CSCU Security 2 â Questions and Answers
Question 1: What is the CIA triad in information security?
- A government intelligence agency framework
- The three core principles of information security: Confidentiality, Integrity, and Availability (Correct answer)
- A type of encryption algorithm using three keys
- A network security protocol with three layers
Correct answer: The three core principles of information security: Confidentiality, Integrity, and Availability
The CIA triad represents the three fundamental pillars of information security: Confidentiality (protecting data from unauthorized access), Integrity (ensuring data accuracy), and Availability (ensuring data is accessible when needed).
The CIA triad is the foundational model of information security, encompassing three core principles that guide security policies, controls, and decisions. Confidentiality ensures that sensitive information is accessible only to authorized individualsâimplemented through encryption, access controls, and authentication. Integrity ensures that data remains accurate, complete, and unaltered except through authorized modificationsâimplemented through hashing, digital signatures, version control, and input validation. Availability ensures that information and systems are accessible to authorized users when neededâimplemented through redundancy, fault tolerance, backups, and DDoS protection. These three principles often involve tradeoffs: for example, stronger confidentiality controls (like complex authentication) may reduce availability for legitimate users. Security professionals must balance all three principles based on the organization's specific risk profile, regulatory requirements, and business needs. Every security control can be mapped to one or more CIA triad components.
Question 2: What is social engineering in cybersecurity?
- Building social media platforms
- Psychological manipulation of people to trick them into revealing confidential information or performing security-compromising actions (Correct answer)
- Engineering solutions for social problems
- A type of software development methodology
Correct answer: Psychological manipulation of people to trick them into revealing confidential information or performing security-compromising actions
Social engineering exploits human psychology rather than technical vulnerabilities, manipulating people through deception, urgency, authority, or trust into bypassing security procedures.
Social engineering is the art of manipulating people to divulge confidential information or perform actions that compromise security. Unlike technical attacks that exploit software vulnerabilities, social engineering exploits human psychologyâtrust, fear, urgency, authority, curiosity, and helpfulness. Common techniques include: pretexting (creating a fabricated scenario to extract information), baiting (leaving infected USB drives or offering enticing downloads), quid pro quo (offering something in exchange for information), tailgating (following authorized personnel into restricted areas), and vishing (voice phishing over phone). Social engineering is often the most effective attack vector because humans are generally the weakest link in securityâpeople naturally want to be helpful and tend to trust authority figures. Defense requires regular security awareness training, verification procedures for sensitive requests, a culture that encourages questioning unusual requests without fear of repercussions, and multi-step verification processes for critical actions like financial transfers or password resets.
Question 3: What is the purpose of a security audit?
- To install new security software
- To systematically evaluate an organization's security posture, identify vulnerabilities, and verify compliance with security policies and standards (Correct answer)
- To audit employee social media accounts
- To calculate the cost of security measures
Correct answer: To systematically evaluate an organization's security posture, identify vulnerabilities, and verify compliance with security policies and standards
A security audit systematically examines an organization's information systems, policies, and practices to identify vulnerabilities, verify compliance, and recommend improvements.
A security audit is a systematic, comprehensive evaluation of an organization's information security posture. It examines technical controls (firewalls, encryption, access controls), administrative controls (policies, procedures, training), and physical controls (locks, surveillance, environmental protections) against established standards and best practices. Types of security audits include: internal audits (conducted by the organization's own team), external audits (performed by independent third parties for objectivity), compliance audits (verifying adherence to specific regulations like HIPAA, PCI DSS, or GDPR), and penetration testing (simulating attacks to identify exploitable vulnerabilities). Audit outcomes include: identification of security gaps and vulnerabilities, verification of policy compliance, assessment of risk levels, recommendations for remediation, documentation for regulatory compliance, and benchmarking against industry standards. Regular security audits are essential for maintaining an effective security program, as threats evolve continuously and new vulnerabilities emerge regularly. Many regulatory frameworks mandate periodic audits.
Question 4: What is multi-factor authentication (MFA) and why is it effective?
