTTP basic API key OAuth Mobile API key
value that indicates thet the
user is known.
is an open standard
for Token-based
19 HTTP basic Open authorization API key one-time password Open authorization
authentication and
authorization on the internet.
The protocol is used for

20 secure remote login from one FTP HTTP SSH POP SSH
computer to another
protocol protects the
communication security and
21 SSH HTTP FTP POP SSH
integrity with strong
encryption.
technique is used to
determine the permissions
22 Authentication Authorization Availability Confidentiality Authorization
that are granted to an
authenticated user.
The identity of a person is

23 Encryption Authentication Authorization Face Authentication
assured by .
checks the access list

24 that the authenticated person Service Authorization Authentication Management Authorization
has.
is the method by which
plaintext is converted from a
25 Encryption Decryption Fabrication Integrity Encryption
readable form to an encoded
version.
is a method of
protecting Information and
communications through the
26 use of codes so that only Cryptography Confidentiality Availability Encoding Cryptography
those for whom the
information is intended can
read and process it.
In encryption,
27 different keys are used for Symmetric key Digital signature Public key Digital certificate Public key
encryption and decryption.
consists of software
and hardware elements that a
Public key Public key
28 trusted third party can use to Digital signature Digital certificate Encryption
infrastructure infrastructue
establish the integrity and
ownership of a public key.
signs the digital
Certification Certification
29 certificate by using its private Cryptographer Sender Receiver
Authority Authority
key.
NAS stands for Network-

30 Area Attack Attached Administrative Attached
Storage.
SAN stands for Area

31 Secure Storage Symmetric Service Storage
Networks.
refers to limiting
Information access and
disclosure to only authorized
32 Confidentiality Integrity Availability Authenticity Confidentiality
users as well as preventing
access by or disclosure to
unauthorised ones.
is the risk of loss of
Information such as
confidential data and Inappropriate
33 Espionage Data leakage Fraud Data leakage
intellectual property through administrator access
intentional or unintentional
means.
refers to the
unauthorized interception of
34 network traffic for the Exposure Fraud Espionage Hijacking Espionage
purpose of gaining
Information intentionally
An system can help to

identify anomalous behaviour Password
35 Intrusion Prevention Intrusion Detection Data Storage Intrusion Detection
on the network that may authentication
indicate unauthorized access.
A person who illegally gains

access to Information they
36 Hijacking Fraud Damage Phishing Fraud
are not authorized to access
commits .
refers to the
exploitation of a valid
computer session to gain
37 Fraud Data leakage Hijacking Phishing Hijacking
unauthorized access to
Information or service in a
computer system.
is an attempt to trick
38 a victim into disclosing Fraud Data leakage Phishing Hijacking Phishing
personal information.
risks affect validity of

Information and the
39 Authentication Integrity Confidentiality Availability Integrity
assurance that the
information is correct.
occurs either when a user

intentionally makes changes
to data but makes the Accidental Accidental
40 Data leakage Fraud Denial-of-service
changes to the wrong dat or modification modification
when a user inputs data
incorrectly.
ie a characteristic of a
system, which aims to ensure
41 Integrity Confidentiality High availability Authenticity High availability
an agreed level of operational
performance.
attack is an attempt to
make a computer resource
42 Brute force Man-in-the middle Denial-of-service Data leakage Denial-of-service
unavailable to its intended
users.
is any unexpected
downtime or unreachability of
43 Data leakage Outage Fraud Espionage Outage
a computer system or
network.
means when the

response time of a computer
44 Fraud Slowness Espionage Data leakage Slowness
or network is considered
unacceptably slow.
improves security
through control of the
45 Array Server Zoning Offsite data storage Zoning
connections between hosts
and the storage array
security allows you to

46 limit the number of database Password Storage Application Network Application
accounts.
backup consists of
47 making a complete copy of all Differential Full Transaction log Incremental Full
of the data in a database.
backup consists of
copying all of tje data that has
48 Differential Full Transaction log Incremental Differential
changed since the last full
backup.
is a protocol for
authenticating service
49 requests between trusted HTTP SSH Kerberos FTP Kerberos
hosts across an untrusted
network such as the internet.
The infrastructure used to

support certificates in an Public Key Public Key Private Key Public Key
50 Public Key Interface
organization is called as Infrastructure architecture Encryption Infrastructure
.
is a certificate-based
system that is used to provide
authentication of secure web Transport Layer
51 Secure Socket Layer Digital certificate Kerberos Secure Socket Layer
servers and clients and to Security
share encryption keys
between servers and clients.
security mechanism
used to authenticate and
provide access to a facility or
52 system based on the Tansport layer Password Biometric Secure Socket layer Biometric
automatic and instant
verification of an individual's
physical characteristics.
management is
security feature controlling
which resources a user can Role-based
53 User rights Data Storage Risk User rights
access and what actions a Authorization
user can perform on those
resources.
is a table that tells a

computer operating system
which access rights each user Role based
54 Access Control List Digital certificate Kerberos Access Control List
has to a particular system Authorization model
object such as a file directory
or individual file.
authorization requires
the development of rules that
55 Role-based Password-based Rule-based Certificate-based Rule-based
stipulate what a specific user
can do on a system.
is the mechanism an
array uses to present its
56 Serial Number Packet number Logical unit number certificate id Logical unit number
storage to a host operating
system.
In zoning the
accessibility of the host to the
57 Port World Wide Name Array Secure Socket layer Port
LUNs is defined by the switch
port.
In network-level security,
which is the first step to
58 Analyze Implement Modify Test Implement
protect your network from
the attack?
Which is not the layer of Cisco

59 Hierarchical Internetworking Core Control Distribution Access Control
model?
networks are stated as

60 the external or public Inside Outside Demilitarized zone Intranet Outside
networks.
zone is made up of one
or more isolated LAN
61 networks that contain shared Port World Wide Name Demilitarized Intranet Demilitarized
server resources such as
web,DNS and e-mail servers.
SIC Question Bank CORRECT
SR NO Unit 3 OPTION A OPTION B OPTION C OPTION D ANS.
Private Public Private Public
Switched Switched Switched Switched
Telephone Telephone Transmission Transport
1 PSTN stand for what ? Network Network Network Network B
The main layer of The Cisco

