Security (Practice set 1)

Which of the following methods of authentication involves something that the user has?

• Security Questions

• Pin

• Hardware token

• Biometrics

Answer explanation

Hardware tokens are physical devices used for authentication. They fall under the category of something the user possesses. Security questions are a type of knowledge-based authentication. They are categorized as something the user knows, not something the user possesses. A PIN (Personal Identification Number) is a knowledge factor used for authentication. It's categorized as something the user knows, not something the user possesses. Biometrics involve unique physical or behavioral attributes of a user, they are categorized as something the user is, not something the user possesses.

Maria, an IT administrator, wants to enhance password security for Dion Training's employees. Which of the following is the BEST policy to implement?

• enforce a password minimum length of 4 .

• encourage employees to use simple and common dictionary words as passwords for easy memorization.

• allow employees to share passwords within department for ease of collaboration.

• implement a password manager tool to generate and store complex passwords for each employee.

Answer explanation

Implementing a password manager tool is the best approach to achieve enhanced password security. Password managers can generate and store complex passwords for each employee, eliminating the need for employees to remember multiple passwords while ensuring strong and unique passwords for each account. Password managers also encrypt the stored passwords, enhancing their security. Encouraging the use of simple and common dictionary words as passwords is a bad practice. Such passwords are easy to guess and are susceptible to dictionary attacks or brute-force attacks. Employees should use strong passwords that combine random words, numbers, and special characters to enhance security. Allowing employees to share passwords within their department is a significant security risk. It violates the principle of individual accountability and makes it difficult to trace actions back to specific users in case of security incidents. Password sharing should never be allowed as it compromises the confidentiality and integrity of the organization's systems. Enforce a password minimum length of 4 would be counterproductive and jeopardize the security of the account due to the ease of cracking a password of such short length.

What is the primary purpose of creating written IT policies and procedures in an organization?

• To guide employees in using IT resources securely.

• to monitor employees performance.

• to regulate internet usage.

• to reduce it cost.

Answer explanation

Creating written IT policies and procedures is primarily intended to guide employees in understanding and adhering to secure and responsible practices while using the organization's IT resources and services. Written IT policies and procedures can lead to more efficient use of IT resources, which may indirectly help reduce costs. However, their main goal is to ensure safe and secure usage of IT infrastructure. Monitoring employee performance is not the main goal of IT policies and procedures. They are developed to ensure safe and responsible use of the company's IT resources. While IT policies may include guidelines on appropriate internet usage, this is not the primary purpose of these policies. They aim to cover a broader spectrum of secure computing and networking practices.

What is the main difference between OEM websites vs third-party websites?

• OEM websites focus on hardware sales, while third-party websites specialize in software distribution.

• OEM websites provide software directly from the original manufacturer , while the third party websites offer modified versions or unauthorized copies.

• OEM websites require user registration and verification, while third party websites allow anonymous downloads.

• OEM websites offer discounted prices and exclusive deals, while third-party websites have higher prices.

Answer explanation

The main difference between OEM websites and third-party websites is that OEM websites are authorized by the original equipment manufacturer to distribute their software. They offer genuine, unaltered versions of the software. On the other hand, third-party websites may provide modified or unauthorized copies of the software, which can pose security risks. OEM websites offer discounted prices and exclusive deals and third-party websites have higher prices, but this isn't the main difference between the two. OEM websites focus on hardware sales and third-party websites specialize in software distribution but this isn't the main difference between the two. OEM websites require user registration and verification and third-party websites allow anonymous downloads, but this isn't the main difference between the two.

What is the purpose of password history requirements?

• To prevent users from reusing old passwords.

• to Track and monitor user login activities

• to enforce a maximum number of failed login attempts.

• to remind the users to change their password regularly.

Answer explanation

Password history requirements are implemented to prevent users from reusing previously used passwords. This helps enhance security by ensuring that users choose new and unique passwords when changing their passwords. Enforcing a maximum number of failed login attempts is typically part of account lockout policies and is not directly tied to password history. Reminding users to change their passwords regularly is typically part of password expiration policies, not password history requirements. Tracking and monitoring user login activities is not the primary purpose of password history requirements. While monitoring user login activities may be important for security purposes, password history requirements specifically focus on preventing password reuse.

