ISDS Information Privacy and Security (ISDS 418) Practice Exam

These questions are part of the practice quiz. Start practicing

• What characterizes a one-way hash function?
• What does authentication involve in an information system?
• How many bits does a plaintext block of Triple DES typically have?
• What kind of breach is expected to have a severe or catastrophic impact on operations or individuals?
• What can weak passwords lead to in terms of digital security?
• Which of the following relationships best describes public-key cryptography?
• What does the term 'plaintext' refer to in cryptography?
• During an active attack, what is typically targeted?
• What type of confidentiality involves unauthorized individuals?
• Which of the following categories is not included in the assets of a computer system?
• What is the typical block size used by symmetric block ciphers like DES?
• What is a threat agent?
• Which property refers to the genuineness and verifiable trustworthiness of data?
• In a biometric scheme, what is mapped into a digital representation?
• In biometric authentication systems, what does the process often involve based on application?
• Which term describes a malicious action that leads a system to behave detrimentally?
• What is ciphertext?
• In access control, what does granting specific requests involve?
• In symmetric encryption, what is shared between communicating parties?
• Which scenario illustrates the concept of workstation hijacking?
• Patient allergy information is an example of an asset requiring high levels of what?
• Which term refers to an entity that poses a threat to a system?
• What kind of systems identify features of the hand, such as shape and lengths of fingers?
• What is the role of a digital signature in secure communications?
• What is required as an input to the encryption algorithm in symmetric encryption?
• What is the most important symmetric algorithm mentioned that is categorized as a block cipher?
• Which of the following is NOT a key aspect of user authentication?
• In security contexts, what are we primarily concerned about?
• Which regulatory body is commonly associated with overseeing Electronic Funds Transfer processes?
• What is defined as a threat that leads to a violation of security?
• What is NOT a focus of isolation in security?
• What can be considered a direct consequence of "compromise" in system security?
• What is the significance of the Data Encryption Standard (DES)?
• What is created between a user and the user's biometric characteristics upon enrollment?
• What type of function helps protect against an attack where one party generates a message for another party to sign?
• How does a user typically authenticate their identity?
• What is the term for the encryption algorithm run in reverse?
• Which is NOT a property of secure hash functions?
• Why is a strong security policy essential for organizations?
• Which of the following describes the concept of "risk"?
• What is the purpose of the Secure Hash Algorithm (SHA)?
• Which encryption method involves key pairs for encryption and decryption?
• What phase comes after identifying system vulnerabilities?
• What does a smart card contain?
• In terms of security, who poses a significant threat when they misuse their authorized access?
• What is a primary use of a public-key cryptosystem?
• What encompasses both tangible and intangible assets within an organization?
• What does availability refer to in the context of an information system?
• What property must a hash function possess for message authentication?
• What is a primary requirement for secure use of symmetric encryption?
• In the context of data security, what does the term 'encryption' primarily refer to?
• What is the purpose of a countermeasure in information security?
• Which of the following is NOT a function of security services?
• What is defined as anything that needs to be protected due to its value to an organization?
• Which of the following would most likely be considered a dynamic biometric?
• In terms of user education on password security, what does a good password guideline emphasize?
• What term describes an attempt by an unauthorized user to gain access to a system by posing as an authorized user?
• What defines a passive attack in cybersecurity?
• What common mistake do many users make when creating passwords?
• What is the key aspect of challenge-response authentication?
• What role does user authentication primarily play in access control?
• Replay, masquerade, modification of messages, and denial of service are examples of what type of attacks?
• Which of the following best describes a password?
• How has EFT impacted the banking industry?
• What does a 'salt' do in password protection?
• What does the "A" in the CIA triad stand for?
• What is contingency planning primarily concerned with?
• Which of the following best defines a "vulnerability" in an information system?
• In cybersecurity, what is an active attack?
• What does the false match rate indicate in biometric systems?
• What is the role of a Certificate Authority in public key infrastructure?
• What is a "security mechanism" designed to do?
• Which concept refers to a hierarchical data structure that displays approaches to penetrate a system’s security?