Hierarchical Internetworking
2 model. Distribution Core Access Performance B
Virtual Virtual Varient
terminal transfer terminal Virtual tapping
What is VTP ? protocol protocol protocol protocol
Virtual terminal
protocol supportswhich
3 layer? Application Physical Data link Presentation A
Controlling access to network

by analyzing incoming and
outgoingpackets is called as Packet Firewall
4 IP Filtering Data Filtering Filtering Filtering C
TCP/IP previously used by

5 which agency? DECNET bISO-NET DECNET ARPANET D
As the data packet moves from

the upperto the lower layers,
what happens to the headers ?
6 Rearranged Removed Added Modified C
Data Link Layer filters

whenworks as
7 firewall? Frame filter Packet filter Content filter Virus filter A
What types of
protocols are used inVPNs? Application level Tunnelling Network Mailing
8 protocols protocols protocols protocols B
Intranet is a tool for
sharing information throughout
what typeof organisation ? single organization multiple multilevel connected
9 organizations organization organizations A
Which Network mediatype that

10 is used ? internet token ring html extranet B
Network Topology is
which type of layoutand
connection of network
11 hardware? logical physical dependent connected B
In networking firewall ,
which systems are used for
controlling traffic movement
around the network? autogenerated
12 authorized authentication automatic B
Who provides an isolated

tunnel acrossa public network
for sending and receivingdata
privately as if thecomputing
devices were directly
connected to the private
network. Virtual Virtual Protocol
Visual Private Protocol Networking Virtual Private
14 Network Network Network D
State full firewall Bit oriented firewall Frame firewall Network layer
Which are the two sub andstateless and byte oriented andpacket firewall and session
categories of Network layer firewall firewall firewall layerfirewall
15 firewall ? A
Which of the following Packet Dual Homed
is / are the types offirewall? Filtering Gateway Screen Host Dual Host
16 Firewall Firewall Firewall Firewall A
A proxy firewall filters Data link Network Application
17 at which layer ? Physical layer layer layer layer D
Network
layer or
A packet filter firewallfilters at Data linklayer Transportlayer Applicationlayer
18 which layer ? Physical layer C
Firewalls are used to Home Corporate Public Both Home &
19 protect: Networks Networks networks Corporate D
Network
Network Address Address Network Access Network Access
What is the full form ofNAT ? Translation Transformation Translation Transformation
20 A
All memory units are
expressed as powersof ?
21 2 5 10 20 A
22 Firewall is a type of ? Virus Security Worm Trojan Horse B
How many types of
23 Firewalls are there ? 1 2 3 4C
Network layer firewall
works as a which typeof filter ?
24 Frame filter Packet filter Content filter Virus filter B
Which
server effectively hides the true
networkaddresses ? Application
25 proxy Packet filter Content filter Gateway A
The first reported typeof

network firewall , which inspect
packetstransferred between
computers ? Connection
26 packet filter Content filter tracking[edit] proxy A
Data travels on the
internet in small pieces;
these arecalled ?
27 metadata packets Protocols Virus filter B
Which firewalls do not
just look at the metadata; they
also look at the actual data
transported? Application-layer Stateful
28 Packet filtering packet Network Layer B
What WLAN device
provides communications
management servicesto
wireless workstations?
Network
29 Antenna adapter Repeater Access point D
DSSS system spreadsthe
baseband signal by performing
what to the baseband pulses
with a pseudo noise sequence.
30 Adding Subtracting Multiplying Dividing C

Frequency hopping
involves a periodic change of
transmission in which
features ?
31 Signal Frequency Phase Amplitude B
Which family of wireless LAN

protocols, collectivelyknown as
Wi-Fi and commonly found in
many organizations and
households?
32 802.11 803 801 804 A
What must be installed and

designedin such a way as to
encompass your premises’
territory andminimize outside
signal leakage as much as
possible?
33 LAN VPN ETHERNET WLAN D
As such, Bluetooth is very

resistant to whichinterference
unless the interfering signal
covers the whole middle ISM
band?
34 microwave radio infrared media B
Wireless Wired Wireless
Ethernet Ethernet Ethernet Wired Ethernet
Compatibility Compatibility Collision Collision Alliance
35 Full form of WECA is ? Alliance Alliance Allocation A
Which range of networks uses

36 DSSS? 802.11 802.15 803 both b & c A
Which way is correct
to control your wireless signal
spread Antenna transmittingpower
37 ? positioning Order sequence A
A radio transceiver
can only transmit or receive at
a given timeon a given
frequency, all
38 full duplex simplex half duplex complex C
To send a packet, thesource

should know the which of the Both IP address
following addresses ? and MAC Address
39 MAC Address IP address DNS D
The protocol used to
find the IP address when Mac
address isgiven is?
40 RARP ARP DNS IP B
Which connection lessprotocol

used in transport layer in OSI
reference model ?
41 TCP UDP IP RARP B
The dumb device used to

provide solution to connectivity
in network is which one ?
42 hub switch modem cables A

The device that
operates at layer 3 ofthe OSI
reference model is ?
43 hubs switch modem Routers D
Hyper text Border
Which of these is arouting Internet transfer Gateway User datagram
44 protocol ? protocol protocol protocol protocol C
Which of these are
the updates releasedby the
product vendorwhich should be
applied in a timely manner?
45 Patches Updates Instants Data A

