Worksheetsقواعد 9
Total questions: 93
Worksheet time: 48mins
Changing data values for reasons of sabotage, crime or ignorance which may be enabled by inadequate security mechanisms, or sharing of passwords or password guessing
Unauthorized modification
Which of the following can enable unauthorized modification?
Sharing passwords
Password guessing
Secure protocols
Strong passwords
Unauthorized modification can happen because of ignorance.
True
False
Strong security mechanisms help prevent unauthorized access
True
False
When information that should not have been disclosed has been disclosed. A general issue of crucial importance, which can be accidental or deliberate.
Unauthorized disclosure
Unauthorized disclosure can be:
Only accidental
Only deliberate
Either accidental or deliberate
What does "loss of availability" refer to?
System downtime
Unauthorized modification
Another name for "loss of availability" is:
Data encryption
Denial of Service
Even short downtime can be a threat to system availability.
True
False
Most financial losses through fraud arise from employees.
True
False
Most financial losses through fraud come from:
Hackers
Employees
What do access controls help with?
Preventing fraud and tracking harmful actions
Speeding up the internet
What can access controls record?
Only successful attacks
Only failed attempts
Both successful and failed harmful attempts
Access controls can help prevent internal fraud
True
False
is data about an identifiable individual.
Often the individual has to be live but the method of identification is not prescribed
True
False
What is personal data?
Data about any company
Data about an identifiable individual
Can a postal code identify someone?
Only if it's shared by many people
Yes, if only one person lives at that address
Personal data should be:
Backed up monthly
Handled and controlled carefully
A postal code can be considered personal data in some cases.
True
False
What is an example of computer misuse?
Updating antivirus software
Accessing the system with permission
Introducing viruses to a system
Computer misuse includes:
Protecting user data
Improving software performance
Violating access controls
One goal of computer misuse is to:
Cause damage or disruption
Increase speed
What do audit requirements help determine?
Future software updates
Who did what and when
These are operational constraints built around the need to know who did what, who tried to do what, and where and when everything happened.
Audit requirements
Audit logs can be used for:
Entertainment purposes
Legal defense or prosecution
Audit requirements usually involve:
Blocking users automatically
Monitoring and logging system activity
Audit logs can provide evidence of unauthorized actions.
True
False
What can OS-level utilities allow someone to do?
Directly access and damage the database
Improve graphics performance
What is a good security practice mentioned in the text?
Increase communication channels
Minimize and isolate system communications
Access to OS utilities can lead to copying or damaging the database.
True
False
Reducing communication channels helps protect against unnecessary threats.
True
False
is the process of converting text and data into a form that can only be read by the recipient of that data or text, who has to know how to convert it back to a clear message.
Encryption is the process of:
Deleting data permanently
Making data visible to everyone
Converting readable data into unreadable form
What is typically encrypted?
Only user passwords
Both data and the schema
Who can read encrypted data?
All administrators
Only the person with the right decryption method
What is a security model used for?
To create passwords
To organize thoughts about security
Which of the following is NOT part of the major categories in a security model?
Threats
Weather
Impact
Loss
Security models vary depending on:
The color of the software
User roles and purpose
A security model helps in organizing security-related ideas.
True
False
Threats, impact, and loss are key categories in a security model.
True
False
Which of the following is considered a security asset?
Screensaver
Data quality
What is the correct way to view security risks?
As ways to improve design
As potential loss of assets
Which of the following is typically considered an asset in security?
Hardware
Data
Credibility
Decoration
Business benefit
Which of the following is typically considered an asset in security?
Hardware
Software
To structure thoughts on security, you need a model of security.
True
False
model of security come in various forms that depend on
purpose
size
degree
roles
are to be seen in terms of the loss of assets.
Security risks
What is the primary concern mentioned in this context?
Hardware
Decorations
Data and data quality
A threat to one asset:
Only affects that asset
Can impact other assets
Data and data quality are the main security concerns in this context.
True
False
A threat to one asset never affects other assets.
True
False
Knowing which asset needs protection is not necessary.
False
True
Identifying the asset helps in focusing protection efforts.
True
False
Which tool is used to address reliability issues?
Logging
Recover from corruption, loss, and damage
Validation rules
What technique helps with access security?
Checkpoints
Passwords
Constraints
Back-up
To ensure internal consistency of data, we use:
Logging
Validation rules and constraints
Logging and checkpoints are techniques for improving access security.
True
False
Control Access is the tool used for Access Security.
True
False
Ensuring internal consistency is part of schema security.
True
False
Passwords are used to maintain data integrity.
True
False
What is always true about security?
It can be perfect
There is always some risk
What should be done in preparation for possible security issues?
Hope nothing happens
Prepare for worst-case scenarios
Which of the following is NOT recommended in security planning?
Spending more than the asset's value on security
Planning recovery from damage
Minimizing impact of attacks
Ensuring security doesn't affect normal use
Security can always be made 100% perfect
True
False
It is wise to prepare for the worst possible outcome in security.
True
False
Security should cost more than the asset being protected.
True
False
Proper security must balance protection and system usability.
True
False
What is the main purpose of a security model?
To replace databases
To set external criteria for examining security
What do specific DBMSs have regarding security?
Identical global settings
Their own security models
What is a possible result of faults in the security model?
Faster operation
Insecure or clumsy systems
What is one drawback of access control?
It is always free
It can be expensive to analyze and operate
Access control is typically applied to:
Unknown environments
Random users
Known situations with known standards
Control must always be:
Strict regardless of context
Appropriate to the situation
Access control is free and easy to implement.
True
False
Control measures should be appropriate to the situation.
True
False
What is the goal of authentication?
Verify the identity of client and server
Increase storage
What is commonly used for authentication?
Shared printers
Shared secrets like passwords or biometrics
Authentication is a prerequisite for authorization.
True
False
Authentication does not give any privileges for particular tasks.
True
False
Authentication cannot be shared or transferred between systems.
True
False
What does authentication confirm?
The user’s trust level
The identity of the user and system
Which of the following is not true about authentication?
It gives specific permissions to the user
It comes before authorization
It proves who the user is
It helps the DBMS know who is connecting
What is a prerequisite for authorization?
Encryption
Authentication
Authentication helps both the user and the system trust each other.
True
False
What does authorization control?
User's identity
User permissions for transactions
Which of the following operations can be managed through authorization?
Reading data
Writing data
Both A and B
Logging out
What is an example of an authorization vector?
Authorization(item, auth-id, operation)
SELECT * FROM table
Authorization gives users permissions to access or modify data.
True
False
Authentication and authorization are the same.
True
False
A vector in authorization defines what operations a user can perform.
True
False
Authorization is optional in database systems.
True
False
is a sequence of data values at a known location in the system.
vector