• What are the essential ingredients of a symmetric cipher?
• What does the term "falsification" refer to in the context of data management?
• What is the purpose of access control in information security?
• What does "unauthorized disclosure" imply?
• What is the function of a message authentication code (MAC)?
• Which of the following statements regarding cryptographic algorithms is true?
• What is defined as a security event where an unauthorized entity attempts to access a system?
• True or False: Hash functions also utilize a secret key to process data.
• What do many security administrators believe about strong security?
• EFT technology is primarily used for which type of transaction?
• What characteristic defines the second preimage resistance of hash functions?
• What does it mean for a hash function to be collision resistant?
• What characterizes an attack that attempts to compromise system availability?
• What term is used for transmitted data that is stored locally?
• Which action is a key component in reducing system vulnerabilities?
• What function does a router serve in a network?
• What is the primary function of a registration authority (RA)?
• What does second preimage resistance ensure in a cryptographic hash function?
• What is the role of a claimant in an authentication system?
• What process is involved in verification within an authentication system?
• How does non-repudiation contribute to information security?
• Before an individual can be included in a database of authorized users, they must first be what?
• What does integrity of a message imply in information security?
• What does the term "misuse" refer to in the context of information security?
• What type of assessment involves periodically assessing risks to organizational operations and assets?
• What is the primary concern of traffic analysis in information security?
• To strengthen authentication, which of the following methods can be incorporated?
• What term is used to describe a threat that, if successful, leads to an undesirable violation of security?
• Which type of attack can disrupt a system's service through malware?
• What best describes a biometric?
• What is an example of a challenge-response protocol?
• What type of threat action leads to deception, such as through masquerade or falsification?
• What is one significant risk associated with EFT transactions?
• What does an attack tree represent?
• What is a Message Authentication Code (MAC)?
• Which of the following is a characteristic of asymmetric encryption?
• What is a flaw or weakness in a system that could be exploited to violate security policies called?
• What helps to ensure strong password protection against attacks?
• Which of the following properties must a hash function NOT have for message authentication?
• To counter threats to remote user authentication, what protocol do systems generally rely on?
• What is incapacitation in the context of information security?
• How is the false nonmatch rate defined?
• What is the Digital Signature Algorithm (DSA) based on?
• What distinguishes asymmetric encryption from symmetric encryption?
• How is risk best described in the realm of information security?
• Release of message contents and traffic analysis are two types of which category of attacks?
• What is the general concept of a challenge-response protocol?
• What is a patent?
• What is the Advanced Encryption Standard (AES) designed for?
• Which aspect of an authenticator may be independent of message content?
• What do we call the means taken to deal with a security attack?
• In data protection, what do integrity, confidentiality, and availability collectively ensure?
• Which electronic service involves the automatic transfer of funds from one bank account to another?
• What characterizes a block cipher in symmetric encryption?
• What is the primary goal of computer security?
• What is a primary goal of information security practices?
• What does system integrity ensure?
• What type of attacks does the strength of a hash function protect against?
• What type of attack involves repeating a previously captured user response?
• Which of the following describes an action that hinders system operations by interrupting delivery of services?
• Which of the following describes a challenge faced by Electronic Funds Transfer systems?
• What is a brute-force attack in cryptography?
• Which of the following best describes symmetric encryption?
• In the context of security, what does the term "attack" imply?
• In the context of biometric authentication, what is verification?
• When referring to the process of presenting authentication information, what is this primarily known as?
• Which of the following best describes disruption in the context of information systems?
• Which example describes 'something the individual knows' in authentication?
• Which of the following statements about public-key cryptography is true?
• Confidentiality, Integrity, and Availability are often referred to as what?
• Misappropriation and misuse attacks lead to which type of threat consequence?
• Which of the following is NOT an approach to message authentication?
• What is the most common means of human-to-human identification?
• Which of the following best describes a passive attack?
• What principle states access decisions should be based on permissions rather than exclusions?
• What defines a one-way function in cryptography?
• What type of attack is keylogging classified as?
• What is the output of a pseudorandom bit generator when combined with plaintext using the XOR operation?
