Information Assurance focuses solely on preventing unauthorized access to data.

Which term refers to the process of ensuring that information is accurate and trustworthy?

Cybersecurity is a relatively new field with no historical precedent.

Which of the following is an example of a key terminology or concept in cybersecurity?

An unpatched software is an example of a common:

A DDoS (Distributed Denial of Service) attack aims to make a service unavailable to its intended users.

Which stage of the Cyber Kill Chain involves an attacker delivering a malicious payload to the victim's system?

Phishing is a type of attack that involves creating fake websites or emails to trick users into revealing sensitive information.

Which of the following is considered an external threat?

The security principle of non-repudiation ensures that:

The principle of Least Privilege states that a user should have only the minimum access rights needed to perform their job functions.

What is the main conflict highlighted in the Security vs. Usability principle?

Authorization is the process of verifying a user's identity.

What is the purpose of Separation of Duties?

The Bell-LaPadula security model is primarily focused on protecting data confidentiality.

In the context of access control, what does RBAC stand for?

Which of the following is a component of the IAAA framework?

A password and a security token are examples of different authentication factors used in Multi-Factor Authentication (MFA).

The Clark-Wilson model is designed to protect the integrity of data by preventing unauthorized modifications.

Scenario: A company's website is taken offline by a massive surge of illegitimate traffic, preventing customers from accessing it.

This attack primarily violates which security goal of the CIA Triad?

Scenario: A company is updating its financial records. An attacker manages to change the transaction details without anyone noticing.

This is an attack on the data's integrity.

Scenario: A company has decided to start using a secure VPN for all remote employees.

This measure primarily addresses which aspect of information security?

Scenario: A user clicks on a link in a suspicious email, which then downloads a program that silently records their keystrokes.

This type of program is an example of a Trojan horse.

Scenario: A hacker uses publicly available information about a company's employees from social media to craft a targeted phishing email.

According to the Cyber Kill Chain, this initial phase of gathering information is called Reconnaissance.

Scenario: A company's network security is compromised because an employee accidentally shared a sensitive password with a co-worker.

This security breach is a result of a threat.

Scenario: A large hospital has a system where all employees, from janitors to senior doctors, can access all patient records.

Which security principle is being violated in this scenario?

Scenario: A company implements a security policy that requires all employees to use complex passwords and change them every day. As a result, many employees write their passwords down on notes and leave them at their desks.

This situation demonstrates a conflict between which two principles?

Scenario: To prevent fraud, one employee is responsible for creating a purchase order, while a different employee must approve it before it is sent to a vendor.

This practice is an example of Separation of Duties.

Scenario: A new company wants to implement an access control system that prevents users from modifying data they did not create, ensuring data integrity.

Which security model is best suited to meet this requirement?

Scenario: The company's new network administrator is given permission to read and write to all network devices but is not allowed to change system-critical configurations.

This is an example of a permissions model called Role-Based Access Control (RBAC).

Scenario: In an organization's access control system, an object's security label must be dominant over the subject's security label to allow a "write-down" operation. (3pts)

Which security model is this rule associated with?

Scenario: A company has a major vulnerability in its payment processing system, allowing an attacker to steal customer credit card information. The company's final project goal is to develop a security plan to prevent a recurrence.

In the security plan, which of the following actions best demonstrates a combined application of the CIA Triad (from Week 1) and the principle of Least Privilege (from Week 3) in a real-world scenario?

A newly hired cybersecurity consultant for a small e-commerce business learns that the owner believes their customer data is completely safe because they use a secure payment gateway. How should the consultant evaluate this claim?

A government agency is debating whether to prioritize confidentiality or availability for its public-facing website, which provides information to citizens during a national emergency. Which of the two security goals is more critical in this scenario?

A company's internal network is completely isolated from the internet. The IT manager argues that they do not need to invest in any further cybersecurity measures. What is the most critical flaw in this argument?

A security analyst detects a phishing attack where an email with a malicious link is being sent to multiple employees. In response, the analyst immediately implements an email filter to block the sender and deletes the emails that have already been delivered. What key security principle is the analyst addressing by also sending a company-wide alert to warn employees about the attack?

A security administrator discovers an unpatched software vulnerability in a critical server. The vendor has not yet released a patch. Which of the following is the best interim mitigation strategy to protect the server from being exploited?

An attacker wants to perform a Man-in-the-Middle (MITM) attack to read and modify communication between a client and a server. Which of the following is the most effective defense against this type of attack?

A large financial institution has a system where one employee is responsible for approving a loan, and a different employee is responsible for transferring the funds. This is a critical control to prevent fraud. What is the main principle demonstrated by this practice?

A company implements a new security policy that is so strict it requires employees to use long, complex passwords that must be changed every day. As a result, employees are now writing their passwords on sticky notes and leaving them under their keyboards. This scenario best demonstrates a failure in which security principle?

A hospital implements a new digital record system. Doctors are given access to all patient records to provide comprehensive care. A janitor is also given access to all records to assist with data entry. Which security principle is being violated, and what is the associated risk?

A security model that is primarily concerned with maintaining data confidentiality and preventing unauthorized information flow from higher security levels to lower ones is the:

A company wants to implement an access control policy that ensures that users can only perform actions that are necessary for their job roles. This is a core concept of:

In the Biba integrity model, which rule prevents a subject from writing to an object at a lower integrity level?

A new social media platform is being developed. It will store user-generated content, including public posts and private messages. The development team's final security plan must address both the confidentiality of private messages and the integrity of user-generated content, and they must use Role-Based Access Control (RBAC) to manage permissions. Which of the following security measures best synthesizes these requirements?