Computer Security Module 2

Preperation for quiz 2

Cynthia is concerned about attacks against an application programming interface (API) that her company provides for its customers. What should she recommend to ensure that the API is only used by customers who have paid for the service?

a.Require authentication
b.Install and configure a firewall
c.Filter by IP address

a.Require authentication

A PIN is an example of what type of factor?

a.Something you know
b.Something you are
c.Something you have
d.Something you set

a.Something you know

Chloe has noticed that users on her company's network frequently have simple passwords made up of common words. Thus, they have weak passwords. How could Chloe best mitigate this issue?

a.Increase minimum password length
b.Have users change passwords more frequently
c.Require password complexity
d.Implement Single Sign-On (SSO)

c.Require password complexity

Chuck’s organization requires that user accounts only be able to log in during the staff member’s working hours. What type of standard would drive a setting like this?

a.Access control
b.Encryption
c.Password
d.Physical security

a.Access control

Gabby has been laid off from the organization that she has worked at for almost a decade. Mark needs to make sure that Gabby's account is securely handled after her last day of work. What can he do to her account as an interim step to best ensure that files are still accessible and that the account could be returned to use if Gabby returns after the layoff?

a.Delete the account and re-create it when it is needed.
b.Disable the account and reenable it if it is needed.
c.Leave the account active in case Gabby returns.
d.Change the password to one Gabby does not know.

b.Disable the account and reenable it if it is needed.

Henry is an employee at Acme Company. The company requires him to change his password every three months. He has trouble remembering new passwords, so he keeps switching between just two passwords. Which policy would be most effective in preventing this?

a.Password complexity
b.Password history
c.Password length
d.Multifactor authentication

b.Password history

Keith wants to identify a subject from camera footage from a train station. What biometric technology is best suited to this type of identification?

a.Vein analysis
b.Voiceprint analysis
c.Fingerprint analysis
d.Gait analysis

d.Gait analysis

A __________ is a password guessing program.

  A.  password hash 

B.  password cracker
  C.  password biometric 

D.  password salt

B.  password cracker

Which of the following is NOT an authentication factor?
A) Something you know (password, PIN)
B) Something you have (smart card, phone)
C) Something you are (fingerprint, face)
D) Something you eat (favorite food)

D) Something you eat (favorite food)

You log into a banking app with your password and then confirm your identity with a fingerprint.
What type of factors are used?
A) Knowledge + Possession
B) Knowledge + Inherence
C) Possession + Inherence
D) Inherence + Location

B) Knowledge + Inherence

If authentication fails in 802.1X, the device:
A) Is granted limited guest access
B) Is blocked from the network
C) Automatically retries without credentials
D) Bypasses authentication and connects anyway

B) Is blocked from the network

When you “Sign in with Google” on a third-party site, Google is acting as:
A) Resource Owner
B) Authorization Server
C) Resource Server
D) Supplicant

B) Authorization Server

Why is OAuth considered more secure than directly sharing your password with a third-party app?
A) OAuth hides your IP address
B) OAuth uses stronger passwords
C) OAuth grants limited tokens instead of full credentials
D) OAuth requires biometrics

C) OAuth grants limited tokens instead of full credentials

Your company requires you to change your password every 90 days. This is an example of:
A) Account Lockout Policy
B) Password Expiration Policy
C) Role-Based Access Control
D) Biometric Policy

B) Password Expiration Policy

Which account policy helps prevent brute-force attacks by locking a user after several failed login attempts?
A) Password Expiration
B) Minimum Password Length
C) Account Lockout
D) Token Expiration

C) Account Lockout

Which combination balances security and usability best in most organizations?
A) MFA + Reasonable Password Policy
B) Single Sign-On (SSO) without MFA
C) Simple Passwords with No Expiration
D) Biometric-only login

A) MFA + Reasonable Password Policy