• The use of longer keys in cryptography primarily serves to improve what aspect?
• Which term refers to the insertion of bits into gaps in a data stream to frustrate traffic analysis attempts?
• What does the acronym EFT stand for in financial transactions?
• What is the definition of identification in an authentication context?
• What is included in a public-key certificate?
• What is created by encrypting a hash value with a private key?
• A successful attack on a network can result in the loss of which of the following?
• What does the term "attack surface" refer to?
• What encryption type is primarily used for digital signatures and key management?
• What is the primary function of a hash function?
• Which algorithm is known primarily for its application in digital signatures?
• What characterizes an "outside attack"?
• What aspect of privacy relates to the control over personal information?
• What is a characteristic of public-key algorithms?
• What does the process of encryption aim to achieve?
• What measures ensure confidentiality, integrity, and availability of information processed by a computer?
• Which of the following systems best exemplifies an EFT network?
• Which attack method primarily targets stored passwords or biometric templates at the host?
• What is the primary purpose of user education in password selection techniques?
• Isolation in security contexts primarily aims to prevent what?
• True or False: Availability ensures that services are not denied to any user.
• Which of the following statements about hash functions is true?
• Which biometric characteristic is most commonly used for human identification?
• Who is responsible for verifying the identity of a claimant in an authentication process?
• What type of attack involves one entity impersonating another?
• What is a key aspect of computer security?
• What is one requirement for secure use of symmetric encryption?
• What does security assurance measure?
• What defines a set of rules for protecting sensitive resources?
• Which entity issues or registers subscriber tokens as part of the authentication process?
• True or False: Threats are synonymous with attacks in information security.
• What type of information requires the highest level of confidentiality?
• What is the primary focus of a risk assessment in an organization?
• Examples of static biometrics authentication include recognition by which of the following?
• What kind of attack does a nonce primarily protect against?
• How does an encryption algorithm perform its function?
• Which of the following describes a deliberate attempt to evade security services?
• True or False: A MAC is created by using a secret key and is added to a message for authentication.
• Standards in information security have been developed to cover which aspect?
• Which of the following describes a private key?
• What does data integrity ensure about information?
• How does the challenge-response authentication process work?
• What feature of a random number makes it useful in cryptographic applications?
• What principle covers the idea that security mechanisms should not impede users' productivity?
• Is an individual's signature considered unique enough for use in biometric applications?
• Which principle dictates that entities should only have the minimum access needed?
• What is the main focus of cryptanalysis?
• Which security principle advocates for a design that minimizes shared functions among different users?
• Which element is crucial in many computer security services and applications?
• What primary feature is assessed by hand geometry systems?
• What are two important applications of public-key encryption?
• What does an attack surface refer to?
• What does the term "dynamic biometrics" refer to?
• What is defined as any action that compromises the security of information owned by an organization?
• What is meant by an attack in the context of information security?
• What is the term for unauthorized disclosure of information in the context of confidentiality?
• In a brute-force attack, on average, how many of all possible keys must be tried to achieve success?
• What is the purpose of an encryption algorithm?
• Who initiates an inside attack?
• How many algorithms or protocols are typically involved in security mechanisms?
• What characterizes a replay attack?
• What is the main goal of implementing a "security mechanism"?
• The original message that is input into an algorithm is known as what?
• What is a potential drawback of using computer-generated passwords?
• True or False: Data integrity ensures that information is altered only with proper authorization.
• What technology facilitates the connection of point of sales devices and bank teller machines globally?
• What does a public-key certificate typically consist of?
• What is the protection afforded to an automated information system in order to preserve the integrity, availability, and confidentiality of its resources?
• What does misappropriation involve?
• Which of the following is a characteristic of a reactive password checking strategy?
• Why should identifiers be assigned carefully in security applications?
• Do memory cards primarily function to store and process data?
• What is corruption primarily categorized as in the context of information security?
• Which strategy involves a system periodically running its own password cracker to identify guessable passwords?
• What is the primary goal of employing countermeasures in security?
• Which of the following statements reflects the importance of a security policy?
• Which of the following is a goal of conducting an audit?
