Defence in Depth

Which principle involves implementing multiple layers of security controls to protect systems and data?

• Principle of Simplicity

• Least Privilege Principle

• Principle of Defence in Depth

• Open Source Security

Answer explanation

The Principle of Defence in Depth involves using multiple layers of security controls to protect systems and data, ensuring that if one layer fails, others remain in place to provide protection.

What is the main function of encryption?

• To compress data for faster transmission

• To convert plaintext into unreadable ciphertext

• To store passwords securely

• To remove malware from files

Answer explanation

The main function of encryption is to convert plaintext into unreadable ciphertext, ensuring that sensitive information remains secure and inaccessible to unauthorized users.

In asymmetric encryption, which key is used for decryption?

• Public key

• Shared key

• Private key

• Session key

Answer explanation

In asymmetric encryption, the private key is used for decryption. The public key encrypts the data, while only the corresponding private key can decrypt it, ensuring secure communication.

Which of the following is an example of symmetric encryption?

• RSA

• ECC

• AES

• Diffie-Hellman

Answer explanation

AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning it uses the same key for both encryption and decryption. In contrast, RSA and ECC are asymmetric, and Diffie-Hellman is a key exchange method.

What does TLS primarily protect?

• Stored data

• Data during transmission

• Password strength

• Network segmentation

Answer explanation

TLS primarily protects data during transmission by encrypting it, ensuring that sensitive information remains secure as it travels across networks. This is crucial for preventing eavesdropping and tampering.

6. The regulation that focuses on protecting personal data within the European Union is:

• GDPR

• HIPAA

• FERPA

• CCPA

Answer explanation

The GDPR (General Data Protection Regulation) is the key regulation in the EU that protects personal data and privacy. It sets strict guidelines for data collection and processing, making it the correct choice.

Which of the following is NOT a common network security threat?

• Malware

• Phishing

• Encryption

• Insider Threats

Answer explanation

Encryption is a security measure used to protect data, not a threat. In contrast, malware, phishing, and insider threats are common network security threats that can compromise systems and data.

A DDoS attack typically uses:

• A. A single infected system

• B. A firewall rule set

• C. Multiple compromised systems (botnet)

• D. Encryption algorithms

Answer explanation

A DDoS attack typically involves multiple compromised systems, known as a botnet, to overwhelm a target with traffic. This makes option C the correct choice, as a single system or other options do not represent the nature of DDoS attacks.

Which device acts as a barrier between trusted and untrusted networks?

• Router

• Switch

• Firewall

• Proxy Server

Answer explanation

A firewall acts as a barrier between trusted and untrusted networks by monitoring and controlling incoming and outgoing traffic based on security rules, making it the correct choice for this question.

What is the primary difference between authentication and authorization?

• Authentication verifies identity, authorization grants access

• Authentication grants access, authorization verifies identity

• Both perform the same role

• Authorization happens before authentication

Answer explanation

The primary difference is that authentication verifies a user's identity, while authorization determines what resources a user can access. Thus, the correct choice is: Authentication verifies identity, authorization grants access.