1️⃣ Security

🔹 Simple Definition:

Protection against harm or danger.

🔹 Formal Definition:

Security refers to the set of measures designed to protect systems, information, or resources
from unauthorized access, damage, or interference, ensuring proper functioning and
trustworthiness.

🔹 Key Idea:

Security = Protection + Control + Assurance that resources are safe and used only as
intended.

🔹 Examples:

 Locking your phone so others can’t read your messages.

 Installing antivirus software to block malware.
 Encrypting files before storing them in the cloud.

🔹 Analogy:

Like locking doors and windows in your house, security keeps intruders out and protects
valuables.

🔹 Importance:

Without security, systems can be misused, data can be stolen, and services can fail.

2️⃣ Threat
🔹 Simple Definition:

Something bad that might happen.

🔹 Formal Definition:

A threat is any potential cause of an unwanted incident that can result in harm to a system or
organization.

🔹 Types of Threats:
  Natural threats: floods, fires, earthquakes.
 Human threats: hackers, employees, spies.
 Technical threats: software bugs, hardware failure.

🔹 Example:

A hacker planning to steal your password is a threat even before they act.

🔹 Analogy:

A storm approaching your town is a threat — even if it hasn’t hit yet.

🔹 Relation:

Threats exploit vulnerabilities to cause attacks.

3️⃣ Vulnerability
🔹 Simple Definition:

A weakness or flaw that can be used to cause harm.

🔹 Formal Definition:

A vulnerability is a flaw in design, implementation, operation, or management that can be

exploited by a threat to gain unauthorized access or cause damage.

🔹 Examples:

 Using a weak password (like “1234”).

 Outdated antivirus software.
 An unlocked office door.

🔹 Analogy:

A cracked window in your house — it’s not broken yet, but easy to break.

🔹 Relation:

Risk = Threat × Vulnerability × Impact

🔹 Importance:

Identifying and fixing vulnerabilities is the first step in building secure systems.
4️⃣ Attack
🔹 Simple Definition:

The actual harmful action carried out by a threat.

🔹 Formal Definition:

An attack is the realization or execution of a threat by exploiting a vulnerability to

compromise a system’s security.

🔹 Examples:

 Phishing email tricking users to reveal passwords.

 Virus deleting important files.
 Hacker breaking into a bank’s database.

🔹 Analogy:

A thief breaking through a weak door and stealing valuables.

🔹 Relation:

 Threat: possibility of a break-in.

 Vulnerability: weak door.
 Attack: the break-in itself.

5️⃣ Computer Security

🔹 Simple Definition:

Protecting computers and information from harm.

🔹 Formal Definition:

Computer security is the protection of computer systems, networks, and data from
unauthorized access, damage, or disruption, ensuring confidentiality, integrity, and
availability (the CIA Triad).

🔹 Example:

Installing firewalls, updating antivirus software, and controlling who can access your data.

🔹 Analogy:
It’s like a security system for your digital world — passwords are locks, firewalls are walls,
and antivirus software is your guard.

🔹 Importance:

Protects data, maintains trust, ensures system performance, and prevents loss.

6️⃣ Confidentiality
🔹 Simple Definition:

Keeping information secret from those who shouldn’t see it.

🔹 Formal Definition:

Confidentiality ensures that information is accessible only to those authorized to have

access.

🔹 Examples:

 Password-protected files.
 Encryption of messages.
 Medical records visible only to doctors.

🔹 Analogy:

Like whispering a secret only your friend should hear.

🔹 Importance:

Prevents identity theft, spying, and data leaks.

7️⃣ Integrity
🔹 Simple Definition:

Keeping information accurate and unaltered.

🔹 Formal Definition:

Integrity guarantees that data is complete, accurate, and protected from unauthorized
modification or corruption.
🔹 Examples:

 Using checksums to detect file tampering.

 Restricting who can edit records in a database.
 Backing up files to restore original copies.

🔹 Analogy:

Like sealing a document with wax so you can tell if it’s been opened or changed.

🔹 Importance:

Ensures trust and correctness of data in decision-making.

8️⃣ Availability
🔹 Simple Definition:

Making sure data and systems are usable when needed.

🔹 Formal Definition:

Availability ensures that authorized users have reliable and timely access to information and
resources.