• How is the integrity of a digital signature guaranteed?
• What aspect makes a hash function suitable for authentication?
• What does an attack surface comprise?
• The strength of a hash function against brute-force attacks depends solely on which of the following?
• What describes public-key encryption?
• What is the recommended method to counter against brute-force attacks on encryption algorithms?
• Who is considered a subscriber in the context of electronic credentials?
• What is an example of a token used for authentication?
• Which technique involves the system checking its own password strength by cracking guessable passwords?
• A threat action in which sensitive data are directly released to an unauthorized entity is called what?
• What is the primary purpose of the DSS algorithm?
• What role does a Key Distribution Center play in information security?
• In terms of password protection, what is a 'salt'?
• Why is it important to use a salt with passwords?
• What does a credential represent in the context of authentication?
• Which type of attack tries every possible key until intelligible plaintext is obtained?
• How many keys are required for two people to communicate using a symmetric cipher?
• Which of the following is less susceptible to automated controls?
• What describes the primary characteristic of a strong encryption algorithm in symmetric encryption?
• A breach of confidentiality may typically result from which of the following actions?
• What aspect of EFT makes it a preferred choice for recurring payments?
• What is an authenticator in the context of information security?
• In a complex password policy, what does the system do when a user attempts to set a password?
• What term describes the assurance that a system performs its intended function without unauthorized manipulation?
• In the context of information sharing, what does the term 'repudiation' imply?
• What primary benefit does EFT offer to individuals managing personal finances?
• What type of security threat involves monitoring transmissions?
• What does "interception" mean in the context of data security?
• What is essential for public-key distribution?
• Which component is described as being most vulnerable to attack?
• What is a nonce used for in data exchange protocols?
• What is considered the fundamental building block and primary line of defense in information security?
• What is the strategy called when users are educated on the importance of using hard-to-guess passwords?
• What is the primary output of an encryption algorithm?
• Which process involves establishing the validity of a claimed identity provided by a user?
• What is the primary risk associated with exposure of sensitive information?
• Which mechanism is essential in enabling two users to securely share a secret?
• What is the difference between a private key and a secret key?
• What is the primary goal of user authentication?
• What characteristic distinguishes a smart card from a memory card?
• What is a good technique for creating a strong password?
• What is a common goal of implementing countermeasures in information security?
• Which process is used to verify the integrity of a message?
• What is a program designed to guess passwords called?
• What is it called when an adversary tries to bypass user authentication without access to the remote host?
• Which protocol is defined by IETF RFC 2821 and is most commonly used for email transmission?
• In what way has EFT contributed to the globalization of commerce?
• What role does cryptanalysis play in the field of cryptology?
• A loss of availability refers to what scenario?
• Which of the following is NOT a fundamental aspect of information security?
• What is the primary focus of privacy in the context of information security?
• What is usurpation in the context of information systems?
• What aspect of cybersecurity does user accountability primarily contribute to?
• What type of monitoring can make a password during a login session vulnerable?
• What is a Message Authentication Code (MAC)?
• What does a smart card typically store?
• Which of the following is an aspect of data integrity?
• What type of attack is directed at the user file at the host where sensitive data is stored?
• What is defined as an exhaustive attempt to decrypt ciphertext by trying every possible key?
• Who is an applicant in the context of a credential service provider?
• What does a credential service provider (CSP) encompass?
• What is a secret key in symmetric encryption?
• Which of the following actions does not affect system resources in a passive attack?
• What does unauthorized control of a system's functions imply?
• What is the function of a digital signature?
• Which of the following is NOT a type of active attack?
• Why was the Advanced Encryption Standard (AES) introduced?
• What is the function of a credential service provider?
• What does Triple DES use to produce a ciphertext block?
• What is the primary function of a cipher?
• Which encryption method uses plaintext and ciphertext as integers between 0 and n-1?
• What does a hash function do?
• Which procedure verifies the authenticity of messages received or stored?
• How is a random number characterized in cryptography?
• What is referred to as a countermeasure in information security?
• Which statement describes user authentication accurately?
• What does the principle of least common mechanism imply in security design?