Which of the following tools assists in managing multiple unique passwords, thus aiding in avoiding password reuse across sites?

• Password History

• Password Complexity

• Password expiration

• Password managers

Answer explanation

Password managers are tools designed to securely store and manage multiple unique passwords, thus reducing the need for password reuse across sites. Password history refers to a record of past passwords used, not to managing multiple unique passwords. Password complexity refers to the use of different types of characters in a password, not to managing multiple unique passwords. Password expiration refers to regularly changing a password, not to managing multiple unique passwords.

What is the primary difference between plain text and cipher text?

• Plain text is encrypted, while cipher text is decrypted

• Plain text is readable and understandable , while cipher text is encrypted.

• Plain text is transmitted over the network , while cipher text is stored locally.

• Plain text is compressed , while cipher text is uncompressed.

Answer explanation

Plain text refers to unencrypted and readable text, while cipher text refers to text that has been encrypted to make it unreadable without the decryption key. The difference between plain text and cipher text is related to encryption, not compression. Plain text and cipher text can both be compressed or uncompressed, depending on other factors. Both plain text and cipher text can be transmitted over a network or stored locally. The primary difference lies in whether the text is encrypted (cipher text) or not (plain text) Plain text is not encrypted, but rather it is the original readable text. Cipher text is the result of encrypting plain text

What is the main purpose of prioritizing data restoration during disaster recovery?

• to reduce the time needed to restore all data

• to comply with data protection regulations.

• to save storage space during recovery.

• to ensure the most critical systems and data are recovered first to minimize business disruption.

Answer explanation

Prioritizing data restoration ensures that the most critical systems and data—those that the business cannot function without—are recovered first. This allows the business to resume critical operations as quickly as possible, minimizing disruption. Prioritizing data restoration is not about saving storage space. Its main purpose is to minimize business disruption by restoring the most important data first. Although data protection regulations may dictate some aspects of data recovery, the main reason for prioritizing data restoration is to minimize business disruption. Compliance with regulations is a separate consideration. While prioritizing critical data can potentially reduce overall recovery time, the primary purpose is to resume critical operations quickly, not necessarily to speed up the full recovery process.

Which of the following security measures is most effective in addressing known vulnerabilities and fixing software bugs in computer systems?

• Patching Updates

• Host Firewall

• Changing default password.

• Antivirus/Anti-malare

Answer explanation

Patching updates involve applying software updates, including security patches and bug fixes, to address known vulnerabilities and software bugs in computer systems. Regularly applying patches helps to close security gaps, improve system stability, and mitigate potential threats. Changing default passwords is a good security practice to prevent unauthorized access to devices or systems. However, it does not specifically address known vulnerabilities and software bugs in computer systems. A host firewall controls network traffic for a specific device, acting as a barrier between the device and the network. While it is an important security measure, it does not directly address known vulnerabilities and software bugs in computer systems. Antivirus and anti-malware software are designed to detect and remove malicious software, protecting against various types of threats. However, they do not specifically address known vulnerabilities and software bugs in computer systems.

Which feature of a normal antivirus software is responsible for automatically scanning files and programs in real-time as they are accessed or downloaded?

• Heuristic analysis

• quarantining and remediating infected systems.

• On-access scanning.

• Scheduled scans

Answer explanation

O-access scanning is the feature of an antivirus software that automatically scans files and programs in real-time as they are accessed or downloaded. It provides immediate protection against malware threats by detecting and blocking malicious files before they can execute on the system. Quarantining and remediating infected systems is a feature that isolates detected malware and removes or repairs it. While important for handling infected files, it is not the specific feature responsible for real-time scanning. Heuristic analysis is a technique used by antivirus software to detect previously unknown or zero-day malware based on behavioral patterns. While an important feature, it is not directly related to real-time scanning. Scheduled scans allow users to configure the antivirus software to perform regular scans at specific times or intervals. This feature helps ensure that the system is periodically checked for malware infections, but it does not specifically refer to real-time scanning.