Security II

What is the primary purpose of using password managers?

• They store passwords in an encrypted format

• They eliminate the need for password explanation.

• They Generate random and complex passwords

• They require the users to reuse passwords across multiple sites

Answer explanation

One of the main advantages of using password managers is that they store passwords in an encrypted format. This helps protect the passwords from unauthorized access in case of a data breach or unauthorized access to the password manager itself. Password managers often have the capability to generate random and complex passwords for users. This is advantageous as it helps users create strong and unique passwords without having to remember them but this is not a password manager's primary purpose. Password managers encourage users to use unique passwords for each site or service they use. Reusing passwords across multiple sites can be a security risk, as a compromise of one site can potentially lead to unauthorized access to other accounts. Password managers do not eliminate the need for password expiration. Password expiration is a separate security measure that is typically implemented to ensure that passwords are regularly changed, reducing the risk of compromised passwords.

Which term describes the act of manipulating individuals to reveal their passwords or sensitive information?

• Social engineering

• Wire tapping

• Eavesdropping

• Snooping

Answer explanation

This term specifically refers to the act of manipulating individuals to reveal their passwords or sensitive information. It involves exploiting psychological vulnerabilities or using deceptive techniques to gain unauthorized access. Wiretapping is the act of intercepting and listening to telephonic or digital communications by tapping into the wire or cable carrying the communication. It does not involve manipulating individuals to reveal passwords or sensitive information. Snooping refers to the unauthorized act of observing or accessing someone else's private information or activities. It does not involve manipulating individuals to reveal passwords or sensitive information. Eavesdropping involves secretly listening to or monitoring private conversations or communications without permission. It does not encompass the act of manipulating individuals to reveal passwords or sensitive information.

In a business continuity plan, what is a key consideration for deciding whether to store backups locally, in cloud storage, or off-site?

• The cost of storage solutions.

• The size of the data to be backed up.

• The speed of the local network

• The need to ensure data availability and quick recovery in case of a disruption.

Answer explanation

Choosing where to store backups in a business continuity plan should primarily be based on ensuring data availability and quick recovery during a disruption. Each option—local, cloud, or off-site—has different advantages and considerations regarding access speed, cost, security, and protection from local disasters. While cost is a factor in choosing a storage solution, the primary consideration should be data availability and quick recovery in case of a disruption. While network speed can influence how quickly backups can be accessed or updated, the primary consideration in a business continuity plan should be data availability and quick recovery in case of a disruption. While the size of the data can influence the type of storage solution used, the main consideration should still be ensuring data availability and quick recovery during a disruption.

Which of the following BEST describes the concept of RAID 1 in data redundancy?

• Disk Mirroring

• Disk Shadowing

• Disk Stripping

• Disk Stripping with parity

Answer explanation

RAID 1, also known as disk mirroring, involves using two disks where each write operation is performed on both disks. If one disk fails, the other can continue functioning. Disk striping is a feature of RAID 0, not RAID 1. It involves spreading data across multiple disks, but does not provide redundancy in case of disk failure. This is a feature of RAID 5, not RAID 1. It combines the benefits of disk striping with additional parity data to enable data recovery in case of a disk failure. Disk shadowing is not a term associated with RAID levels. It does not correctly describe RAID 1.

Which of the following specifically refers to a deliberate attack aimed at overwhelming a system or network, rendering it unavailable?

• Service Outage

• Power Outage

• Denial of Service Attacks (Dos Attack).

• Destruction

Answer explanation

A denial of service (DoS) attack is a deliberate and malicious act aimed at overwhelming a system or network with excessive traffic or requests. The intention is to render the targeted system or network unavailable to its intended users. This is the correct answer as it specifically refers to the described attack. Destruction involves physical damage or harm caused by events like natural disasters, fires, or deliberate acts. While destruction can render systems unavailable, it is not specifically related to overwhelming a system or network with excessive traffic or requests. While a power outage can impact the availability of information systems, it is not a deliberate attack aimed at overwhelming the system. Power outages occur due to factors like severe weather conditions or infrastructure issues, affecting the electrical power supply and potentially causing service disruptions. A service outage refers to the unavailability or disruption of a specific service. While service outages can be caused by various factors, including hardware failures or software issues, they are not specifically related to overwhelming a system or network as described in the question.

