English
Menu

Information Security Basics

Learn information security with multiple-choice questions: the CIA triad and risk, symmetric-key and public-key cryptography, hash functions and digital signatures, authentication and multi-factor authentication, access control, malware and phishing, web attacks such as SQL injection and XSS, and backups and incident response.

Practice 10 questionsRandom questions from this topic · about 5 minutes Practice this topicAll questions in this topic, in random order Weak questionsRetry only the questions you last got wrong

Password brute-force time →

CVSS calculator →

Information Security Basics: key points

Protecting information means keeping it in a state where only authorized people can see it (confidentiality), its contents stay correct (integrity) and it can be used when needed (availability). To achieve this, technologies such as encryption, hash functions and digital signatures are combined with authentication, access control, backups and organizational management.

This topic covers threats, vulnerabilities and risk and how to respond to risk, when to use symmetric-key or public-key cryptography and how to calculate the number of keys, hash functions and password storage, digital signatures and certificates, multi-factor authentication and the error rates of biometrics, and the principle of least privilege. It also explains malware, phishing and web attacks such as SQL injection and cross-site scripting in terms of how they work and how to defend against them, which helps with the security section of IT certification exams such as Japan's Fundamental and Applied Information Technology Engineer Examinations. Hardware-related security is covered in the Hardware Security topic.

All Information Security Basics questions (40)
  1. A company's business system received a flood of requests and stopped responding, so users could not use it when they needed to. Which of the three elements of information security (confidentiality, integrity, availability) was mainly compromised?
  2. When thinking about information security risk, which of the following is a vulnerability rather than a threat?
  3. To prepare for damages that might have to be paid after a data breach, a company took out cyber insurance. Which risk response is this?
  4. For an information system, it is estimated that an incident causing a loss of 20 million yen each time occurs 0.1 times per year. A countermeasure costing 0.5 million yen per year would reduce the frequency to 0.02 times per year. What is the net annual benefit of this countermeasure (the reduction in expected loss minus the cost of the countermeasure)?
  5. When an ISMS (information security management system) is run using the PDCA cycle, which activity belongs to the Check stage?
  6. Which statement correctly describes symmetric-key cryptography?
  7. Using public-key cryptography, A wants to encrypt a message so that only B can read it. Which key is used for the encryption?
  8. Fifty members want every pair of them to be able to communicate with encryption without the other members learning the contents. Which combination gives the number of keys needed with symmetric-key cryptography and with public-key cryptography (counting public and private keys together)?
  9. When sending a large file encrypted to someone, which procedure describes the commonly used hybrid encryption scheme?
  10. Which statement correctly describes a property of hash functions used in cryptography (cryptographic hash functions)?
  11. For an ideal hash function with a 256-bit output, which combination gives the approximate number of computations needed for a brute-force attack in two cases: finding an input that produces a given hash value (a preimage attack), and finding any two different inputs that produce the same hash value (a collision attack)?
  12. When a web service stores users' passwords, it adds a random value that differs for each user (a salt) to the password before computing and storing the hash value. What is the main purpose of the salt?
  13. For storing passwords, it is recommended not to use a fast hash function such as SHA-256 directly but a scheme deliberately designed to take time to compute, such as bcrypt or Argon2. Why?
  14. An 8-character password is searched for by brute force, trying every candidate. If 1×10^10 candidates can be tried per second, which combination is closest to the time needed to try all candidates for a password made only of lowercase letters (26 kinds) and one made of uppercase letters, lowercase letters and digits (62 kinds)?
  15. A attaches a digital signature to a document sent to B. Which combination correctly gives the keys used to create and verify the signature and what the digital signature can confirm?
  16. Which statement correctly compares a message authentication code (MAC) with a digital signature?
  17. It has been discovered that the private key corresponding to a web server's server certificate may have been leaked. The certificate has not yet expired. What is the most appropriate action for the operator?
  18. Of the three factors of authentication used to verify a user (knowledge, possession and inherence), which one applies to authentication with an employee ID smart card?
  19. Which of the following authentication methods is multi-factor authentication?
  20. In fingerprint-based biometric authentication, the threshold on the matching score required to accept a user as genuine is made stricter (higher). Which change generally occurs?
  21. A face recognition device can be set to one of three thresholds, A, B and C, with a false acceptance rate (FAR) and false rejection rate (FRR) of 1% and 0.5% for A, 0.1% and 2% for B, and 0.01% and 8% for C. For controlling entry to a laboratory, the requirement is a FAR of 0.1% or less, and within that, legitimate users should be rejected as rarely as possible. Which threshold should be chosen?
  22. Which statement correctly describes single sign-on (SSO)?
  23. Which practice follows the principle of least privilege?
  24. A company with thousands of employees manages permissions with role-based access control (RBAC). Which statement describes the idea of RBAC?
  25. Among the types of malware, which statement correctly describes a worm?
  26. Which statement correctly describes ransomware?
  27. Regarding backups as a defense against ransomware, which method best follows the "3-2-1 rule"?
  28. Which combination correctly gives the phishing technique and a countermeasure on the user's side?
  29. Which of the following is an example of social engineering?
  30. An email claiming to be from a contact at a business partner says, "Our account for receiving payments has changed, so please pay this invoice and future ones to the new account." When business email compromise (BEC) is suspected, what is the most appropriate response?
  31. In a web application, entering a string such as ' OR '1'='1 in the password field of the login screen lets someone log in without knowing the password. What is this attack called?
  32. As a countermeasure against SQL injection, why are prepared statements with placeholders (parameterized queries) considered more fundamental than removing dangerous characters from the input?
  33. A bulletin-board web application had a vulnerability in which scripts contained in text posted by users were executed in other visitors' browsers. Which combination correctly gives the name of this vulnerability and its fundamental countermeasure?
  34. A web application has a vulnerability in which, if a logged-in user opens a trap page prepared by an attacker, the user's browser sends requests to the legitimate site that the user did not intend, such as transferring money or changing settings. Which is an appropriate countermeasure?
  35. A web application reads and displays a file by joining a file name given in a URL parameter to the name of its public folder. If a value containing ../ is given as the file name, configuration files and other files outside the public folder can be read. Which combination correctly gives the name of this attack and a countermeasure?
  36. If a web application keeps using the same session ID before and after login, an attacker may get the user to use a session ID the attacker prepared in advance and then, after the user logs in, impersonate the user with that ID. What is the most appropriate countermeasure against this attack?
  37. Which statement correctly describes a DDoS attack?
  38. Which statement correctly describes a zero-day attack?
  39. Which combination correctly describes CVE and CVSS, used in vulnerability management?
  40. On an employee's PC, file extensions start changing one after another and a screen demanding a ransom appears. What is the most appropriate first action for this employee?

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Other topics in Computer systems