CECS 378 Midterm 1

Work in progress

An administrator disables a compromised account, revokes its sessions, and restores altered records from a trusted backup. Which control role is emphasized?

Risk acceptance after remediation

Response and recovery after detection

Deterrence before authentication

Prevention before exploitation

Correct answer: Response and recovery after detection

Rationale: The actions contain an identified compromise and restore affected data after detection.

A service has daily backups, but restoration has never been tested and no alternate service is available during an outage. Which improvement BEST addresses the availability concern?

 

Increase the number of years that backups are retained.

 

Encrypt the existing backups with a separate key.

 

Require MFA for administrators who manage backups.

 

Test restoration and provide an appropriate failover capability.

Correct answer: Test restoration and provide an appropriate failover capability.

Rationale: Tested restoration and failover address whether the service can recover and remain accessible; backups alone do not ensure availability.

A team assumes that document identifiers are difficult to guess, but testing shows that they are sequential. Which control would BEST address the resulting risk?

 

Replace the identifiers with longer sequential values.

 

Require longer user passwords.

 

Remove document links from the navigation menu.

 

Check authorization for every document request.

Correct answer: Check authorization for every document request.

Rationale: Predictability may aid discovery, but authorization on every request is the control that prevents access to another user's document.

A hospital prioritizes a patient-portal vulnerability over the same vulnerability in a disconnected training image. What BEST supports that decision?

 

Patient portals must be patched before any other type of system.

 

A disconnected system cannot contain a genuine vulnerability.

 

The portal has greater exposure and protects more consequential assets.

 

Training systems do not require security controls or monitoring.

Correct answer: The portal has greater exposure and protects more consequential assets.

Rationale: Greater exposure and more consequential assets can make the same weakness produce greater risk.

A company operates a public status page and a payroll database. Which security-goal assignment is MOST appropriate?

 

The status page needs confidentiality but not integrity or availability.

 

Payroll needs confidentiality; both need appropriate integrity and availability.

 

Both systems need identical confidentiality, integrity, and availability controls.

 

Only payroll requires security because the status page is public.

Correct answer: Payroll needs confidentiality; both need appropriate integrity and availability.

Rationale: Payroll data has strong confidentiality needs, while inaccurate or unavailable information can harm either system.

A botnet floods a ticketing site with requests so legitimate customers cannot connect. No records are read or modified. Which goal is PRIMARILY affected?

 

Integrity

 

Authenticity

 

Confidentiality

 

Availability

Correct answer: Availability

Rationale: Preventing legitimate users from reaching the service is an availability failure.

A failed storage controller prevents employees from accessing an order-processing system. How should the event be classified?

 

Technical threat affecting availability

 

Human error affecting integrity

 

Adversarial threat affecting confidentiality

 

Environmental threat affecting authentication

Correct answer: Technical threat affecting availability

Rationale: A storage-controller failure is a technical, non-adversarial threat event that prevents authorized use, affecting availability.

An employee accidentally sends a confidential report to the wrong customer. Which statement is accurate?

 

The event is not a threat because the employee lacked malicious intent.

 

Human error caused a threat event affecting confidentiality.

 

The event affects integrity because the report left the organization.

 

The recipient became a vulnerability when the email arrived.

Correct answer: Human error caused a threat event affecting confidentiality.

Rationale: Threat events can result from human error; unauthorized disclosure affects confidentiality even without malicious intent.

A developer claims that unlinked files are safe because users can open files only through dashboard links. What should a security reviewer do FIRST?

 

Review the backup schedule for uploaded files.

 

Attempt to request an unlinked file directly.

 

Confirm that file transfers use HTTPS.

 

Verify that dashboard sessions expire automatically.

Correct answer: Attempt to request an unlinked file directly.

Rationale: A direct request tests the developer's assumption that the interface is the only path to a file.

A portal uses HTTPS and MFA, but an authenticated user can change a record number in the URL and retrieve another customer's record. Which change would MOST directly correct the weakness?

 

Verify record ownership on every request.

 

Increase the minimum password length.

 

Shorten the authenticated session lifetime.

 

Encrypt the record number shown in the URL.

Correct answer: Verify record ownership on every request.

Rationale: Authentication does not replace object-level authorization. The server must verify that the authenticated user may access the requested record.