BSCS Computer Security and Cybersecurity 3

Question 1

What is Cross-Site Scripting (XSS)?

Accepted Answer

An attack where malicious client-side scripts are injected into web pages viewed by other users

Answer

An attack that forges HTTP requests on behalf of an authenticated user

Answer

An attack that hijacks an active authenticated session

Answer

An attack that exploits trust relationships between different web domains

Question 2

What does the principle of least privilege state?

Accepted Answer

Users should be granted only the minimum access rights necessary to perform their assigned job functions

Answer

Users should have the broadest access needed to handle any conceivable task

Answer

All employees in an organization should have identical access rights for fairness

Answer

Administrative privileges should always be shared among multiple users

Question 3

Which of the following is a valid example of true two-factor authentication (2FA)?

Accepted Answer

Using a password (something you know) combined with a fingerprint scan (something you are)

Answer

Using a long, complex password with special characters

Answer

Using two different passwords entered sequentially

Answer

Using a username and a security question

Question 4

What is the role of a Certificate Authority (CA) in a Public Key Infrastructure (PKI)?

Accepted Answer

A trusted third party that issues, signs, and manages digital certificates to vouch for identity

Answer

A hardware security module that physically stores private encryption keys

Answer

A network protocol that facilitates secure key exchange between endpoints

Answer

A type of firewall that validates SSL/TLS certificates in real time

Question 5

Which attack exploits human psychology rather than technical vulnerabilities to gain unauthorized access to systems or information?

Accepted Answer

Social engineering

Answer

Brute force attack

Answer

Dictionary attack

Answer

Zero-day exploit

Question 6

What is a zero-day vulnerability?

Accepted Answer

A software flaw that is unknown to the vendor with no available patch, giving defenders zero days to respond

Answer

A vulnerability that has been publicly disclosed for less than 24 hours

Answer

A vulnerability that is automatically patched immediately upon discovery

Answer

A type of exploit that executes in under one second

Question 7

What does an Intrusion Detection System (IDS) primarily do?

Accepted Answer

Monitors network traffic and system activity for suspicious patterns and generates alerts for administrators

Answer

Actively blocks unauthorized traffic by resetting malicious connections

Answer

Encrypts all inbound and outbound network traffic

Answer

Manages user authentication and authorization across the network