IT & Computer Studies — YGC2 Network and Security Foundations Version 1
Answer: A
A university interconnects multiple buildings using fiber-optic cabling, indicating a campus area network (CAN).
A campus area network (CAN) is specifically designed to connect multiple buildings within a limited geographical area, such as a university campus, using high-speed connections like fiber-optic cabling.
A) CAN (campus area network)
This option is correct because a CAN is tailored for linking several buildings in close proximity, making it ideal for university settings where multiple facilities are interconnected.
B) WAN (wide area network)
A wide area network (WAN) covers a much larger geographic area than a campus area network, often connecting distant locations across cities or countries. Since the question specifies multiple buildings on a campus, a WAN is not applicable here.
C) SAN (storage area network)
A storage area network (SAN) is used to provide access to consolidated block-level storage, primarily for data storage and management. It does not relate to the interconnection of buildings and, therefore, is not relevant to the context of the question.
D) MAN (metropolitan area network)
While a metropolitan area network (MAN) connects networks over a city or a large campus area, it generally spans a broader area than a CAN. Since the scenario specifically describes a university campus, a CAN is the more appropriate choice.
Conclusion
The correct answer is A) CAN because it accurately reflects the network type used to interconnect multiple buildings within a university. Options B, C, and D do not align with the specific context of connecting buildings on a campus, highlighting why they are incorrect in this scenario.
2. Which team is responsible for performing this offensive testing?
Answer: B
The Red team is responsible for performing this offensive testing.
The Red team carries out offensive testing, which involves simulating attacks to identify vulnerabilities within systems and applications. Their role is crucial for understanding potential threats and enhancing security measures.
A) Purple team
The Purple team is a hybrid group that combines the efforts of both Red and Blue teams to improve security posture through collaboration. While they play an important role in the testing process, they do not specifically conduct offensive testing on their own.
B) Red team
The Red team is specifically tasked with offensive testing. They simulate real-world attacks to assess the security of an organization’s defenses, making them the correct choice for this question.
C) White team
The White team typically oversees and manages the activities of both Red and Blue teams during exercises and assessments. Their focus is not on offensive testing but rather on ensuring that the testing is conducted fairly and within established guidelines.
D) Blue team
The Blue team is responsible for defending against attacks and monitoring security systems. Their role is defensive, focusing on detecting and responding to threats, rather than conducting offensive testing.
Conclusion
The Red team is definitively the group responsible for offensive testing, as their primary function is to emulate attackers to uncover vulnerabilities. In contrast, the other teams, including the Purple, White, and Blue teams, serve supportive or defensive roles, which do not involve direct offensive testing activities.
3. Which security principle does this approach align with?
Answer: B
This approach aligns with the principle of Complete mediation.
Complete mediation ensures that all access to resources is controlled and verified, allowing for consistent security checks every time a resource is accessed.
A) Psychological acceptability
Psychological acceptability focuses on ensuring that security mechanisms are designed in a way that is easy for users to understand and use. While important, it does not directly relate to the concept of ensuring that all access is mediated by security checks, which is the essence of complete mediation.
B) Complete mediation
Complete mediation is the correct principle as it emphasizes the necessity for all access attempts to be checked against security policies before granting access to resources. This approach prevents unauthorized access by ensuring that every access request is verified, aligning perfectly with the definition of complete mediation.
C) Open design
Open design refers to the principle that security mechanisms should not be secret, allowing for public scrutiny and collaboration to identify vulnerabilities. While open design contributes to overall security, it does not specifically address the requirement for thorough verification of access, which is characteristic of complete mediation.
D) Separation of duties
Separation of duties is a security principle aimed at preventing fraud and error by dividing responsibilities among different individuals. Although it is a crucial aspect of security, it does not relate to the systematic verification of access that complete mediation mandates.
Conclusion
The principle that aligns with the approach described is complete mediation, as it requires that every access to a resource be controlled and verified against security policies. Other options, while relevant to security in various contexts, do not encapsulate the necessity for all access to be mediated by security checks in the same way. Thus, option B is clearly the most appropriate choice.
4. Which method provides the strongest wireless security?
Answer: D
Using WPA3 encryption provides the strongest wireless security.
WPA3 encryption is the most advanced security protocol currently available for wireless networks, offering enhanced protection against unauthorized access and improved encryption methods.
A) Using WEP encryption
WEP (Wired Equivalent Privacy) is an outdated security protocol that is easily compromised, making it one of the weakest options for wireless security. Its vulnerabilities are well-documented, and it does not provide adequate protection for modern networks.
