Question: Discuss any negative effects of using Chromium an Nickel metals in stainless steel cooking kits (apparatus) on human health
Solution:
It is a strong reducing agent and reduces both aldehyde and ketch into alcohol. As only 1 equation of PhmgRrFs product, rather it will attack the more electrophilic center which is aldehyde rather than ketone.
Question: Determine the truth value of each of the following formulas (the universe of discourse for each statement is given in parentheses).
(a) (∀x)(x + x ≥ x). (ℝ)
(b) (∀x)(x + x ≥ x). (ℕ)
(c) (∃ x) (2x = x). (ℕ)
(d) (∃ x) (2x = x). (w)
Solution:
a) (∀x)(x + x ≥ x). (ℝ)
False
Counter Example: x = -2
b) (∀x)(x + x ≥
x). (ℕ)
True
c) (∃ x) (2x =
x). (ℕ)
False
There is no such number
d) (∃ x) (2x =
x). (w)
True
Example: x = 0 and 2x = 0
Question 1: For each of the following AI agents, identify the following elements: Environment, Percept, Sensor, Actuator, Action, Goal and Performance
|
ATM machine |
Facial recognition system |
Google translate |
Environment |
|
|
|
Percept |
|
|
|
Sensor |
|
|
|
Actuator |
|
|
|
Action |
|
|
|
Goal |
|
|
|
Performance |
|
|
|
Solution:
|
ATM machine |
Facial recognition system |
Google translate |
Environment |
User, ATM card |
Humans |
Users, smartphones, computers, the internet |
Percept |
ATM Card, Touch |
Human faces |
Keyboard strokes, touch |
Sensor |
Card reader, touch, buttons |
Camera sensors |
Typed words |
Actuator |
Display, audio, cash withdrawal |
Display, audio |
Display, audio |
Action |
Detect card details, withdraw cash, and give it to the user |
Detect human from their face |
Display translation of selected language |
Goal |
Allow users to withdraw cash |
Detect humans from their facial features |
Translate the typed words into the selected language |
Performance |
Accurately detect cards, complete withdrawal |
Accurate facial recognition |
Accurately translate words into the selected language |
Question 2: Consider a robot vacuum cleaner. What type of environment is this agent subjected to. Which type of agent can be more suitable for modelling such environment. Justify your answers with some explanation.
Solution: Agent type: Utility-based Agent
Explanation: The vacuum cleaner agent has the following functions: move left, right, back, front, and suck dirt from the floor. Here, the performance of the agent can be measured by how effectively and efficiently it can complete the task. A utility-based agent doesn’t only focus on the goal but also on the best way to reach that goal i.e minimize path cost and search cost.
Question 3: The Edison Robot is a programmable coding robot for school education. What are PEAS (Performance, Environment, Actuator, Sensor) for this agent?
Solution: Agent - Edison Robot
Performance measure - Student’s test score, student’s feedback
Environment - Group of students, school
Actuators - Display or Speak(teach) about learning modules, exercises, suggestions, hints, reminders
Sensors - Keyboard strokes, sound, visibility
Question: Collaborative writing is an essential writing practice during the COVID-19 pandemic amongst educators and journalists.
Write an essay to rationalise how collaborative writing can be carried out effectively. Your essay should be between 800 and 900 words.
Solution: Collaborative writing is a way of combining ideas done by individuals or members of a team. Although it may be aggravating, there are several ways that can help you get through those dreaded group project tasks. A project's success hinges on effective communication. Everyone in the group should make sure they understand what the assignment comprises and what each person is expected to do.
There are many ways to achieve a successful collaborative writing within a group. One of which is version control and how to utilize it. Everyone should know how to get to the most current agreed-upon draft at all costs, so that the group has a frame of reference to which it can refer if an issue or disagreement arises. Whether you're working with shared files on a shared server or Alfresco Team, a person will have to make a decision about which changes to make and which sections of the document to keep. This is an example of what can happen: a paragraph that was previously cut gets reinstated, but the paragraph no longer appears to fit because the transition leading into that part has undergone additional alterations. To accommodate this, the transition will need to be redone. Documents are systems in the sense that all of their components are interconnected.
Secondly is making sure you know what each revision's goal is. People should be laser-focused on whatever goal they are pursuing. Is this iteration for minor concerns such as style and tone modifications, or for broader ones like as structure and flow? When a revision that was supposed to be a significant clarification comes back with nit-picky style guide modifications, "that" vs. "which" revisions, and so on, it's aggravating. The frustration can be alleviated by having a clear understanding of the revision's goal.
Moreover, have faith in the subject matter expert most of the time. When it comes to content, trust your subject matter expert, but be prepared to push back if they add extra levels of complexity that threaten to confound the very individuals you're trying to reach. Communication should be staged and scheduled. As a result, some math experts aren't particularly excellent math teachers, to use a frequent example. True, but it's at a level of complexity that makes learning impossible. Make sure everyone in your group understands who your document is intended for.
In addition, don't waste your time fighting a losing battle. When human people collaborate on a project, disagreements are bound to arise. That isn't always a bad thing. Indeed, it is frequently via the process of airing out differences that a new understanding emerges. When the group, project leader, or other decision-making organization has made a decision , the person who strongly preferred a different strategy must move on. Bringing upstream issues into downstream discussions destroys confidence since your teammates assumed the problem had been resolved. It's a unique situation.
Lastly, choose a final editor. Make it clear who is in charge of putting the final copy together. It's certain that two contributors will make competing changes to their working copies of the same file and commit those changes to the repository. Even if your program detects the problem, an editor must remedy the issue before the update is applied and a new version is released. For sure, people would believe that their changes are more valuable than someone else's. We can't help but be objective in our assessments of our own contributions. Someone has to be in charge of that work, and that person should be able to refer to a style guide that has been agreed upon.
