CSI Information Security Basics 2 — Questions and Answers
Question 1: Which of the following best describes the principle of least privilege in information security?
- Users are given access to all systems by default and restrictions are added later
- Users are granted only the minimum access rights necessary to perform their job functions (Correct answer)
- Privileges are shared equally among all employees regardless of role
- Administrative accounts are used for all daily operations to improve efficiency
Correct answer: Users are granted only the minimum access rights necessary to perform their job functions
The principle of least privilege limits user access rights to only what is strictly required for their role, reducing the attack surface.
Question 2: A security investigator discovers that an employee copied sensitive files to a personal USB drive before resigning. This is an example of which type of threat?
- Advanced Persistent Threat (APT)
- Zero-day exploit
- Insider threat (Correct answer)
- Man-in-the-middle attack
Correct answer: Insider threat
An insider threat involves a current or former employee misusing authorized access to harm the organization.
Question 3: What does 'data at rest' refer to in the context of information security?
- Data being transmitted across a network
- Data stored on devices such as hard drives or databases (Correct answer)
- Data currently being processed by a CPU
- Data that has been deleted but not yet overwritten
Correct answer: Data stored on devices such as hard drives or databases
Data at rest refers to inactive data stored physically in any digital form, such as databases, data warehouses, or file systems.
Question 4: Which encryption standard is currently recommended by NIST for protecting sensitive government information?
- DES (Data Encryption Standard)
- 3DES (Triple DES)
- AES (Advanced Encryption Standard) (Correct answer)
- RC4 (Rivest Cipher 4)
Correct answer: AES (Advanced Encryption Standard)
AES, particularly AES-256, is the NIST-approved standard for encrypting sensitive and classified government information.
Question 5: During a security investigation, you find logs showing repeated failed login attempts followed by a successful login from an unusual location. This pattern most likely indicates:
- A software misconfiguration
- A brute force attack that eventually succeeded (Correct answer)
- Normal user behavior during travel
- A denial-of-service attack
Correct answer: A brute force attack that eventually succeeded
Repeated failed logins followed by success from an unusual location is a classic indicator of a brute force attack achieving account compromise.
Question 6: What is the purpose of a hash function in information security?
- To encrypt data so it can be decrypted later with a key
- To compress files for efficient storage and transmission
- To produce a fixed-size digest that verifies data integrity (Correct answer)
- To generate random encryption keys for symmetric algorithms
Correct answer: To produce a fixed-size digest that verifies data integrity
Hash functions produce a fixed-length output (digest) from input data; any change to the input produces a different hash, verifying integrity.
Question 7: Which of the following is an example of two-factor authentication (2FA)?
- Using a long, complex password with mixed characters
- Entering a password and then a one-time code sent to a mobile phone (Correct answer)
- Answering two security questions during login
- Using the same password on two separate login screens
Correct answer: Entering a password and then a one-time code sent to a mobile phone
Two-factor authentication combines something you know (password) with something you have (OTP sent to phone), adding a second verification layer.
CSI Information Security Basics 2
Which of the following best describes the principle of least privilege in information security?