CSI Information Security Basics 3 — Questions and Answers
Question 1: In information security, what does 'non-repudiation' mean?
- Ensuring that data cannot be accessed by unauthorized users
- Preventing a party from denying that they sent or received a message (Correct answer)
- Encrypting communications so they cannot be intercepted
- Backing up data to ensure it can be recovered after a loss
Correct answer: Preventing a party from denying that they sent or received a message
Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message, often achieved through digital signatures.
Question 2: A CSI investigator is reviewing chain of custody for digital evidence. Why is maintaining chain of custody critical?
- It speeds up the investigation process significantly
- It ensures evidence admissibility by documenting who handled it and when (Correct answer)
- It allows investigators to modify evidence for clarity
- It eliminates the need for witness testimony in court
Correct answer: It ensures evidence admissibility by documenting who handled it and when
Chain of custody documents every person who handled evidence and when, ensuring its integrity and admissibility in legal proceedings.
Question 3: Which of the following best describes social engineering in the context of information security?
- Using technical exploits to compromise network infrastructure
- Manipulating people psychologically to divulge confidential information (Correct answer)
- Installing malware through compromised software updates
- Intercepting unencrypted network traffic to steal credentials
Correct answer: Manipulating people psychologically to divulge confidential information
Social engineering exploits human psychology rather than technical vulnerabilities to trick individuals into revealing sensitive information or taking harmful actions.
Question 4: What is a vulnerability assessment?
- An active attempt to exploit weaknesses in a system to test defenses
- A systematic review of security weaknesses in an information system (Correct answer)
- A legal document authorizing a security audit of a third party
- A record of all known security incidents in the past 12 months
Correct answer: A systematic review of security weaknesses in an information system
A vulnerability assessment systematically identifies, quantifies, and prioritizes security weaknesses in systems without actively exploiting them.
Question 5: During an investigation, an analyst finds that an attacker used SQL injection. Which security principle was most directly violated?
- Availability
- Input validation and secure coding practices (Correct answer)
- Physical security controls
- Data classification policies
Correct answer: Input validation and secure coding practices
SQL injection exploits failures in input validation and secure coding, where user-supplied data is incorrectly trusted and passed to a database interpreter.
Question 6: Which of the following is the primary purpose of an Intrusion Detection System (IDS)?
- To block unauthorized access attempts in real time
- To monitor network traffic and alert on suspicious activity (Correct answer)
- To encrypt data transmitted across the network
- To manage user authentication and access control
Correct answer: To monitor network traffic and alert on suspicious activity
An IDS monitors network traffic or system activity and generates alerts when it detects suspicious patterns, but does not actively block threats like an IPS does.
Question 7: What is 'defense in depth' as applied to information security?
- Focusing all security resources on protecting the network perimeter
- Implementing multiple overlapping layers of security controls (Correct answer)
- Using the deepest level of encryption available for all data
- Training defenders to use offensive security techniques
Correct answer: Implementing multiple overlapping layers of security controls
Defense in depth employs multiple security layers so that if one control fails, others remain in place to protect assets.
CSI Information Security Basics 3
In information security, what does 'non-repudiation' mean?