In conclusion, the pros and challenges of collaborative writing, including the technological component, have been widely studied. The human component in generating collaborative documents can be a source of leverage rather than an uphill struggle with sufficient buy-in from the team, as well as clear ground rules and roles.
Question: What is Cause and Effect Depression Amidst Covid-19 Pandemic?
Solution:
The COVID-19 pandemic and the ensuing economic downturn have had a detrimental impact on many people's mental health and raised additional obstacles for those who still suffer from mental illness or drug abuse problems. Approximately 4 in 10 adults in the United States have recorded anxiety or depressive disorder symptoms since the pandemic, a share that has remained relatively stable, up from one in ten adults who reported these symptoms from January to June 2019.
If the pandemic progresses, ongoing and necessary public health efforts expose a growing number of people to situations that are related to poor mental health outcomes, such as loneliness and job loss.
Concerns about mental health and drug use have increased since the COVID-19 pandemic, including concerns about suicidal ideation. In January 2021, 41% of adults reported anxiety and/or depressive disorder symptoms, a percentage that has remained relatively constant since spring 2020. According to a survey conducted in June 2020, 13% of adults reported new or increased drug use as a result of coronavirus-related stress, and 11% of adults reported suicidal thoughts in the previous 30 days. Suicide rates have been that for some time and could escalate as a result of the pandemic. Drug overdose deaths spiked from March to May 2020, coinciding with the start of pandemic-related lockdowns, according to early 2020 data.
Adults in poor general health appear to experience higher rates of anxiety and/or depression than adults in good general health, as they did prior to the pandemic. 1.2 The already high probability of developing a concurrent mental health condition in people with chronic disease could be increased by their susceptibility to serious illness from COVID-19. According to a recent survey, 18% of people who obtained a COVID-19 diagnosis were later diagnosed with a mental health condition including anxiety or mood disorders. Seniors are also more susceptible to serious coronavirus disease and have shown higher levels of anxiety and depression during the pandemic.
Prior to the current epidemic, there were high rates of mental illness and drug abuse, but mental distress during the pandemic is not surprising. Prior to the pandemic, one out of every ten adults had anxiety or depressive symptoms. Nearly one in every five people in the United States has a mental disorder. Over 48,000 Americans died by suicide in 2018,3 and nearly eleven million adults recorded serious thoughts of suicide in the previous year on average between 2017 and 2018. Furthermore, as a result of the opioid epidemic, drug overdose deaths were four times higher in 2018 than they were in 1999.
The pandemic has likely impacted mental health in a number of ways, including widespread social isolation as a result of necessary safety steps. Social alienation and depression have been linked to poor mental and physical health in a large body of study. Even before the pandemic, the widespread experience of isolation had become a public health problem due to its connection to a shorter lifespan and a higher risk of both mental and physical illnesses.
Previous epidemics also caused widespread depression and resulted in new mental health and drug abuse problems. If the COVID-19 pandemic progresses, various groups are at a higher risk of mental illness and will have difficulty getting the treatment they need.
Many young adults have experienced heightened anxiety, depression, sleep disturbances, and suicidal thoughts as a result of the pandemic. They have also dealt with a slew of pandemic-related effects, including university closures, shifts to remote jobs, and loss of income or employment, all of which could wreak havoc on their mental health.
Job loss may result in other negative mental health effects, such as drug use disorder, in addition to increased anxiety and depression. The high unemployment rate during the previous recession was also linked to a rise in suicides. According to a KFF Health Tracking Poll conducted in mid-July 2020, a higher percentage of households experiencing income or job loss reported that pandemic-related worry or stress caused them to experience at least one negative effect on their mental health and well-being, such as difficulty sleeping or eating, increased alcohol consumption, or increased anxiety.
Many schools and childcare centers in the United States have closed and switched to virtual instruction for at least some time to help slow the spread of coronavirus. Children and their parents are experiencing constant uncertainty and changes to their everyday lives as a result of these closures. During the pandemic, research revealed questions about children's and parents' mental health and well-being. Many parents of school-aged children, for example, are even more anxious than they were before the pandemic about their children's emotional well-being.
Q1: Which of these statements are used to determine the value of information assets?
a. Which information asset is the most expensive to protect?
b. Which information asset is the most expensive to protect?
c. Which information asset generates the highest profitability?
d. Which information asset is the most critical to the success of the organization?
Solution: Which information asset is the most critical to the success of the organization?
Which information asset is the most expensive to protect?
Which information asset generates the highest profitability?
Which information asset is the most expensive to protect?
Q2: The final step in the risk identification process is to list the assets in order of importance. Which tool is used to achieve this goal?
a. weighted factor analysis
b. Cost Benefit Analysis
c. Thread vulnerabilities assessment
d. Quality Risk Analysis
Solution: weighted factor analysis
Q3: Which of these define Mitigation Risk control strategies
a. Applying safeguards that eliminate or reduce the remaining uncontrolled risk
b. Reducing the impact if the vulnerability is exploited
c. Understanding the consequences of and accepting the risk without control
d. Shifting risks to other areas or to outside entities
Solution: Reducing the impact if the vulnerability is exploited
Q4: Which of the Risk Control Strategy selection should be chosen when we manage risk -to limit the extent of the attack
a. When the attacker’s potential gain is greater than the costs of an attack
b. When potential loss is large
c. When a vulnerability can be exploited
d. When a vulnerability exists
Solution: When potential loss is large
Q5: Which of this statement define Single loss expectancy
a. is based on the value of the asset and the expected percentage of loss that would occur from a particular attack
b. Evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised
c. is the process of comparing the projected or estimated costs and benefits
d. the probability of a threat occurring is the probability of loss from an attack within a given time frame
Solution: is based on the value of the asset and the expected percentage of loss that would occur from a particular attack
Q6: Which of the following is NOT a task in Work Breakdown Structure (WBS)
a. estimated capital and noncapital expenses
b. Identify risk
c. identification of dependencies between/among tasks
d. start and end dates
Solution: Identify risk
Q7: Which of these define the goals of project wrap-up?