• What process involves creating an association between a user and their biometric characteristics?
• What does repudiation refer to in communications?
• In an authentication transaction, what does the verifier validate besides possession of a token?
• Which of the following best describes the term integrity in information security?
• What do we analyze when we assess security vulnerabilities?
• Which attack method involves guessing the password after studying the account holder?
• What is a hashed password?
• Who is a relying party in the context of credential verification?
• What are "security services" intended to do?
• In the context of key management, which is a use of public-key encryption?
• What ensures the security of a symmetric key?
• The output of a decryption process results in which of the following?
• What is the assurance that data received are exactly as sent by an authorized entity called?
• What is the outcome of a denial of service attack?
• Which attack method involves a legitimate request being sent more than once to forge actions?
• What is inference in information security?
• Which type of database provides statistical information such as counts and averages?
• In symmetric encryption, what is used predominantly to ensure confidentiality?
• Which of the following is a principal threat to password secrecy?
• What characteristic of a system guarantees that data is only accessible to authorized individuals?
• Which type of attack is characterized by overwhelming a system with traffic to disrupt services?
• What is the first step in implementing security services and mechanisms?
• True or False: Computer security encompasses the protection of integrity, availability, and confidentiality of information system resources.
• Which attack is characterized by an entity illegitimately posing as another entity?
• What unique feature does retinal pattern recognition utilize for identification?
• What does it mean if a hash function is preimage resistant?
• Which component is essential for confirming the possession and control of a token by a claimant?
• Which of the following is NOT a benefit of using Electronic Funds Transfer (EFT)?
• What is the main focus of data integrity in the context of information security?
• What is the primary purpose of a secure hash function?
• A memory card is primarily characterized by what feature?
• What is the purpose of an audit in the context of information security?
• Which benefit does EFT provide to businesses?
• Which of the following is a common use of EFT in everyday financial operations?
• What is the fourth complementary course of action in security implementation?
• Which of the following accurately describes a public key?
• An institution that issues debit cards and is responsible for cardholder accounts is referred to as what?
• Which of the following prevents or inhibits the normal use or management of communication facilities?
• In encryption, what is required for verification in a hashing process?
• What typically governs how a cipher replaces data?
• What does the transport layer in the TCP/IP protocol stack handle?
• What does effective user authentication help protect confidential information from?
• How does a digital signature confirm the integrity of a message?
• Which type of attack specifically aims to gather information without altering system resources?
• Which security measure would likely have an assurance that works as intended?
• As the importance of a service increases, what happens to the level of availability required?
• Which of the following best describes the relationship between a public and private key in public-key encryption?
• What is the main focus of cryptography?
• What does RSA stand for in cryptographic terms?
• Which term describes the unauthorized disclosure of information?
• Data confidentiality refers to which of the following?
• What is the main advantage of a stream cipher?
• What does elliptic curve cryptography rely on?
• What is one common technique used to protect a password file?
• What is a digital signature?
• Which statement is true regarding passwords in authentication?
• What are modes of operation in symmetric encryption designed to do?
• What type of attack seeks to repeat an authorized service?
• What does exposure refer to in the context of information security?
• Which of the following best describes confidentiality in information security?
• What is the primary function of the Internet Protocol (IP)?
• Which statement about symmetric encryption is true?
• In the context of security, a passive attack is defined as what?
• What does message digest refer to in information security?
• What occurs if an opponent discovers the key used in symmetric encryption?
• What is the purpose of a contingency plan in information security?
• How does RFC 4949 define user authentication?
• What is the step that involves presenting or generating authentication information to verify identity?
• When considering least privilege, what is the goal for access permissions?
• What security principle emphasizes the need for a simple and small design?
• What does the evaluation process in information security involve?
• The output of an encryption algorithm is referred to as what?
• What does non-repudiation provide to the sender and the recipient of information?
• What is a popular password attack strategy?
• What type of biometric does not involve a time component?
• What is the purpose of a session key in encryption?
• What is meant by "compromise" in information security?
• What is a technique that allows a symmetric block cipher to process data streams of any length?