APCSP Cybersecurity 2 — Questions and Answers
Question 1: A website uses HTTPS instead of HTTP. What does this primarily protect against?
- Faster page load times
- Eavesdropping on data in transit (Correct answer)
- Preventing all malware downloads
- Blocking unauthorized logins
Correct answer: Eavesdropping on data in transit
HTTPS encrypts data between the browser and server, preventing eavesdroppers from reading transmitted information.
Question 2: Which type of attack tricks a user into clicking a disguised link that performs an unintended action on a site where the user is authenticated?
- SQL injection
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF) (Correct answer)
- Phishing
Correct answer: Cross-site request forgery (CSRF)
CSRF exploits the trust a website has in a logged-in user's browser by forging authenticated requests.
Question 3: What is the purpose of a digital certificate in secure communications?
- To compress data for faster transmission
- To verify the identity of a server or entity (Correct answer)
- To store user passwords securely
- To detect malware in downloaded files
Correct answer: To verify the identity of a server or entity
Digital certificates bind a public key to an identity, allowing users to verify they are communicating with the intended server.
Question 4: A company stores passwords as plain text in its database. Why is this a critical security flaw?
- Plain text takes more storage space
- A database breach exposes all passwords immediately (Correct answer)
- Plain text passwords cannot be compared during login
- It violates data compression standards
Correct answer: A database breach exposes all passwords immediately
Plain text storage means any breach instantly reveals all user passwords, unlike hashed storage which requires additional cracking effort.
Question 5: Which of the following best describes the principle of 'defense in depth'?
- Using the strongest single security tool available
- Encrypting only the most sensitive data
- Layering multiple security controls so one failure doesn't compromise the whole system (Correct answer)
- Isolating all systems from the internet
Correct answer: Layering multiple security controls so one failure doesn't compromise the whole system
Defense in depth uses multiple overlapping layers of security so that if one layer fails, others still protect the system.
Question 6: What distinguishes a worm from a traditional computer virus?
- Worms only affect mobile devices
- Worms self-replicate and spread across networks without user action (Correct answer)
- Worms encrypt files for ransom
- Worms require physical access to spread
Correct answer: Worms self-replicate and spread across networks without user action
Unlike viruses that need a host file and user interaction, worms autonomously replicate and spread across networks.
Question 7: An attacker sends millions of requests to a web server until it crashes. This is an example of which attack?
- Man-in-the-middle attack
- Denial-of-service (DoS) attack (Correct answer)
- Brute-force attack
- Replay attack
Correct answer: Denial-of-service (DoS) attack
A DoS attack overwhelms a server with traffic to exhaust its resources and make it unavailable to legitimate users.
APCSP Cybersecurity 2
A website uses HTTPS instead of HTTP.
What does this primarily protect against?