You may select more than one answer.
a. draw conclusions about how to improve process
b. resolve any pending issues
c. Patching
d. critique overall project effort
Solution: resolve any pending issues,
critique overall project effort,
draw conclusions about how to improve process
Q8: Which of the following is NOT TRUE about the Chief Information Security Officer (CISO or CSO)
a. Drafts or approves information security policies
b. Works with the CIO on strategic plans
c. Manages the overall information security program
d. Accountable for day-to-day operation of information security program
Solution: Accountable for day-to-day operation of information security program
Q9: The ISO management model is a five-layer approach that provides structure to the administration and management of networks and systems. The core ISO model addresses management and operation through five topics:
• Fault management
• Configuration and name management
• Accounting management
• Performance management
• Security management
Which of these statements define the Fault management
a. involves the physical and logical assessment of the vulnerabilities present in information systems. This is most often accomplished with penetration testing.
b. is process of reviewing use of a system, not to check performance, but to determine misuse or malfeasance; automated tools can assist
c. is the administration of the configuration of the components of the security program.
d. the process of identifying, tracking, diagnosing, and resolving faults in the system.
Solution: the process of identifying, tracking, diagnosing, and resolving faults in the system.
Q10: Which of these statements is NOT a primary deliverable of the Monitoring Process?
a. Building and maintaining an inventory of network devices and channels, IT infrastructure and applications, and information security infrastructure elements
b. Detailed intelligence on highest risk warnings
c. Periodic summaries of external information
d. Specific warning bulletins issued when developing threats and specific attacks pose measurable risk to organization
Solution: Building and maintaining an inventory of network devices and channels, IT infrastructure and applications, and information security infrastructure elements
Q11: Most audit reports contain at least three broad sections: findings, recommendation, and follow-up. Explain each section in the audit reports.
Solution: - Findings are organised according to how closely they correspond to the standard benchmark.
- Recommendations: Make recommendations on how to mitigate the risks that have been identified.
• Implementation timeline, amount of risk, and management reaction are all important considerations.
When it is essential, auditors should plan a follow-up to confirm that suggestions have been implemented by the company.
Q12: An organization needs clearly documented personnel security policies and procedures in order to facilitate the use and protection of information. For example, the organization should conduct background checks and formal termination procedures.
(a) Describe TWO (2) reasons why background checks and verifying application information for all potential employees and contractors are important.
(b) Formal termination procedures should be implemented to help protect the organization from potential lawsuits, property theft, and destruction, unauthorized access, or workplace violence. Explain THREE (3) termination procedures that should be considered by the organization.
Solution: a. Background checks may assist in reducing the likelihood of engaging in criminal activity such as assault, abuse, and theft. They may also check the facts included in an applicant's résumé or job application, and they can aid your business in determining whether or not a certain individual is the best candidate for the position.
b. 1. All logical and keycard access is cancelled before the employee is even aware of it.
2. The employee gathers all of his or her personal things and returns all keys, keycards, and other business property to the office.
3. The employee is then escorted out of the building.
Q13: List FOUR (4) essential security testing tips and explain why it is crucial to an organization's security consideration.
Solution: 1-Choose the right tool: As if you dont use the correct tool the results might be different and misleading sometimes
2-Tools make mistake : Sometimes the tools give false positives as well
3-Protect your system: The system should be updated and must be using antivirus to protect against attacks
4-Tests should be as “real” as possible , Real Attacks: The real should be as real so that the real environment can be mimicked
Q14: (a) Calculate the risk assessment weighted score for each of the information assets.
Table 1: Information Asset Risk Assessment
Information Asset
Criterion l:
Impact on Revenue Criterion 2:
Impact on profitability
Criterion 3:
Impact on Public Image Weighted Score
Criterion weight 50 20 30
Alpha 0.8 0.9 0.5
Beta 0.8 0.9 0.6
Omega 0.4 0.5 0.3
Delta 1 0.6 0.4
Gamma 0.4 0.4 0.9
Solution: Alpha = (50 * 0.8) + (20*0.9) + (30 *0.5) = 40 + 18 + 15 = 73
Beta = (50 * 0.8) + (20*0.9 + (30 *0.6) = 40 + 18 + 18 = 76
Omega = (50 * 0.4) + (20*0.5) + (30 *0.3) = 20 + 10 + 9 = 39
Delta = (50 * 1) + (20*0.6) + (30 *0,4) = 50 + 12 + 12 = 74
Gamma = (50 * 0.4) + (20*0.4) + (30 *0.9) =20 + 8 + 27 =55
Q1: The access control mechanism that requires the validation and verification of an unauthenticated entity's purported identity is known as -------------------------
a. authentication
b. accountability
c. confidentiality
d. authorization
Solution: authentication
Q2: An attribute of information that describes how data is protected from disclosure or exposure to unauthorized individuals or systems is known as ___________________
a. Privacy
b. Integrity
c. disclosure
d. Confidentiality
Solution: Confidentiality
Q3: Which of these statements define threat?
a. A potential weakness in an asset or its defensive control system(s).
b. An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it.
c. Any event or circumstance that has the potential to adversely affect operations and assets.
d. A single instance of an information asset suffering damage or destruction, unintended or unauthorized modification or disclosure, or denial of use.