Web interface
accessed by a browser can be
monitored by whom ? Secure Shell Diagnostic Network
46 Protocol Services SNMP Protocol C
Authorization
Accessing, Accounting , Authentication,
What does AAAstands Authorization, Amending, Accounting, Authorization,
47 for ? Accounting Authorization Accessing Accounting D
Which of these is the
component that determines if
an incoming connectionis
allowed? Authentication
48 Accounting Accessing Authorization C
Which one is an attempt to slip

throughthe external defenses
by masquerading as an internal
host ? Address
49 Sniffing spoofing Trojan horse Worms B
ICMP works in which
layer of the OSI reference Transportlayer
50 model Network layer Session layer Data link layer B
Correct
Sr. No Question Option 1 Option 2 Option 3 Option 4 Answer
are unauthorized activity with
malicious intent using specially crafted code or
1 techniques Attacks hacking virus pipping 1
can be classified as attacks or misuse,and

they can exploit network protocols or work as
2 malicious content at the application layer rule break protocols Threats roles 3
Defense of
3 What is DoS stands for Service Denial of service Duty of service delay of service 2
is the process of monitoring for intrusion Intrusion
4 and identifying specific malicious traffic traffic controller controller traffic detection detection (ID) 4
Simple Network simple net sample network

Management management management simple net
5 (SNMP) means Protocol protocol protocol manage protocol 1
maximum
minimum maximum media transformation
6 (MTU) stands for transmission unit transmission unit transmission unit unit 2
Although protocol attacks
abound, most security threats exploit the host’s transmission
7 application layer internet protocol hyper text network control 3
A comparison is done between
the payload and each potential threat signaturein the
8 IDS’s database bit - by - bit byte - by - bit bit - by - byte byte-by-byte 4
excel at catching known, Intrusion intrusion
9 definitive malicious attacks detection (ID) traffic controller controller traffic detection 1
There are types of generation Intrusion
10 detection (ID) 2 3 4 5 1
IDSs focused almost exclusively on
the benefit of early warning resulting fromaccurate Second- Fourth-
11 detection. First-generation generation Third-generation generation 1
A is installed on the host it host-based IDS
12 is intended to monitor Home based Ids (HIDS) Hetero based Ids Homo based Ids 2
13 (HIDS) stands for Home based Ids Hetero based Ids Host-based IDS Homo based Ids 3
A file-integrity HIDS also sometimes called as
14 protocol router firewall snapshot 4
- are the most popular IDSs, and NetProtocol-
they work by capturing and analyzing networkpackets Network-based Net-based IDSs based IDSs Network-by
15 speeding by on the wire IDSs (NIDSs) (NIDSs) (NIDSs) IDSs (NIDSs) 1
NetProtocol-
Net-based IDSs Network-based based IDSs Network-by
16 (NIDSs) stands for - (NIDSs) IDSs (NIDSs) IDSs (NIDSs) 2
For a NIDS to sniff packets, the packets have to
be given to the -level driver by the
17 network interface card page segment packet sequence 3
A segment can be defined as a
18 single logical packet domain session data transport network 4
was proposed in 1985 by noted

security laureate Dr. Dorothy E. Denning, and itworks Module modern memory
by establishing accepted baselines and noting Anomaly Model Anomaly anamoly anomaly
19 exceptional differences detection detection detection detection 2
Module modern memory
Anomaly anamoly Model Anomaly anomaly
20 Model AD stands for detection detection detection (AD) detection 3
are the most popular typeof Signature-

IDS, and they work by using databases of known detection or protocol
21 bad behaviors and patterns. misuse IDSs login detection detection id detection 1
-generation IDSs are being called
22 intrusion-prevention systems (IPSs). First Second Third Fourth 2
IPSs are proactive, and a false positive means a
legitimate service or is being
23 denied guest session host network 3
Central to the field are the definitions of
24 management console and agent guest session host IDS 4
Many systems are server-based
and rely on common operating systems (mainly
Windows and Linux) to run their hardware interface
25 pop VoIP smtp snmp 2
The element (the “brains” of the
operation) of a VoIP system can be either a purposed
appliance, a piece of software thatruns on a common
or specialized server operating system communication
26 host control network control call control control 3
access application
communication application communication access control
27 (ACLs) stands for list control list list lists 4
session - level application-level network - level transport level
28 (ALG) stands for gateway gateway gateway gateway 2
are configured to use dial peers
(defined as “addressable endpoints”) to
29 originate and receive calls. routers switches Gateways modems 3
multiple multi-
multi- conference communication multiple communication
30 (MCU) stands for unit unit conference unit unit 1
compromises today are
frequently targeted at mobile devices, and muchof the
attention in the industry right now is focused on how to
secure the mobile environment.
31 First point Endpoint Middle point symbol point 2
have made a remarkable
evolutionary leap, from initially being used as aplace to
take orders and field complaints, to being a strategic
asset that most enterprises cannot survive without
32 Call centers service center hub company 1
on exploits of various
systems is so readily available, that takingadvantage of
open relays is a common recreational and for-profit
33 activity. data knowledge Information expertism 3
system has to create a risk profile for Assessment
34 low-tech hacks in an organization . Audit network audit control audit pay-off 1
protected
A is a computer-based switch thatcan public branch branch Private Branch People Branch
35 be thought of as a local phone company. exchange exchange Exchange Exchange 3
protected
Private Branch branch public branch People Branch
36 (PBX) stands for Exchange exchange exchange Exchange 1
Transport Telecom
Traffic expense expense Tata Expense Expense
37 TEM stands for management management management Management 4
trustable trusted tranmission telecom
38 TCB stands for computing base computing base computing base computing base 2
Security commences at the level
and maps all the way up to the operations of the hyper text post office
39 operating system internet protocol protocol network protocol protocol 3
is the term for establishing a
40 connection with a forged sender address spoofing threat hacking bluffing 1
discretionary
directory access defend access access control data access
41 (DACLs) stands for control lists control lists lists contol lists 3
is always prohibitive (i.e., all that
is not expressly permitted is forbidden) and not
42 permissive. HTTP MAC FTP SMTP 2
requires that access control
policy decisions be beyond the control of theindividual Mandatory Memory access matadata data access
43 owners of an objec access control control access control contol lists 1
is often known as a reversed
version of Bell-LaPadula, as it focuses onintegrity
44 labels TCB TCSEC Biba Sun sparc 3
- attempts to define a security model
based on accepted business practices for
45 transaction processing Clark-jhonson Clark-Bohem Clark-william Clark-Wilson 4
TCSEC makes heavy use of the concept of
46 . caption label symbol protocol 2
The Windows is responsible for Security

validating Windows process access permissions Reference Referential
47 against the security descriptor for a given object. Monitor manager control panel task manager 1
Security Security
Security Role reference Reference Security Role
48 (SRM) stands for Manager manager Monitor monitor 3
A defines a standard set
of security requirements for a specific type ofproduct
(for example, operating systems, databases, or
49 firewalls). public profile private profile people profile protection profile 4
Enhanced evaluation enquiry expert assurancce

