CyberSecurity Review

A company develops a mobile app designed for parents to monitor what their children are doing. The parents install the app on the phone, and it can record details like who the child is conversing with and what apps they're using. It can also record and store the geolocation of the child.

Which of these questions from parents could not be answered by the recorded geolocation data?

• Did my child hang out in the park in a group of more than 20 people?

• Did my child travel to another city today?

• Did my child break their curfew by staying outside of the home past 9pm?

• Did my child spend more than an hour outside of the school campus in the middle of the day?

BBC News wrote an article with this headline:

"HP laptops found to have hidden keylogger"

After reading that headline, what should HP laptop owners be most concerned about?

• The keylogger could be recording what they type and sending the logs to a server.

• The keylogger could be overwriting their files with random generated text.

• The keylogger could be sending emails to all of their contacts with malware attached.

• The keylogger could be using up their computing power to mine for cryptocurrency.

Tags

CCSS.RI.11-12.10

CCSS.RI.6.10

CCSS.RI.7.10

CCSS.RI.8.10

CCSS.RI.9-10.10

An investigative journalist connects to the Internet over a wired Ethernet connection in a government building. They don't want anyone else to see which websites they're visiting.

Which entities might be able to see the websites visited in that browsing session?

- I. A rogue access point

- II. The building's Internet Service Provider (ISP)

- III. Their computer's web browser

• I and II only

• II and III only

• I and III only

• I, II, and III

Which of the following best describes symmetric encryption?

• An encryption scheme where the sender and receiver use the same shared key for encrypting and decrypting data.

• An encryption scheme where the sender and receiver each have their own key for encrypting and decrypting data.

• An encryption scheme where the sender encrypts data with the receiver's public key and the receiver decrypts the data with their own private key.

• An encryption scheme where the sender encrypts data with the sender's public key and the receiver decrypts the data with the sender's private key.

Aliza visited a website over HTTPS and saw a lock icon in the URL bar, indicating a secure connection with a valid digital certificate.

Which of these statements describes the trust model in this scenario?

• The browswer trusts Aliza, Aliza trusts the certificate authority, and the certificate authority trusts the website.

• Aliza trusts the certificate authority, the certificate authority trusts the browser, and the browser trusts the website.

• The certificate authority trusts Aliza, Aliza trusts the browser, and the browser trusts the website.

• Aliza trusts the browser, the browser trusts the certificate authority, and the certificate authority trusts the website.

Which statement is true about multi-factor authentication?

• MFA requires the user to reveal PII in order to authenticate.

• MFA adds an additional level of security to the authentication process

• MFA adds a layer of encryption to online authentication.

MFA requires evidence from at least two authentication factors.

• True

• False

For a long time, mathematicians weren't sure that asymmetric encryption was possible. Fortunately, cryptographers discovered the necessary mathematical innovation in the 1970s and invented public key encryption.

If public key encryption was never invented, what wouldn't be possible today?

• A father logging into the family computer with his password, while the mother logs in with her own password, so that they can each keep their documents private.

• A lawyer encrypting the contents of their hard drive with a password, to maintain better privacy for their client's documents.

• A customer logging into their bank website, with their password and secure code, without the risk of cybercriminals stealing their login information.

• A web surfer using a browser extension that blocks advertisements and other third-party code from running on the websites they visit.

In 2011, the Dutch certificate authority DigiNotar was infiltrated by a cybercriminal. The attacker managed to create hundreds of false certificates, including ones for popular domains like google.com and facebook.com.

When the attack was publicized, companies like Apple and Microsoft blacklisted DigiNotar in their lists of trusted certificate authorities.

Why was it important for the DigiNotar certificates to be blacklisted?

• The attacker could sell the false certificates for thousands of dollars, raising the costs of certificates unnecessarily.

• The attacker could use the false certificates to gain access to the databases of the domains and download all their previously stored data.

• The attacker could launch a DNS spoofing attack on the certificates' domains and then intercept private data from the domains' users.

• The attacker could use the false certificates to spread viruses on the web servers of the compromised domains.

Nombeko is creating a social messaging app to use with her friends. She registers the domain "friendzers.com" to host the backend for the app. She then signs up for a digital certificate from a certificate authority and installs the certificate on the domain.

What does the certificate prove?

• The certificate proves that "friendzers.com" and the associated public key are owned by the same entity.

• The certificate proves that "friendzers.com" maps to the associated IP address.

• The certificate proves that "friendzers.com" is a legally operated company in the United States.

• The certificate proves that "friendzers.com" is following all security best practices with user data.