Solution: Any event or circumstance that has the potential to adversely affect operations and assets.
Q4: ________________responsible for the security and use of a particular set of information
a. Data user
b. Data Subject
c. Data Custodian
d. Data owner
Solution: Data owner
Q5: Recently, a ransomware incident was announced in the local news that could infect similar Operating Systems that are being used by your company.
Identify THREE (3) most important assets in your company that could be affected by this malware threat.
Solution: 1. Bussiness Documents and Excel Sheets
2. Websites images and other resources
3. Back up server files
Q6: Explain why those assets are considered important.
Solution: 1. Bussiness Documents and Excel Sheets: All the business corresponding and financial data of the organization is stored in these documents
2. Websites images and other resources: This will damage the reputation of the company as the notice of the ransomware will be shown on the website
3. Back up server files: The backup data of the company will also not be available and nothing will be available for employees to do work on.
Q7: List at least TWO (2) vulnerabilities for each of the assets in (a) that are relevant to the malware threat.
Solution: 1. Bussiness Documents and Excel Sheets:
+ Using Microsoft office macros.
+ By clicking links of downloaded word file
2. Websites images and other resources:
+ By SQL injection Attack
+ By OS command injection Attack
3. Back up server files:
+ Malware spreading from network
+ SMB protocol (Eternal Blue)
Q8: Identify ONE (1) possible RISK for each of the asset you listed
Solution: 1. Bussiness Documents and Excel Sheets:
Unavailability of the resources
2. Websites images and other resources:
Damage to the reputation of the company
3. Back up server files:
Unavailability of the resources
Question 1: What is the MOST IMPORTANT reason to have detailed documentation of what happens during an incident?
a. To improve the security posture of the organization
b. To know which member of the response team is the most valuable contributor
c. To provide proof that can be taken to court
d. To identify where the attack is coming from
Solution: To improve the security posture of the organization
Question 2: The most likely reason humans are considered the weakest link is:
a. Humans are stubborn
b. Humans have emotion
c. Humans talk too much
d. Human can't be trusted
Solution: Humans have emotion
Question 3: The success factor of an attacker could be of the following, EXCEPT
a. They use the victim's red team
b. They patiently studied their target
c. They breach and observe
d. They are persistent
Solution: They use the victim's red team
Question 4: The following could be the cause for failure in detection of threats and incidents, EXCEPT:
a. Unpatched hosts
b. Untrained users
c. Zero-day attack
d. Hiring external consultant as incident responders
Solution: Hiring external consultant as incident responders
Question 5: If an incident has happened, and you need to bring the criminal to justice, which of the following is most important for your response team?
a. The user credential of the witness or victim
b. The availability of the jury
c. The confidentiality of the court's hearing date
d. The integrity of the incident's data
Solution: The integrity of the incident's data
Question 6: The following are good location to place sensors or detectors of intrusion EXCEPT
a. The users
b. The internal network
c. The external network
d. The hosts
Solution: The users
Question 7: Why is it important to perform self assessment before defining the incident response process?
a. Threats could be stopped before it happens
b. Critical asset and resources could be defined
c. Zero-day could be prevented
d. Estimation of the time of attack could be made
Solution: Critical asset and resources could be defined
Question 8: After knowing which assets to protect, a requirement that could assist us to identify breach or incident is:
a. Knowing how much those assets costs
b. Identifying the baseline and normal occurrences of those assets
c. Installing security control that could protect the assets from risks
d. Hiring consultants to assess the assets to get a second opinion
Solution: Identifying the baseline and normal occurrences of those assets
Question 9: The best practice if we adopt the ASSUME BREACH approach in handling security incident means:
a. Form the purple team to manage the red and blue team
b. We are ready, learn and adapt for security incident
c. We use cloud computing services to distribute the security team
d. We constantly attack and defend our organization's security control
Solution: We are ready, learn and adapt for security incident
Question 10: Which of the following is an example of defense in depth implementation?
a. Defense is embedded deep within the OSI layers and technology
b. Considering security implementation from the users, hosts and systems perspective
c. Protection and defense is so strong that the asset is impenetrable to risk and threats
d. Situation where the attacker can't penetrate and harm the asset because of the layers of security defense
Solution: Considering security implementation from the users, hosts and systems perspective
Q1: The following statements are correct about Shinto EXCEPT
a. the belief in sacred spirits of nature
b. the indigenous faith of the Japanese people
c. Propaganda and preaching are not common
d. It has a founder and sacred scripture
Solution: It has a founder and sacred scripture
Q2: The twin concepts of jen and li are often said to constitute the basis of Confucianism
Select one:
True
False
Solution: True
Q3: Those are the basic doctrines of Buddha teachings EXCEPT
a. nothing is fixed or permanent
b. actions have consequences
c. emphasis on devotion rather than sacrifice
d. change is possible
Solution: emphasis on devotion rather than sacrifice
Q4: Which of the following statement is NOT TRUE about Theravada, one of schools of Buddhism.
a. Theravada monks follow the practices that have been passed down by the senior monks from the Buddha's time, such as living in the forests and meditating.
b. Theravada is practiced mainly in southern Asian countries such as Sri Lanka, Thailand and Myanmar
c. Theravada means 'the teaching of the Elders'.
d. The goal in Theravada Buddhism is to become an 'Bodhisattva'
Solution: The goal in Theravada Buddhism is to become an 'Bodhisattva'
Q5: What is the purpose of most Shinto rituals?
a. to keep away evil spirit
b. to get blessing from God
c. to show the kami the outside world
d. to gain good life
Solution: to keep away evil spirit
Q6: Who is Buddha mother's name?
a. Śuddhodana
b. Māyādevī
c. Kapilavastu
d. Gautama
Solution: Māyādevī
Q7: The word Confucianism seems to be the creation of European Christians who entered Korea about 1860 CE and was originally used to label their notion of the non-Christian religions they came across in Korea.