B) Hiding the SSID to make the network less visible
While hiding the SSID can provide a minor layer of obscurity, it does not effectively enhance the security of a wireless network. This method can be circumvented relatively easily, and it does not address the fundamental vulnerabilities that exist in older encryption protocols.
C) Using WPA2 with a very long passphrase
Using WPA2 with a long passphrase is certainly more secure than WEP or hiding the SSID, but it is still not as robust as WPA3. WPA2 is susceptible to certain attacks, such as the KRACK vulnerability, whereas WPA3 offers improved defenses against such threats.
D) Using WPA3 encryption
WPA3 encryption is designed to provide stronger security features, including better encryption algorithms and protections against brute-force attacks. It addresses the shortcomings of previous protocols like WPA2 and is the recommended choice for securing wireless networks today.
Conclusion
WPA3 encryption stands out as the most secure method for wireless networks due to its advanced features and protections against modern threats. In contrast, the other options either rely on outdated technology or do not provide adequate security measures, making them less effective in safeguarding wireless communications.
5. Which type of encryption should be used?
Answer: C
Asymmetric encryption should be used.
Asymmetric encryption is the recommended type of encryption for scenarios where secure key exchange is necessary. This method utilizes a pair of keys, a public key for encryption and a private key for decryption, enhancing security in communication.
A) VPN
VPN, or Virtual Private Network, is not a type of encryption but rather a technology that creates a secure connection over the internet. While it can use encryption protocols, it is not inherently an encryption method itself and thus does not fit the requirement of the question.
B) IPSec
IPSec is a protocol suite for securing internet protocol communications through encryption and authentication. While it is effective for securing data in transit, it is not classified as a type of encryption like asymmetric encryption, making it less suitable for the specific context of the question.
C) Asymmetric
Asymmetric encryption is specifically designed for secure key exchanges and is the most appropriate option for scenarios requiring secure communication. It allows users to encrypt messages without the need to share a secret key, thus providing a strong security model.
D) Hashing
Hashing is a process used to convert data into a fixed-size string of characters, which is typically used for data integrity checks rather than encryption. It does not provide confidentiality since it is a one-way function, making it unsuitable for the purpose of encryption outlined in the question.
Conclusion
Asymmetric encryption is the definitive choice due to its ability to facilitate secure data exchange without the need for a shared secret. In contrast, VPN, IPSec, and hashing either do not represent encryption methods or serve different purposes, thus failing to meet the specific requirements of the question.
Answer: C
DNS functions at the Application layer of the OSI model.
DNS operates at the Application layer, which is responsible for providing network services directly to end-user applications. It facilitates the translation of human-readable domain names to machine-readable IP addresses.
A) Network layer
The Network layer is primarily concerned with the routing of data packets between devices across multiple networks. While it plays a crucial role in establishing the path data takes, it does not handle the translation of domain names, which is the primary function of DNS.
B) Presentation layer
The Presentation layer is responsible for data translation, encryption, and compression, preparing data for the Application layer. However, it does not perform any functions related to DNS, which is focused on resolving domain names to IP addresses.
C) Application layer
The Application layer is where DNS operates, as it directly interacts with user applications to provide network services. This layer enables users to utilize domain names without needing to understand the underlying IP addresses, highlighting its essential role in internet navigation.
D) Session layer
The Session layer manages sessions between applications, establishing and maintaining connections. While it is vital for communication between applications, it does not involve the name resolution process that DNS performs.
Conclusion
The correct answer is C, as DNS operates at the Application layer, providing essential services for name resolution that facilitate user access to websites. Options A, B, and D fail to capture the specific function of DNS, which is not related to routing, data formatting, or session management, further confirming that the Application layer is the appropriate context for DNS operations.
7. Which type of attack does this describe?
Answer: D
Social engineering is the type of attack described.
Social engineering involves manipulating individuals into divulging confidential information or performing actions that compromise security. This type of attack preys on human psychology rather than technical vulnerabilities.
A) Brute-force attack
A brute-force attack involves systematically trying all possible combinations to crack a password or encryption key. This method relies on computing power rather than psychological manipulation, making it distinct from social engineering.
B) Phishing attack
A phishing attack typically involves deceitful emails or websites designed to trick individuals into revealing sensitive information. While related to manipulation, phishing is more focused on deception through technology rather than direct interpersonal influence, as seen in social engineering.
