BSCS Computer Security and Cybersecurity 2 — Questions and Answers
Question 1: What is a SQL injection attack?
- An attack that physically damages SQL server hardware
- An attack that inserts malicious SQL code into input fields to manipulate a database (Correct answer)
- An attack that denies legitimate users access to a SQL database
- An attack that encrypts SQL database files and demands ransom
Correct answer: An attack that inserts malicious SQL code into input fields to manipulate a database
SQL injection exploits unsanitized input fields by embedding malicious SQL statements that manipulate, expose, or destroy database contents when executed by the server.
Question 2: In public key (asymmetric) cryptography, which key must be kept confidential?
- The public key
- Both the public and private keys
- The private key (Correct answer)
- Neither key — both are publicly distributed
Correct answer: The private key
In asymmetric cryptography, the private key must remain secret while the public key can be freely shared; security depends entirely on the private key's secrecy.
Question 3: What is a firewall's primary function in network security?
- To encrypt all network traffic between endpoints
- To monitor and control incoming and outgoing network traffic based on predefined security rules (Correct answer)
- To scan files for malware before they are downloaded
- To authenticate users attempting to access network resources
Correct answer: To monitor and control incoming and outgoing network traffic based on predefined security rules
A firewall enforces security policies by filtering network traffic according to rules, acting as a gatekeeper between trusted internal networks and untrusted external networks.
Question 4: Which of the following best describes a rainbow table attack?
- A brute-force attack that tries every possible password sequentially
- An attack using precomputed hash-to-password mappings to efficiently crack stored password hashes (Correct answer)
- An attack that eavesdrops on network traffic to capture password hashes
- A social engineering attack that tricks users into revealing passwords
Correct answer: An attack using precomputed hash-to-password mappings to efficiently crack stored password hashes
A rainbow table attack uses precomputed tables mapping plaintext passwords to their hash values, allowing rapid lookup of a hash's corresponding password without on-the-fly computation.
Question 5: What is the purpose of adding a salt to passwords before hashing?
- To encrypt passwords using a secret key before storage
- To prepend a unique random value so identical passwords produce different hashes, defeating precomputed attacks (Correct answer)
- To compress passwords for more efficient storage
- To obfuscate passwords during transmission over the network
Correct answer: To prepend a unique random value so identical passwords produce different hashes, defeating precomputed attacks
Salting appends or prepends a unique random value to each password before hashing, ensuring identical passwords yield different hashes and rendering rainbow tables ineffective.
Question 6: What type of malware disguises itself as legitimate software while secretly performing malicious actions in the background?
- Worm
- Virus
- Trojan Horse (Correct answer)
- Spyware
Correct answer: Trojan Horse
A Trojan Horse appears to be useful or legitimate software but conceals malicious functionality, tricking users into installing it voluntarily.
Question 7: Which protocol allows two parties to establish a shared cryptographic secret over an insecure channel without transmitting the secret itself?
- RSA
- Diffie-Hellman key exchange (Correct answer)
- AES
- MD5
Correct answer: Diffie-Hellman key exchange
The Diffie-Hellman key exchange enables two parties to compute the same shared secret using public values and their own private values, without ever sending the secret across the channel.
BSCS Computer Security and Cybersecurity 2
What is a SQL injection attack?