Select one:
True
False
Solution: False
Q8: Which of the following is NOT the meaning of Jen (wren)?
Select one:
a. benefit
b. human heartedness
c. benevolence
d. goodness
Solution: benefit
Q9: One of the concept of Confucius is Hsiao. Which of the following is NOT TRUE on the meaning of reverence in Confucianism?
a. bring honor to the family since they have sacrificed much for you
b. Parents are revered because they are the source of your life
c. One should do well and make the family name known and respected
d. revered someone you love who you admire most among the outsiders
Solution: revered someone you love who you admire most among the outsiders
Q10: There are few instruments used in Buddhism ceremonies and meditation. Below are the list, EXCEPT
Select one:
a. bowls
b. Drums
c. Gongs
d. Wooden fish
Solution: bowls
Q11: During Meiji Period, Shinto is considered as state officials religion. Which of the following is NOT TRUE on this statement.
a. important shrines receive governmental funding
b. Shinto priests became state officials
c. The Shinto governor must be from man
d. Japan's creation myths were used to foster a national identity with the Emperor at its center
Solution: The governor must be from man
Q12: The Buddha explained that people live in a sea of suffering because of
Select one:
a. Perception and arrogant
b. Pleasures and happiness
c. Ignorance and greed
d. Desire and courage
Solution: Ignorance and greed
Question: What effect does a binding minimum wage have on a monopsony labor market?
Solution: A monopsony labor market is a type of market structure where there is one employer and many laborers looking for work with that employer.
Minimum wage rate in a monopsony labor market will cause firms to still operate at the point marginal factor cost curve equals marginal revenue product curve.
When firms are forced to pay a set minimum wage, MRP increases because of increased output along with increase in costs. This will result in increased employment.
Unlike competitive firms, where employment falls due to minimum wage, in case of monopsony, it increases.
Question: When is a firm’s shutdown point equal to the minimum point on its average cost curve?
Solution: A firm’s shutdown point is equal to the minimum point on its average cost curve in the short run. This is because the average cost comprises of the sum of average fixed cost and the average variable cost. The average fixed cost has to be incurred by the firm even if the firm makes no business. Thus when a firm shuts down in the short run it will equal to the minimum point on its average cost curve.
Question 1: Cyber criminals only target big businesses.
True
False
Solution: False
Question 2: Cybersecurity awareness is only for IT and technical people.
True
False
Solution: False
Question 3: Technology alone can protect me from internet dangers.
True
False
Solution: False
Question 4: Backups are an important part of cybersecurity.
True
False
Solution: True
Question 5: Operating systems are the only updates I need to worry about.
True
False
Solution: False
Question 6: Microsoft recommends using Internet Explorer to browse the internet.
True
False
Solution: False
Question 7: Password managers can store difficult to remember passwords.
True
False
Solution: True
Question 8: I should use a separate password for every account I have.
True
False
Solution: True
Question 9: The name of your pet or child makes a great password.
True
False
Solution: False
Question 10: I only need to worry about links sent through email.
True
False
Solution: False
Question 11: I can open attachments because my anti-virus will catch anything malicious.
True
False
Solution: False
Question 12: Attackers will often use...
Select all answers that apply (more than one)
spoofed phone numbers
a sense of urgency
hacked accounts or devices of people you know
none of these
Solution: spoofed phone numbers
a sense of urgency
hacked accounts or devices of people you know
Question 13: I can safely plug in a USB drive I found in the parking lot.
True
False
Solution: False
Question 14: Encryption can be used by both the good guys and the bad guys.
True
False
Solution: True
Question 15: A green padlock means a website is legitimate and safe to input your user credentials.
True
False
Solution: False
Question 16: Sharing photos while on vacation can tip off criminals that you are not home.
True
False
Solution: True
Question 17: Microsoft or Apple might call you in extreme circumstances when your computer is compromised.
True
False
Solution: False
Question 18: A caller's phone number (called ID) is a great way to verify who they are.
True
False
Solution: False
Question 1: The security protocol used in HTTPS is _____________.
A. IPSec
B. DNSSEC
C. TLS
D. SSH
Solution: TLS
Question 2: The SSH protocol was initially developed for the purpose of:
Select one:
A. Remote login
B. File transfer
C. Remote program execution
D. Sending email
Solution: Remote login
Question 3: Given below are security services offered by the Authentication Header (AH) protocol in IPSec EXCEPT:
Select one:
A. Integrity
B. Authentication
C. Confidentiality
D. Access control
Solution: Confidentiality
Question 4: Which of the following email security threats can be prevented using DNSSEC?
A. Email sent is sniffed during transmission
B. Email sent is transmitted to the attacker’s server
C. Email sending address is spoofed
D. Email cannot be sent due to DoS attack
Solution: Email sent is transmitted to the attacker’s server
Question 5: Which of the following is NOT one of the reasons why TLS has become the most popular network security protocol?