50 (EALs) stand for assurance levels assurance levels assurance level level 2
is a compute resource that
uses software instead of aphysical computer to Virtual Operating commercial
1 router Virtual Machine
run programs anddeploy apps. Machine system softwares
is computer software,
2 firmware or hardware thatcreates and runs Vmware Hypervisor Hyper V Microsoft Hypervisor
virtual machines
A hypervisor, also known as a

3 VCM VMM VMC VVM VMM
Network Network Network Network

Net Address
4 What is NAT? Address Address Addition Address
Translation
Transcoder Translation Translation Translation
When you add a software stack, such as

an operating system andapplications to
5 Saas PaaS laaS Saas and PaaS Saas
the service, the model shifts to model.
Which of the following is most refined and

6 restrictive service model laaS Saas PaaS Saas and PaaS PaaS
?
Software asa Software as a Security as a Service as a Software as a

7 What is SaaS?
Service Security Service Security Service
8 Which is not in the Cloud Services? Saas PaaS laaS HaaS HaaS
Which of these companies is not aleader
9 Google Catalina Amazon Microsoft Catalina
in Cloud computing?
Which is not the feature of Cloud

10 High Cost Reliability Security Reduced Cost High Cost
Computing?
is the on- demand

Security In Cloud Cloud
11 availability of computer system VMM Availability
Computing computing computing
resources.
There are main servicemodels

12 two three four five three
of cloud computing.
offers the fundamental

13 infrastructure of virtualservers. laaS PaaS Saas HaaS laaS
Web applications can be created quickly and Platform as a Infrastructureas Software as a Hardware as a Platform as a
14
easily via Service Service Service Service Service
This cloud computing solution subscriptionor a

subscription or a
15 involves the deployment of softwareover the pay-per-use pay-per-use pay-per- use
internet to various businesses who pay via subscription model paytm
model model
is done by malicious
attackers through the useof free Wi-Fi Hotspot
16 Trojan Horse Wi-Fi hijacking DoS Wi-Fi hijacking
hotspots set up in public places . hijacking
A device is classifiedas any
device that uses distinctive personally
17 Biometric VMM Router Guards Biometric
identifiable characteristics.
is the
process of identifying physical assets and
Classificationof Classification of Classificationof Classificationof
18 assigning criticality andvalue to them in Classification
platforms services assets assets
order to develop concise controls and
procedures
A area A area
designed to allow A mechanismfor designed to allow
It is trusted
A device for fire only one logical accessing only one
security
19 What is a mantrap? suppression authorized control. authorized
domain
individual individual
Which of the following is the best choice in When When When the When
When access
choosing security guard fora physical access intrusion discriminating allotted security discriminating
20 controls are in
control mechanism? detection is judgment is budget is low judgment is
place
needed required required
When choosing a location for a datacenter

21 or office survivability cost buget risk survivability
site what is most important?
of the site is typically the

22 first consideration, andwith good reason. Cost Accessibility Location Buget Accessibility
can take your entire

network and communicationsinfrastructure Construction and construction Construction and
23 Construction excavation
down with one fell swoop of a backhoe’s excavation activities excavation
bucket.
Closed-
Clear -circuit Clean -circuit Clone -circuit Closed-circuit
24 what is CCTV? circuit
television television television television
television
Multi device
25 Which is not characteristic of SaaS? Web Access one to many offline access offline access
support
Locks and Entry Controls are Securing security security Securing

26 Securing guards
Assets devices control guard Assets
These are very It generatesmany It doesn’t detect it does not It generatesmany

What is the major drawback ofanomaly
27 slow at false alarms novelattacks generate any false alarms
detection IDS?
detection alarms
It models the
Most are It is Anything Most are
normal usage of
28 based onsimple programmed to distinct from the based on simple
What are the characteristics ofsignature network as a
pattern interpret a certain noise is assumed patternmatching
based IDS? noise
matching series of packets to beintrusion algorithms
characterizatio
What is the number one concernabout Too Too many Security Security
29 Accessability
cloud computing? expensive platforms concerns concerns
is the on- demand

delivery of IT resources over the Internet with Cloud Cloud
30 laaS PaaS Saas
pay-as-you-gopricing. computing computing
T.Y.B.Sc. IT SEM VI SIC MCQ-Unit-1
Q 1. Switches and Firewall come under the category of _______________ assets
A. Technical equipment
B. Computer Equipment
C. Communication Equipment
D. security Equipment
Ans. C
Q 2. Racks and NEMA-rated enclosures come under the category of _______________ assets
B. Furniture and Fixtures
C. Communication equipment
D. Storage equipment
Ans. B
Q 3. One of the following comes under the category of Technical equipment
A. Air-conditioners
B. Servers
C. Fax machine
D. Credit-cards
Ans. A
Q 4. One of the following does not comes under Physical Vulnerability assessment
A. Buildings
B. Computing devices and peripherals
C. Documents and Records
D. Security Guard
Ans. D
Q 5. Threats to Employee safety and break-inns are due to
A. Poor lighting
B. No security guard
C. Remotely located offices
D. High crime areas
Ans. A
Q 6. Power outages can cause irreparable damages to
A. Remote offices running PCs
B. Servers
C. Data centres
D. CCTV
Ans. C
Q 7. _______________ is an area designed to allow only one authorized person to enter in
A. Mantrap
B. Human trap
C. One pass
D. Secure Pass
Ans. A
For Queries / Assistance / Sharing document on Campus Orbit - email us at