Which of the following are considered reputable software sources

• Freeware websites with no user rating or reviews

• Third-Party websites offering cracked software

• peer-to-peer file sharing networks

• official vendor websites and app stores

Answer explanation

Official vendor websites and app stores, such as Microsoft Store, Apple App Store, or Google Play Store, are reputable software sources. These platforms provide legitimate and authorized software that has undergone security checks, ensuring users download genuine and safe applications. Freeware websites can provide legitimate software options, but those without user ratings or reviews may lack credibility. User ratings and reviews often provide insights into the quality, safety, and user experience of the software, helping users make informed decisions. Third-party websites offering cracked software are not reputable sources. Such websites often distribute unauthorized and modified versions of software, which can be illegal and compromised with malware or other security risks. Peer-to-peer file-sharing networks are not typically considered reputable software sources. While they may offer access to various software applications, the authenticity, integrity, and security of the downloaded files cannot be guaranteed. There is a higher risk of downloading malware or pirated software from such networks.

Which of the following is HTTPS used for the most?

• Secure web communication

• encryption of emails messages

• secure file storage

• encryption of mobile applications.

Answer explanation

HTTPS encryption ensures secure web communication by encrypting the data transmitted between a web browser and a web server. It provides confidentiality and integrity, protecting sensitive information from eavesdropping and tampering during transmission. HTTPS encryption is not specifically tied to encrypting mobile applications. It is a protocol used for securing communication over the web. HTTPS encryption is not specifically designed for encrypting email messages. It is primarily used for securing web communication. HTTPS encryption is not directly related to secure file storage. It focuses on securing data transmission over the web.

Emily, a security analyst at Dion Training, wants to prevent attackers from capturing and retransmitting legitimate data to deceive the system. Which of the following threats should she be particularly focused on?

• Replay Attack

• Man-in-the Middle

• impersonation

• Unauthorized information alteration

Answer explanation

Emily should be particularly focused on the threat of a replay attack. In this type of attack, attackers capture legitimate data transmissions and retransmit them to deceive the system. It aims to exploit vulnerabilities associated with repeated or unauthenticated data transmission. Preventing replay attacks often involves implementing mechanisms like message timestamps, nonces, or session tokens. Impersonation refers to someone pretending to be another person or entity. While impersonation can be a security concern, it does not specifically pertain to preventing attackers from capturing and retransmitting legitimate data. A man-in-the-middle attack involves an unauthorized individual intercepting and potentially manipulating the communication between two parties. While it is a security concern, it does not directly relate to preventing attackers from capturing and retransmitting legitimate data. Unauthorized information alteration involves the unauthorized modification or tampering of data. While it is a security concern, it does not specifically relate to preventing attackers from capturing and retransmitting legitimate data.

Which of the following is the primary purpose of authentication?

• To assign permissions and access levels

• To verify the identity of the users

• to ensure the availability of the resources

• To track the user activities and generates logs.

Answer explanation

Explanation

The primary purpose of authentication is to verify the identity of users. It involves validating user credentials or other factors to ensure that the person accessing the system or resource is indeed the authorized user. Ensuring the availability of resources falls under the realm of availability and resource management, not authentication. Authentication is focused on verifying user identities, not on ensuring resource availability. Assigning permissions and access levels is the primary purpose of authorization, not authentication. Authentication is concerned with verifying the identity of users, while authorization deals with granting appropriate access based on the verified identity. Authentication is primarily focused on verifying the identity of users and ensuring that they are who they claim to be. Tracking user activities and generating logs fall under the realm of accounting and auditing.

As a user of online communication platforms, what is one major privacy concern?

• Understanding the type of computer used to access these platforms

• knowing what information is made public and how service providers use provided data.

• Being sure to use a high-speed internet connection.

• Monitoring the amount of time spent on these platforms.

Answer explanation

Privacy on online platforms involves understanding how public your information is and how the data you provide is utilized by service providers. Monitoring time spent on platforms is more relevant to productivity or digital wellbeing than to privacy. While important for usability, the speed of your internet connection doesn't directly relate to privacy concerns on online platforms. The type of computer used doesn't necessarily impact your privacy on online platforms.