A. TLS is independent of operating system platform
B. TLS is used to secure the Web application, which is the most used network application
C. TLS only needs to be configured once, and all network applications running on the host would then be protected
D. From a user point of view, using TLS is as easy as downloading and using a client application that implements TLS
Solution: TLS only needs to be configured once, and all network applications running on the host would then be protected
Question 6: Given below are among the security concerns to an Internet user EXCEPT:
A. You may not be communicating with the person that you think you are communicating with
B. An attacker may sniff your packets
C. Your Internet connection may not be fast enough that an attacker may capture your slow moving packet
D. Malware may be secretly installed on your computer
Solution: Your Internet connection may not be fast enough that an attacker may capture your slow moving packet
Question 7: Which of the following email security mechanisms can be configured by an email user?
A. DKIM
B. SPF
C. DANE
D. PGP
Solution: PGP
Question 8: Which of the following is an advantage of using IPsec (which is network-layer security protocol) as compared to using TLS (which is a transport-layer security protocol)?
A. Configuration of IPsec is easier compared to TLS
B. IPsec uses more secure cryptographic protocols compared to TLS
C. Once IPsec is configured, communication will all Internet hosts will be protected
D. Once IPsec is configured, data transfer of all network applications with the specified receiving host will be protected
Solution: Once IPsec is configured, data transfer of all network applications with the specified receiving host will be protected
Question 9: DNSSEC ensures the following security objective(s):
A. Confidentiality, integrity and authenticity
B. Integrity and authenticity
C. Confidentiality and integrity
D. Authenticity and confidentiality
Solution: Integrity and authenticity
Question 10: Which of the following is NOT true about the use of explicit TLS in email application?
A. Before secure connection is achieved, port 25 is used by SMTP client to connect to SMTP server
B. When explicit TLS is used, email message sent between an email client and an email server is encrypted
C. It requires an insecure SMTP connection to be upgraded to a secure connection using the STARTTLS command
D. Explicit TLS can be used not only by SMTP, but also by IMAP and POP3
Solution: Before secure connection is achieved, port 25 is used by SMTP client to connect to SMTP server
Question 11: The use of https prevents the following attacks from being conducted EXCEPT:
A. Attacker replacing the Web server with a malicious server
B. Attacker sniffing the username and password transmitted by Web browser
C. Attacker stealing the HTTP cookie transmitted in an HTTP request message
D. Attacker spoofing the IP address of the host on which the Web browser is running
Solution: Attacker spoofing the IP address of the host on which the Web browser is running
Question 12: What is contained in an HTTP cookie?
A. A string that specifies the type of Web browser used by the user
B. The username and password of the Web user in cleartext
C. A string that identifies the Web user
D. The username and password of the Web user in encrypted form
Solution: A string that identifies the Web user
Question 13: Which of the following is NOT a TLS record protocol payload?
A. Hello protocol
B. Change cipher spec protocol
C. Alert protocol
D. Application data
Solution: Hello protocol
Question 14: Which of the following is one of the differences between S/MIME and OpenPGP?
A. S/MIME uses certificates issued by Certificate Authority while OpenPGP generates their own public and private keys
B. S/MIME provides authenticity and confidentiality, while OpenPGP only provides confidentiality
C. S/MIME does not include the sender’s public key with the message, while OpenPGP includes the sender’s public key with the message
D. OpenPGP provides authenticity and confidentiality, while S/MIME only provides authenticity
Solution: S/MIME uses certificates issued by Certificate Authority while OpenPGP generates their own public and private keys
Question 15: The feature of SSH that enables any insecure TCP connection to be converted to a secure SSH connection is called ____________.
A. Remote login
B. Channel conversion
C. Securing channel
D. Port forwarding
Solution: Port forwarding
Question 16: Which of the following fields is not encrypted in Encapsulating Security Payload (ESP) transport mode?
A. ESP trailer
B. IP header
C. TCP header
D. TCP data
Solution: IP header
Question 17: The following are true about private IP addresses EXCEPT:
A. A private IP address used in an organization may also be used in another organization
B. Accessing the Internet requires the use of Network Address Translation (NAT)
C. The address block 172.16.0.0/12 belongs to one of the private IP address blocks
D. They can be directly accessed from the Internet
Solution: They can be directly accessed from the Internet
Question 18: Which of the following is NOT true about DNS-based Authentication of Named Entities (DANE)?
A. It solves security issues related to the use of STARTTLS
B. It encrypts the email data regardless of whether the email server supports TLS or not
C. It ensures the authenticity of an email server without verifying the server's digital certificate with a Certificate Authority (CA)
D. It makes use of a DNS record called TLSA
Solution: It encrypts the email data regardless of whether the email server supports TLS or not
Question 19: In S/MIME, what is the use of the receiver's private key?
A. To encrypt the message digest
B. To decrypt the message content
C. To decrypt the message digest
D. To decrypt the secret key
E. To encrypt the message content
F. To encrypt the secret key
Solution: To decrypt the secret key
Question 20: In S/MIME, what is the use of the receiver's public key?
A. To decrypt the secret key
B. To decrypt the message content
C. To encrypt the message digest
D. To encrypt the message content
E. To decrypt the message digest
F. To encrypt the secret key
Solution: To encrypt the secret key
Question 21: Differentiate between active and passive security attacks.
Solution: Passive security attack: In this attack the intruder or attacker just sniffs the information, he does not modify or change it. He only listens to the traffic and compromises the confidentiality of the data
Active Security attack: In this the attacker first listens to the information and then changes it and then forwards it to the receiving party which means the confidentiality and integrity both compromises.