campus.connect59@gmail.com or www.campusorbit.com
Q 8. Antitailgating mechanism is used to prevent _________________ person from closely following
an authorized person through an open door
A. All Authorized
B. Unauthorized
C. Both Authorized and Unauthorized
D. Few Authorized
Ans. B
Q 9. ______________ is used to confirm the identification of an individual through fingerprint, voice,
face, retina, iris etc.
A. Passwords
B. Signature verification
C. PCMC Card
D. Biometric device
Ans. D
Q 10. Forcible entry or intrusion into the premises of an organization can be prevented by using
A. Security Guards
B. CCTV Cameras
C. Infra-red sensors
D. RF devices
Ans. A
Q 11. For Intrusion detection ___________ is/are used
A. CCTV cameras
B. Alarms
C. Both a and b
D. Radio Frequency Sensor
Ans. C
Q 12. _________________ standard is concerned with the Physical Security of Computer resources
A. ISO 45002
B. ISO 37002
C. ISO 1700
D. ISO 27002
Ans. D
Q 13. The COBIT is an Acronym for
A. Control Operation for Information and Related Terminologies
B. Computer Organization and Information Related Technologies
C. Computer Operation for Information and Related Terminologies
D. Control Objectives for Information and Related Technologies
Ans. C
Q 14. One of the following is not a criteria for selecting site location for Security
A. Construction and excavation
B. RF and wireless transmission interception
C. Lighting
D. Markets and Malls
Ans. D

Q 15. One of the following does not comes under the duty of Security Guards
A. Prevention of forcible intrusion
B. Prevention of Theft
C. Repairing of faulty CCTV
D. Prevention of Abuse and Arson
Ans. C
Q 16. ______________ is a Computer Equipment Asset
A. Cash
B. CCTV Cameras
C. Network Attached Storage
D. Furniture
Ans. C
Q 17. Storage Area Network is an ______ asset
Ans. B
Q 18. Firewall is an ___________ asset
Ans. C
Q 19. One of the following comes under the category of Assets with direct monetary value
A. Credit card
B. Laptop
C. Server
D. Furniture
Ans. A
Q 20. Power supply is an ______________ asset
Ans. A
Q 21. PBXs machines are ___________ asset
A. direct monetary value
B. Communication Equipment
C. Technical equipment
Ans. B

Q 22. One of the following is a Technical asset
A. Cash
B. Furniture
C. Power supplies
D. server
Ans. C
Q 23. Fax machine is an ____________ asset
Ans. B
Q 24. Modems are classified in the same category as
A. Cash
B. Laptop
C. Fax machine
D. Furniture
Ans. C
Q 25. Bonds are an ___________ asset
B. security Equipment
C. direct monetary value
D. Communication Equipment
Ans. C
Q 26. A company buys shares from market, then it is __________ asset
Ans. A
Q 27. One of the following is not a Technical Equipment asset
A. Power supply
B. UPS
C. Generators
D. Laptop
Ans. D
Q 28. Cell phones are ________ asset
B. security Equipment
C. direct monetary value
D. Communication Equipment
Ans. C

Q 29. Almost all the storage media are _________ asset
Ans. D
Q 30. Which of the following is a critical asset?
A. Data Centre
B. CCTV Cameras
C. Alarm
D. Furniture
Ans. A

Q 1. Mirrored windows or windows with highly reflective coatings should face ____________ to avoid
casting sun glare into trafficked areas
A. East-West
B. north-south
C. West
D. South
Ans. B
Q 2. Lighting should be positioned in such a way that it ________ blinds those leaving the building at
night
A. Never
B. Always
C. Sometimes
D. At first
Ans. A
Q 3. Sharing the building with _________ brings high security risks
A. Police Department
B. Fire Department
C. Hospitals
D. Casinos
Ans. D
Q 4. Having offices in proximity of __________ can be beneficial
A. Emergency Services
B. Malls
C. Gardens
D. Playgrounds
Ans. A
Q 5. The most commonly implemented biometrics devices are
A. Retina Scanner
B. Iris Scanner
C. Fingerprint Scanner
D. Voice Identification
Ans. C
Q 6. One of the following is not a Biometric technique for Authentication in the Field of IT
A. Face recognition
B. Voice identification
C. DNA
D. Fingerprint identification
Ans. C
Q 7. The least preferred areas for placing CCTV cameras is
A. Parking Areas
B. research areas
C. cash handling areas
D. Canteens
Ans. D

Q 8. RF transmission is not concerned with ___________ transmission
A. WIFI
B. Bluetooth
C. Cordless
D. Fibre optic
Ans. D
Q 9. physical security vulnerability assessment is not concern with
A. tablets
B. MP3 players
C. Security guards
D. jewellery
Ans. C
Q 10. SSDL is acronym for
A. Secure Software Delivering Lifecycle
B. Secure Software Dividing Lifecycle
C. Secure Software development lifecycle
D. Security Software development lifecycle
Ans. C
Q 11. One of the following is not a part of SSD lifecycle
A. Application
B. Employee
C. Project
D. system
Ans. D
Q 12. The last stage of the Project lifecycle is
A. vendors are paid
B. results are accepted
C. contracts are negotiated
D. contracts are signed
Ans. A
Q 13. What is the initial state of Application?
A. idea
B. design
C. testing
D. implementing
Ans. A
Q 14. one of the following is not a part of Application life cycle
A. design
B. idea
C. testing
D. Hiring
Ans. D