- Using multiple passwords for the same account
- Requiring two or more different types of verification factors to prove identity, making account compromise significantly harder (Correct answer)
- Logging in from multiple devices simultaneously
- Changing your password multiple times per week
Correct answer: Requiring two or more different types of verification factors to prove identity, making account compromise significantly harder
MFA combines two or more independent authentication factorsâsomething you know, something you have, and something you areâso compromising one factor alone is insufficient for access.
Multi-factor authentication (MFA) requires users to provide two or more verification factors from different categories to authenticate their identity. The three standard categories are: something you know (passwords, PINs, security questions), something you have (smartphones, hardware tokens, smart cards), and something you are (fingerprints, facial recognition, voice patterns). MFA is highly effective because an attacker must compromise multiple independent factors simultaneously. If a password is stolen through phishing, the attacker still needs the physical device or biometric. Factor independence is crucialâtwo passwords (both 'something you know') do not constitute true MFA. Common MFA implementations include: authenticator apps (TOTP codes), hardware security keys (FIDO2/WebAuthn), push notifications, SMS codes (least secure due to SIM-swapping), and biometric verification. Microsoft reports that MFA blocks 99.9% of automated account compromise attacks. Organizations should implement MFA for all accounts, prioritizing email, financial systems, VPN access, and administrative accounts.
Question 5: What is a zero-day vulnerability?
- A vulnerability that was fixed on the same day it was discovered
- A previously unknown software vulnerability that is exploited by attackers before the vendor has developed a patch (Correct answer)
- A vulnerability that has existed for zero days
- A virus that can only operate for one day
Correct answer: A previously unknown software vulnerability that is exploited by attackers before the vendor has developed a patch
A zero-day vulnerability is an unknown software flaw that attackers discover and exploit before the software vendor is aware of it or has released a fix, leaving zero days for users to protect themselves.
A zero-day vulnerability is a software security flaw that is unknown to the vendor and for which no patch or fix exists at the time of exploitation. The term 'zero-day' refers to the fact that the vendor has had zero days to address the vulnerability when it is first exploited. The timeline typically involves: a vulnerability exists in software (potentially for years), an attacker discovers the vulnerability, the attacker creates an exploit (zero-day exploit) and uses it in attacks, the attacks are eventually detected and the vulnerability reported, and the vendor develops and releases a patch. During the window between exploitation and patching, all users of the affected software are vulnerable. Zero-day vulnerabilities are extremely valuableâthey sell for hundreds of thousands to millions of dollars on black markets and are used by nation-state actors, criminal organizations, and surveillance companies. Defense strategies include defense-in-depth (multiple security layers), behavior-based detection, exploit mitigation technologies (ASLR, DEP), application whitelisting, and rapid incident response capabilities.
Question 6: What is the role of encryption in protecting data?
- Encryption makes data transfer faster
- Encryption converts readable data into an unreadable format that can only be deciphered with the correct key, protecting confidentiality (Correct answer)
- Encryption compresses data to save storage space
- Encryption prevents data from being created
Correct answer: Encryption converts readable data into an unreadable format that can only be deciphered with the correct key, protecting confidentiality
Encryption transforms plaintext data into ciphertext using mathematical algorithms and keys, ensuring that even if data is intercepted or stolen, it remains unreadable without the decryption key.
Encryption is a fundamental data protection mechanism that uses mathematical algorithms to transform readable data (plaintext) into an unreadable format (ciphertext). Only someone possessing the correct decryption key can reverse the process and access the original data. Encryption protects data in multiple states: at rest (stored on diskâfull disk encryption, file encryption, database encryption), in transit (moving across networksâTLS/SSL, VPN, encrypted email), and in use (being processedâemerging technologies like homomorphic encryption and secure enclaves). Two main types exist: symmetric encryption (AES, same key for encryption and decryption, faster, used for bulk data) and asymmetric encryption (RSA, ECC, public-private key pairs, used for key exchange and digital signatures). Encryption is essential for regulatory compliance (GDPR, HIPAA, PCI DSS), protecting sensitive communications, securing cloud data, and ensuring that physical theft of devices does not lead to data exposure. Key managementâsecurely generating, distributing, storing, and rotating encryption keysâis equally critical.
CSCU Security 2
What is the CIA triad in information security?