Question 22: Both Sender Policy Framework (SPF) and DomainKeys Identified Email (DKIM) are used to prevent the email sending address from being spoofed. However, the techniques used are different. Differentiate between the techniques used by these two mechanisms.
Solution: SPF makes use of a TXT DNS resource log in which the sending domain identifies all of the domain's senders. To authenticate the sender, the receiver will query a TXT DNS resource record about the sender's address domain and IP address. DKIM, on the other hand, uses a digital signature. The sender's private key will be used to sign the message. The receiver would then search the public key to see if the message is from the legitimate sender
Question 23:For each of the following situations, identify the most suitable IPSec protocol (AH or ESP) and mode (transport or tunneling) to be used.
(a) A staff working from home during COVID-19 pandemic, and would like to establish a Virtual Private Network (VPN) to his corporate network.
(b) A system administrator configuring two servers that always send data to each other. The system administrator needs to ensure that the data transmitted between the two servers cannot be read by an attacker.
(c) A network administrator configuring firewall between two office branches. The data transmitted are all TLS data. The main aim of using IPSec would be to ensure the authenticity of the two firewalls.
Solution: (a) Ipsec protocol (ESP) and tunneling mode
(b) Ipsec ESP transport modec)AH tunnel mode
Question 1: Which of the following statements about EAP authenticator is CORRECT?
Select one or more:
EAP authenticator may also play the role of an authentication server
EAP authenticator can communicate with supplicants using IEEE 802.1X
EAP authenticator is the device that grants access to the network
A WiFi access point is an example of an EAP authenticator
Solution: EAP authenticator may also play the role of an authentication server
EAP authenticator can communicate with supplicants using IEEE 802.1X
EAP authenticator is the device that grants access to the network
A WiFi access point is an example of an EAP authenticator
Question 2: Identify the methods that are commonly used to control network access in a corporate network.
Select one or more:
Assign users to specific VLAN based on their access level
Allow access to devices based on their MAC address
Control access between network segments using firewall
Use 802.11X authentication
Solution: Assign users to specific VLAN based on their access level
Control access between network segments using firewall
Use 802.11X authentication
Question 3: Which of the following statements about EAP over LAN (EAPOL) is CORRECT?
Select one or more:
EAPOL support the transmission of EAP authentication packets over IEEE 802 LAN standards such Ethernet or WiFi
EAPOL is a protocol defined as part of IEEE 802.1X
EAPOL defines an authentication method to be used with IEEE 802.1X authentication
EAPOL is used to carry data packets sent after authentication has been approved
Solution: EAPOL support the transmission of EAP authentication packets over IEEE 802 LAN standards such Ethernet or WiFi
EAPOL is a protocol defined as part of IEEE 802.1X
Question 4:When a mobile phone is made into a WiFi hotspot, it would play the role of:
Select one or more:
Authenticator
Authentication server
Supplicant
Wireless medium
Solution: Authenticator
Authentication server
Question 5: Choose the essential features of cloud computing from the list below.
Select one or more:
Computing resources can be increased or decreased based on the specified service requirement
Cloud users are charged based on the amount of computing resources used
Computing resources are shared among the cloud users.
Cloud users can provision for computing resources themselves without the need to interact with any employee from the cloud service provider
Solution: Computing resources can be increased or decreased based on the specified service requirement
Cloud users are charged based on the amount of computing resources used
Cloud users can provision for computing resources themselves without the need to interact with any employee from the cloud service provider
Question 6:What are the security risks related to the use of cloud computing?
Select one or more:
Cloud computing account may be compromised by attackers
Cloud computing resources may be used for malicious purposes
Data may be leaked to other cloud computing users
Data may be read by the employees of the cloud service provider
Solution: Cloud computing account may be compromised by attackers
Cloud computing resources may be used for malicious purposes
Data may be leaked to other cloud computing users
Data may be read by the employees of the cloud service provider
Question 7: The IEEE 802.11i standard provides confidentiality through which of the following protocols?
Select one or more:
EAP
CCMP
TKIP
IEEE 802.11X
Solution: CCMP
TKIP
Question 8: The IEEE 802.11i standard provides access control through which of the following mechanisms?
Select one or more:
PSK
TKIP
CCMP
IEEE 802.11X
Solution: PSK
IEEE 802.11X
Question 9: Among the reasons why mobile devices are more prone to security risks are:
Select one or more:
Mobile devices are equipped with Global Positioning System (GPS) receiver
Mobile devices run mobile operating systems where security features are not implemented
Mobile devices are easily lost or stolen
Mobile devices connect to various different networks
Solution: Mobile devices are equipped with Global Positioning System (GPS) receiver
Mobile devices are easily lost or stolen
Mobile devices connect to various different networks
Question 10: Which of the following should be done to secure a newly bought WiFi access point to be installed in your house?
Select one or more:
Change the default administration password
Change the default SSID name
Choose WPA3 for authentication even though it is not supported by the wireless devices that will use the access point
Use IEEE 802.1X instead of PSK as the authentication method
Solution: Change the default administration password
Change the default SSID name
Question 11: Choose the factors that contribute to the higher security risk of wireless networks as compared to wired networks.
Select one or more:
The fact that wireless devices are mobile and often connect to various different networks
Wireless network protocols have no security mechanisms implemented
Some mobile devices have limited capability to deal with security threats
The broadcast nature of wireless medium
Solution: The fact that wireless devices are mobile and often connect to various different networks
Some mobile devices have limited capability to deal with security threats
The broadcast nature of wireless medium
Question 12: Among the common threat(s) faced by devices when communicating over a wireless network are:
Select one or more:
Attacker can break into any TCP or UDP port even though it is not opened
Its MAC address could be sniffed by attacker
The access point that it connects to could be a rogue access point
Its HTTP cookies can be easily sniffed even if HTTPS is used
Solution: Its MAC address could be sniffed by attacker
The access point that it connects to could be a rogue access point
Question 13: Choose the CORRECT statement(s) about WiFi association.