Q 15. The three primary elements of SDL are
A. New Security feature
B. Cost estimation of system
C. Making decisions affecting the current system
D. Adding Some feature to already implemented system
Ans. B
Q 16. security training program for development teams includes technical security awareness training
for ___________
A. Individuals
B. CEOs
C. Everyone
D. Managers
Ans. C
Q 17. A ___________ program must be conducted for development teams which includes technical
security awareness training and role-specific training.
A. Security training
B. Security coding
C. Security Testing
D. Documentation
Ans. A
Q 18. Security __________ is performed to find security issues by running application code.
A. Documentation
B. Monitoring
C. Testing
D. Modelling
Ans. C
Q 19. __________ is a technique for reviewing the security properties of a design and identifying
potential issues and fixes.
A. Threat Modelling
B. Code Review
C. Cookies
D. SQL injection attack
Ans. A
Q 20. ___________ Scripts are used for performing validations like limiting the size of the input fields,
disallow certain characters.
A. Server side
B. Client side
C. SQL query
D. Application
Ans. B

Q 21. Limiting the number of connections per second per IP address and use of strong passwords can
prevent ___________ attack.
A. Brute-force
B. SQL injection
C. Buffer overflow
D. Cookies
Ans. A
Q 22. Application security is mainly controlled by the ____________ of the application, as he/she
requires extensive knowledge about various areas like GUI, network connectivity, OS interaction
and sensitive data management for writing secure programs.
A. Server
B. Developer
C. Client
D. Company
Ans. B
Q 23. ___________ is common method of verifying that the person on the other end is a human being
by showing a distorted image of letters and numbers and requiring the user to type them in
correctly.
A. OTP
B. password
C. CAPTCHA
D. graphics
Ans. C
Q 24. Web interface has _________ quick development time than GUI.
A. slow
B. fast
C. medium
D. regular
Ans. B
Q 25. ___________ Attacks are those that do not come under any specific category but still they are
considered as risk to website security.
A. General
B. cookies
C. forms
D. scripts
Ans. A
Q 26. _________________ is a technique to inject crafted SQL into user input fields that are the part of
the web forms.
A. SQL injection
B. brute-force
C. buffer overflow
D. cookies
Ans. A

Q 27. __________________________ is a technique to find security issues by inspecting application
code, using static analysis tools or manual code review or a combination.
A. secure design
B. Security code review
C. Testing
D. Documentation
Ans. B
Q 28. Keeping applications up to date with the latest security ____________ is one of the most
important security measures.
A. patches
B. forms
C. OS
D. Release
Ans. A
Q 29. One of the following is a disadvantage of custom web administration.
A. Availability
B. encryption
C. specific OS
D. complex graphics
Ans. C
Q 30. Customized client GUIs can be used to display ________________ that cannot be shown using a
regular web administration interface.
A. footer
B. header
C. image
D. Complex graphics
Ans. D

Q 1. A web interface can be accessed from any ________ location through internet.
A. Remote
B. low
C. high
D. source
Ans. A
Q 2. Forms are used to
A. Secure connection
B. Send information
C. provide protocols
D. hijack sessions
Ans. B
Q 3. JavaScript is _________ side scripting
A. Server
B. Client side
C. SQL query
D. Application
Ans. B
Q 4. VBScript is _________ site scripting
A. Server
B. Client side
C. SQL query
D. Application
Ans. B
Q 5. The _______ command doesn’t reveal the data in the URL
A. Hide
B. Post
C. Gets
D. Pre Hide
Ans. B
Q 6. GUID is an Acronym for
A. general unique identifier
B. globally unique integer
C. get unique identifier
D. globally unique identifier
Ans. D
Q 7. When the same key is used to encrypt and decrypt the data, the technique is called
A. symmetric cryptography
B. Asymmetric cryptography
C. asymptotic cryptography
D. Steganography
Ans. A

Q 8. NAT is an acronym for
A. National Address Translation
B. Network Address of Traffic
C. Network address translation
D. No address translation
Ans. C
Q 9. The ____________security program must include the right level of responsibility and
authorization to be effective.
A. Authority
B. Framework
C. Planning
D. Gap Analysis
Ans. A
Q 10. ________________for the use of software, computer systems, and networks should be clearly
documented for the sake of the people who use these technologies
A. Rules
B. Guidelines
C. Program
D. Network
Ans. B
Q 11. A _________________ is a plan of action for how to implement the security remediation plans.
A. Planning
B. Road
C. Roadmap
D. Gap Analysis
Ans. C
Q 12. ______________is concerned with protecting information in all its forms, whether written,
spoken, electronic, graphical, or using other methods of communication.
A. Information security
B. Network Security
C. Computer Security
D. Graphics Security
Ans. A
Q 13. ___________is an important asset.
A. Information
B. Algorithm
C. Program
D. CCTV
Ans. A
Q 14. FUD stands for ___________
A. fear, understanding, defence
B. fear, uncertainty, and doubt
C. fact, uncertainty, defence
D. fact, understanding, defence
Ans. B
Q 15. Which is not a part of Building a Security Program
A. Authority
B. Framework
C. Planning
D. Defence
Ans. D
Q 16. You can never be _____________ percentage secure about security.
A. 10
B. 25
C. 50
D. 100
Ans. D
Q 17. A ______________ compares the desired state of the security program with the actual current
state and identifies the differences.
A. risk analysis
B. Remediation planning
C. gap analysis
D. Planning
Ans. C
Q 18. one of the following is not three Ds of security
A. defence
B. deterrent
C. detect
D. delete
Ans. D
Q 19. A universal truth of security, regardless of the application, is that the job of the attacker is always
___________ than the job of the defender.
A. Difficult
B. Very Difficult
C. Easy
D. Extremely Difficulty
Ans. C
Q 20. ______________is concerned with protecting information in all its forms, whether written,
spoken, electronic, graphical, or using other methods of communication.
A. Information security
B. Network Security
C. Computer Security
D. Graphics Security
Ans. A
Q 21. The basic assumptions of security are as follows
A. We want to protect our assets.
B. There are threats to our assets.
C. We want to mitigate those threats.
D. All of the above
Ans. D