C) SQL injection attack
An SQL injection attack exploits vulnerabilities in a web application's database by inserting malicious SQL code. This type of attack is technical in nature and does not involve human manipulation, thus differing from the tactics used in social engineering.
D) Social engineering
Social engineering specifically targets human interaction to gain confidential information or access. Techniques may include impersonation or psychological tricks, which are the hallmark of this attack type. Therefore, it accurately reflects the description provided.
Conclusion
The correct answer, social engineering, is characterized by its focus on human interaction to exploit vulnerabilities. In contrast, the other options represent various technical or indirect attack methods that do not primarily manipulate individuals. Understanding these differences is crucial for recognizing and defending against various cybersecurity threats.
8. What should this organization expect to be required to do under this legislation?
Answer: A
Securely dispose of personal identifiable information
Organizations are required under this legislation to implement measures for the secure disposal of personal identifiable information to ensure that individuals' privacy is respected and protected.
A) Securely dispose of personal identifiable information
This option is correct as it directly aligns with the legislative requirements for organizations to handle personal data responsibly. Secure disposal is essential to prevent unauthorized access and identity theft, which the legislation aims to mitigate.
B) Compensate individuals for revenue from the sale of their information
This option is incorrect because the legislation does not mandate organizations to compensate individuals for any revenue generated from the sale of their information. Instead, it focuses on the protection and proper handling of personal data rather than financial compensation.
C) Disclose the software used to protect personal data
This option is incorrect, as the legislation does not require organizations to disclose the specific software they use for data protection. The emphasis is on the secure management of personal data rather than transparency about the tools used.
D) Notify individuals each time their personal information is viewed
This option is also incorrect because the legislation does not necessitate that organizations notify individuals every time their personal information is accessed. Such a requirement would be impractical and burdensome, diverting focus from comprehensive data protection strategies.
Conclusion
The correct answer, securely disposing of personal identifiable information, is vital for compliance with the legislation aimed at safeguarding individual privacy. The other options fail to align with the core objectives of the legislation, which emphasize data security and the responsible handling of personal information rather than financial compensation or operational transparency.
9. Which AAA category does this apply to?
Answer: B
This applies to the Authentication category.
Authentication is the process of verifying the identity of a user or system, which is crucial in establishing secure access to resources.
A) Accounting
Accounting pertains to the systematic recording and reporting of financial transactions. While it is essential in financial management, it does not relate to the verification of identity or access control, making this option incorrect.
B) Authentication
Authentication is indeed the correct choice as it directly involves the methods used to confirm a user's identity before granting access to systems or data. This process is fundamental in security protocols and information technology.
C) Auditing
Auditing refers to the examination and evaluation of financial records or systems to ensure accuracy and compliance. It focuses on reviewing and verifying existing practices rather than the process of verifying identities, thus rendering this option incorrect.
D) Authorization
Authorization is the process that determines what an authenticated user is allowed to do. Although it is closely related to authentication, it follows after the identity has been confirmed, making it distinct and incorrect in this context.
Conclusion
Authentication is the category that specifically deals with identity verification, making it the definitive answer. The other options, while relevant in the broader context of security and compliance, do not pertain directly to the process of confirming user identity, which is the focus of the question.
Answer: B
The medical records system represents an Asset in terms of cybersecurity.
In the context of cybersecurity, the electronic medical records system is considered an Asset because it contains valuable patient information that the hospital relies on for its operations and patient care.
A) Risk
Risk refers to the potential for loss or harm related to an asset. While the medical records system carries risk due to possible data breaches, it is not categorized as a risk itself but rather as a valuable asset that is subject to risk.
B) Asset
The medical records system is indeed an Asset because it holds critical patient data necessary for healthcare delivery. In cybersecurity, protecting this asset is vital to maintaining the confidentiality, integrity, and availability of sensitive patient information.
C) Threat
A threat refers to any circumstance or event with the potential to cause harm to an asset. The medical records system is not a threat; instead, it is the target that could be harmed by various threats, such as cyberattacks or unauthorized access.
D) Vulnerability
Vulnerability refers to a weakness in a system that could be exploited by a threat to cause harm. The medical records system itself is not a vulnerability; rather, it may have vulnerabilities that need to be addressed to protect the asset effectively.
Conclusion
The medical records system is classified as an Asset in the realm of cybersecurity due to its importance in storing sensitive patient information. While it is associated with risks, threats, and potential vulnerabilities, it fundamentally serves as a critical resource that requires protection. Understanding this classification is essential for implementing effective cybersecurity measures.