Select one or more:
It is not possible for association to be done without having to enter a password
It is possible to permit association based on device MAC address
Association refers to the process of transferring data from a wireless device to a WiFi access point
WPA3 is an authentication protocol used during WiFi association
Solution: It is possible to permit association based on device MAC address
WPA3 is an authentication protocol used during WiFi association
Question 14:Which of the following statements are TRUE about open WiFi network?
Select one or more:
When WPA3 is used, data transmitted in open WiFi network is encrypted
When open WiFi network is used, data is transmitted in clear text
Open WiFi network is only available in access points that support WEP
In open WiFi network, association can be done without requiring a password
Solution: When WPA3 is used, data transmitted in open WiFi network is encrypted
When open WiFi network is used, data is transmitted in clear text
In open WiFi network, association can be done without requiring a password
Question 15: Which of the following statements are TRUE about WPA2-Personal and WPA2-Enterprise?
Select one or more:
In WPA2-Personal, a single password is shared between multiple users
In WPA2-Personal, a radius server is used for authentication
In WPA2-Enterprise, each user has is own password
In WPA2-Enterprise, the access point can verify user credentials
Solution: In WPA2-Personal, a single password is shared between multiple users
In WPA2-Enterprise, each user has is own password
Question 1: Which of the following is the latest VPN protocol?
WireGuard
OpenVPN
IPSec
SSTP
Solution: WireGuard
Question 2: A firewall can be implemented in the following ways EXCEPT:
As a module in a router or a switch
As a specialized firewall hardware
As a software running on a PC operating system
As a module in a network interface card
Solution: As a module in a network interface card
Question 3: In what way is an IPS (intrusion prevention system) different from an IDS (intrusion detection system)?
An IPS can prevent an attack while an IDS can detect an attack
IDS is installed on a host while IPS is installed on a network
IPS is more intelligent than an IDS because it uses machine learning
Upon detecting a malicious activity, an IDS will only generate an alert while an IPS will attempt to take an appropriate action to mitigate the attack
Solution: Upon detecting a malicious activity, an IDS will only generate an alert while an IPS will attempt to take an appropriate action to mitigate the attack
Question 4: Why is stateful inspection firewall more secure than the packet filtering firewall?
Stateful inspection firewall will automatically block high-numbered ports without having to specify them in the rules
Stateful inspection firewall will only allow incoming packets to high-numbered ports if they are part of an active TCP connection
Stateful inspection firewall can filter packets based on the network application
Stateful inspection firewall can allow for more specific rules
Solution: Stateful inspection firewall will only allow incoming packets to high-numbered ports if they are part of an active TCP connection
Question 5: Which of the following security objectives are important when VPN is used for organizations?
Confidentiality and authenticity
Privacy and authenticity
Confidentiality and anonymity
Privacy and anonymity
Solution: Confidentiality and authenticity
Question 6: An online NIDS (Network-based intrusion detection system) is characterized by:
Its ability to perform traffic evaluation in real time
Its ability to utilize online resources in detecting malicious activities
Its ability to be online 24/7 and monitor traffic all the time
Its ability to search for vulnerability signature online
Solution: Its ability to perform traffic evaluation in real time
Question 7:Which of the following specifies the main difference between stateful inspection firewall and packet filtering firewall?
State inspection firewall is faster
Stateful inspection firewall maintains the list of active TCP connections
Stateful inspection firewall can identify to which network application the packet belongs to
State inspection firewall can detect a network attack
Solution: Stateful inspection firewall maintains the list of active TCP connections
Question 8: Which of the following security threats cannot be prevented by a firewall?
A DDoS attack coming from a specific IP address range
A staff who attempts to use BitTorrent application for downloading pirated software and movies
An external attacker who attempts to exploit an unused port on a server in the DMZ
A malware downloaded through Web browsing activity of staff within the organization
Solution: A malware downloaded through Web browsing activity of staff within the organization
Question 9: Choose the correct statement regarding signature-based and anomaly-based IDS detection methods
Anomaly-based detection can only detect both active and passive attacks while signature-based detection only detect passive attacks
Signature-based detection makes use of machine learning algorithms and therefore is more accurate than anomaly-based detection
Signature-based detection may suffer from false positives while anomaly-based detection is more accurate
Signature-based detection can only detect known attacks while anomaly-based detection can detect new attacks
Solution: Signature-based detection can only detect known attacks while anomaly-based detection can detect new attacks
Question 10: Which of the following statements are TRUE about the TCP SYN flood attack?
Select one or more:
It is a type of reflector DDoS attack
It works by having the attacker to pretend to establish TCP connection to the victim but never actually complete the connection
It causes the victim to use up its system resources
It attempts to saturate the bandwidth of the victim
Solution: It works by having the attacker to pretend to establish TCP connection to the victim but never actually complete the connection
It causes the victim to use up its system resources
Question 11: Which of the following statements are TRUE about the HTTP flood attack?
Select one or more:
It can be configured to cause the victim to use up its system resources
It can saturate the bandwidth of the victim
It works by having attackers send large number of HTTP GET or POST messages to the victim
It is a type of reflector DDoS attack
Solution: It can be configured to cause the victim to use up its system resources
It can saturate the bandwidth of the victim
It works by having attackers send large number of HTTP GET or POST messages to the victim