Q 22. ___________ ensures that the data is not changed
A. Confidentiality
B. Integrity
C. Authenticity
D. Availability
Ans. B
Q 23. ___________ ensures that the data is received only by the intended receiver
A. Confidentiality
B. Integrity
C. Authenticity
D. Availability
Ans. A
Q 24. ____________ ensures that the resources are safe
A. Confidentiality
B. Integrity
C. Authenticity
D. Availability
Ans. D
Q 25. _______________ produces priorities and timelines for security initiatives.
A. assessment
B. planning
C. action
D. planning
Ans. B
Q 26. The __________ of the security team produce the desired results based on the plans.
A. assessment
B. planning
C. action
D. planning
Ans. C
Q 27. A security ________ provides a defensible approach to building the program.
A. assessment
B. planning
C. action
D. framework
Ans. D
Q 28. _______________ is a source for the threat theft and the target is intellectual property
A. employee
B. contractor
C. consultant
D. vendor
Ans. A

Q 29. _______________ is a source for the threat loss and the target is trade secret intellectual
property
A. employee
B. contractor
C. consultant
D. vendor
Ans. B
Q 30. _______________ is a source for the Exposure loss and the target is Personally identifiable
information
A. employee
B. contractor
C. consultant
D. vendor
Ans. C

Q 1. The ____________ security control Block security threats before they can exploit a vulnerability
A. Preventative
B. Detective
C. Deterrent
D. Corrective
Ans. A
Q 2. The ____________ security control Discover and provide notification of attacks or misuse when
they happen
A. Preventative
B. Detective
C. Deterrent
D. Corrective
Ans. B
Q 3. The ____________ security control Discourage outsider attacks and insider policy violations
A. Preventative
B. Detective
C. Deterrent
D. Corrective
Ans. C
Q 4. The ____________ security control Restore the integrity of data or another asset
A. Preventative
B. Detective
C. Deterrent
D. Corrective
Ans. D
Q 5. The ____________ security control Restore the integrity of data or another asset
A. Recovery
B. Detective
C. Deterrent
D. Compensative
Ans. A
Q 6. The ____________ security control In a layered security strategy, provide protection even when
another control fails
A. Recovery
B. Detective
C. Deterrent
D. Compensative
Ans. D
Q 7. ________ that are physically present in the “real world”
A. Physical Controls
B. Administrative Controls
C. Logical Technology
D. Operational Controls
Ans. A

Q 8. ______________ defined and enforced by management
Ans. B
Q 9. ____________ performed by machines
Ans. C
Q 10. _______________that are performed in person by people
Ans. D
Q 11. __________ that are triggered dynamically when certain circumstances arise
A. Virtual
Ans. A
Q 12. A firewall is installed at the point where the secure internal network and untrusted external
network meet which is also known as __________
A. Chock point
B. Meeting point
C. Firewall point
D. Secure point
Ans. A
Q 13. Network layer firewall has two sub-categories as _________
A. State full firewall and stateless firewall
B. Bit oriented firewall and byte oriented firewall
C. Frame firewall and packet firewall
D. Network layer firewall and session layer firewall
Ans. B
Q 14. Which of the following is / are the types of firewall?
A. Packet Filtering Firewall
B. Dual Homed Gateway Firewall
C. Screen Host Firewall
D. Dual Host Firewall
Ans. C

Q 15. A proxy firewall filters at _________
A. Physical layer
B. Data link layer
C. Network layer
D. Application layer
Ans. D
Q 16. A packet filter firewall filters at __________
A. Physical layer
B. Data link layer
C. Network layer or Transport layer
D. Application layer
Ans. B
Q 17. A firewall needs to be __________ so that it can grow proportionally with the network that it
protects.
A. Robust
B. Expansive
C. Fast
D. Scalable
Ans. B
Q 18. A firewall is a ______security system:
A. Network
B. File
C. Program
D. None of These
Ans. A
Q 19. A firewall is a network security system ______based that controls incoming and outgoing
network traffic based on a set of rules:
A. Hardware
B. Software
C. Both hardware or software
D. None of These
Ans. C
Q 20. Firewalls are used to protect:
A. Home Networks
B. Corporate Networks
C. Both of Above
D. None of These
Ans. C
Q 21. If you have more than one computer connected in the home, it is important to protect every
computer. You should have a ____firewall (such as a router) to protect your network:
A. Hardware
B. Software
C. HTML
D. None of These
Ans. A
Q 22. Firewalls are often categorized as:
A. Network Firewalls
B. Host Based Firewalls
C. Either Network firewalls or Host based firewalls
D. None of These
Ans. C
Q 23. __________ Firewalls do not just look at the metadata; they also look at the actual data
transported.
A. Packet filtering
B. Application-layer
C. Stateful packet
D. Network Layer
Ans. B
Q 24. All memory units are expressed as powers of?
A. 2
B. 5
C. 10
D. 20
Ans. A
Q 25. Firewall is a type of
A. Virus
B. Security
C. Worm
D. None of These
Ans. B
Q 26. Firewalls can be of _______ kinds.
A. 1
B. 2
C. 3
D. 4
Ans. 3
Q 27. Network layer firewall works as a __________
A. Frame filter
B. Packet filter
C. Content filter
D. Virus filter
Ans. B
Q 28. _____________server effectively hides the true network addresses.
A. proxy
B. Packet filter
C. Content filter
D. Application Gateway
Ans. A

Q 29. The first reported type of network firewall is called a _______, which inspect packets transferred
between computers.
A. packet filter
B. Content filter
C. Connection tracking[edit]
D. proxy
Ans. A
Q 30. Data travels on the internet in small pieces; these are called __________
A. metadata
B. packets
C. Protocols
D. Virus filter
Ans. B

Q 1. __________ Firewalls do not just look at the metadata; they also look at the actual data
transported.
A. Packet filtering
B. Application-layer
C. Stateful packet
D. Network Layer
Ans. B
Q 2. The process of transforming plain text into unreadable text.
A. Decryption
B. Encryption
C. Network Security
D. Information Hiding
Ans. B
Q 3. A process of making the encrypted text readable again.
A. Decryption
B. Encryption
C. Network Security
D. Information Hiding
Ans. A
Q 4. A system for encryption and decryption is called as___________
A. Cryptosystem
B. Encryption
C. Decryption
D. Security System
Ans. A
Q 5. What is the minimum number of cryptographic keys required for secure two-way communications
in symmetric key cryptography?
A. 1
B. 2
C. 3
D. 4
Ans. A
Q 6. In _______Claude E. Shannon publishes an article called “A mathematical theory"
A. 1935
B. 1945
C. 1955
D. 1965
Ans. B
Q 7. In ________ U.S adopted a block cipher design as national standard- Data Encryption Standard.
A. 1963
B. 1973
C. 1983
D. 1993
Ans. B

Q 8. In _______, DES is replaced by the AES.
A. 1997
B. 1998
C. 1999
D. 2000
Ans. D
Q 9. Symmetric key cryptography uses the _______ key for encryption and decryption.
A. Same
B. Different
C. Fixed
D. Variable
Ans. A
Q 10. Which one of the following is a cryptographic goal that cannot be achieved by a secret key
cryptosystem?
A. Nonrepudiation
B. Confidentiality
C. Availability
D. Integrity
Ans. A
Q 11. Which one of the following cipher types operates on large pieces of a message rather than
individual characters or bits of a message?
A. Stream cipher
B. Caesar cipher
C. Block cipher
D. ROT3 cipher
Ans. C
Q 12. In which year Giovan Bellaso envisions the first cipher to use a proper encryption key?
A. 1834
B. 1553
C. 1854
D. 1556
Ans. B
Q 13. Who invented the Play fair Cipher, which encrypts pairs of letters instead of single ones?
A. Edward Hebern
B. Poland
C. Charles Wheatstone
D. IBM
Ans. C
Q 14. What is the name of the group that IBM has formed in 1970's to design a block cipher to protect
customer data?
A. Crypto Group
B. Stream Cipher Group
C. Block Cipher Group
D. Cipher Suites Group
Ans. A

Q 15. Scrambling the data according to a secret key is known as?
A. Caesar Cipher
B. Decryption
C. Code cracking
D. Encryption
Ans. D
Q 16. In encryption, the order of the letters in a message is rearranged by __________
A. substitution ciphers
B. quadratic ciphers
C. transposition ciphers
D. both transposition ciphers and substitution ciphers
Ans. C
Q 17. What is the minimum number of keys required for secure two-way communications in
symmetric key cryptography?
A. One
B. Two
C. Three
D. Four
Ans. A
Q 18. In asymmetric key cryptography, the private key is kept by __________
A. sender
B. receiver
C. sender and receiver
D. all the connected devices to the network
Ans. B
Q 19. What is cipher?
A. both algorithm for performing encryption and decryption and encrypted message
B. encrypted message
C. decrypted message
D. algorithm for performing encryption and decryption
Ans. D
Q 20. Which one of the following cipher types operates on large pieces of a message rather than
individual characters or bits of a message?
A. Stream cipher
B. Caesar cipher
C. Block cipher
D. ROT3 cipher
Ans. C
Q 21. The _________________ is the original message before transformation.
A. cipher text
B. plaintext
C. secret text
D. simple text
Ans. B

Q 22. DES stands for?
A. Data Encryption Standard
B. Data Encryption Statistics
C. Data Encryption System
D. Data Encryption Sequence
Ans. A
Q 23. What is Authentication
A. Encryption
B. Proof of Identity
C. Access
D. Modification
Ans. B
Q 24. A Strong password is
A. ismail
B. Ismail
C. i$mail1324
D. i$@maila1234
Ans. D
Q 25. Following method uses tickets for authentication
A. Kerberos
B. Token
C. passwords
D. username
Ans. A


Security in Computing Questions

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security in Computing Questions

Uploaded by

Copyright:

Available Formats

Security in Computing Questions:

1. Full form of FUD?

2. Define 3d’s in security and full form?

3. Write steps to build a security program?

4. What are the components of authority and Assessment in security program?

6. What is the different medium chosen by the attacker to confidentiality information?

7. Difference between strategy and tactic

8. Define threat and common computer threat?

9. Enlist threat vectors

13. Define Trojan and what action Trojan take place

14. Define RAT(Remote Access Trojan)?

16. APT (Advance Persistent Threats) & its diagram?

17. How many steps APT has?

18. Enlist different types of attack

19. Define ARP and its diagram?

20. Define sniffing and spoofing?

21. What does MAC Flood?

22. Define DoS?

23. Define SQL injection Attack?

24. Define Risk?

25. Security is never 100 % Sure.

27. TYPES of Risk.

28. How the risk values represented?

29. Formula for ALE?

30. Full form SLE, ALE, ARO.

31. CIA Triad Security Model with diagram

32. How many defense model are there

33. Draw Lollipop & Onion Model

35. Best Practices for network defense model

36. Enlist Harden the Operating System

37. Define antivirus?

38. Types of share permission

39. Define RBAC

40. Roles of RBAC (Role-Based Access Control)

41. Define ACL (Access Control List)

43. ISO Provisions

47. Difference between Symmetric & Asymmetric Key

48. Stream Shifter Process 1 bit at a time.

50. Recipient use Recipient Private key in PKC.

51. Sender use Recipient’s Public key in PKC.

52. PKI consist of

53. Benefits of PKI

54. Enlist storage security evolution line wise

55. Enlist what consist of fundamental storage infrastructure?

56. Define OLTP

57. Write four steps in Network-level security

58. Define Authentication

60. How many types of Authentication are there?

61. OTP is also called as?

63. Sequential keys

65. SSL/ TLS (Secured Socket Layer / Transport Layer Security)

66. Smart Card

67. Define Biometric

69. Enlist Object Level Security

70. Define Backup. List down its Types.

71. Flow of Keeping Server Up to Date

72. Database Security Layers

73. Database Level Security

78. Types of Routers : 1. Static Router 2. Dynamic Router

79. Routing Protocols are classified by :

81. Autonomous System (AS) is also known as a Routing Doamin.

87. H.248 is also called as Megaco