🔹 Examples:

 Redundant servers that prevent downtime.

 Regular backups after power failures.
 Anti-DDoS measures to keep websites running.

🔹 Analogy:

Like ensuring your house keys work when you need to enter — not locked out.

🔹 Importance:

No matter how secure a system is, if users can’t access it, it’s useless.

9️⃣ Hackers
🔹 Simple Definition:
People who try to access computer systems — sometimes illegally.

🔹 Formal Definition:

A hacker is an individual who gains unauthorized access to computer systems, networks, or

data — either for malicious reasons (black hat) or ethical testing (white hat).

🔹 Types:

 Black hat: malicious attackers.

 White hat: ethical security testers.
 Gray hat: in-between (may break rules but not for harm).

🔹 Analogy:

A hacker is like a lock picker — sometimes a burglar, sometimes a locksmith testing the
locks.

🔹 Importance:

Hackers can both create threats and help prevent them.

🔟 Viruses (Malicious Software / Malware)

🔹 Simple Definition:

Programs that harm your computer or data.

🔹 Formal Definition:

A virus is a type of malicious software designed to replicate itself and spread to other
computers, often damaging data or disrupting operations.

🔹 Examples:

 Trojan horse (pretends to be safe software).

 Worm (spreads automatically).
 Ransomware (locks your files until you pay).

🔹 Analogy:

Like a biological virus that infects people, a computer virus spreads through files or
networks.

🔹 Importance:
Understanding malware helps in designing antivirus defenses.

11️⃣ Cyber Threat

🔹 Simple Definition:

A digital danger — an online threat that targets data or systems.

🔹 Formal Definition:

A cyber threat is any malicious act that seeks to damage data, steal information, or disrupt
digital life through computer networks or the internet.

🔹 Examples:

 Phishing emails.
 Denial-of-service attacks.
 State-sponsored hacking.

🔹 Analogy:

Just like burglars target houses, cyber threats target computers across the internet.

🔹 Importance:

Understanding cyber threats is the first step to creating strong cyber defenses.

12️⃣ Policies and Provisions

🔹 Simple Definition:

Rules and measures used to maintain security.

🔹 Formal Definition:

Security policies are documented rules that define how systems and data must be protected.
Provisions are the actual measures (software, hardware, or procedures) used to enforce these
rules.

🔹 Examples:

 Password policy requiring strong passwords.

 Data backup schedule.
 Access control list defining who can log in.
🔹 Analogy:

Policies are like laws; provisions are like police and locks enforcing them.

🔹 Importance:

Without clear policies, security measures become inconsistent or ineffective.

🧩 Summary Table (Quick View)

Concept Simple Meaning Analogy Focus Area
Security Protection from harm Locking doors General protection
Threat Possible danger Storm approaching Potential cause of harm
Vulnerability Weakness Broken window Flaw that can be exploited
Attack Harmful action The break-in Threat exploiting vulnerability
Confidentiality Keeping secrets Whispering Privacy
Integrity Accuracy Wax seal Trustworthiness
Availability Access when needed Key to enter Service continuity
Hacker System intruder Lock picker Actor
Virus Harmful code Disease Malware
Cyber Threat Digital danger Online burglar Internet-based threat
Policy/Provision Rules and protections Laws and police Governance

🧠 COMPUTER SECURITY – FINAL

EXAM (Conceptual & Analytical)

🅐 PART I — MULTIPLE CHOICE QUESTIONS

(MCQs)
Choose the best answer and read the explanation carefully.

1️⃣

Which of the following best defines Computer Security?

A. Keeping computers free from dust
B. Protecting computer systems and data from unauthorized access or damage
C. Ensuring computers work faster
D. Installing antivirus software only
Answer: B
Explanation: Computer security covers confidentiality, integrity, and availability —
protecting information from misuse, not just installing tools.

2️⃣

The CIA Triad stands for:

A. Control, Investigation, Authentication
B. Confidentiality, Integrity, Availability
C. Code, Information, Access
D. Confidentiality, Identification, Audit
Answer: B
Explanation: CIA Triad is the foundation of information security ensuring privacy,
accuracy, and accessibility.

3️⃣

A threat is:
A. A weakness in a system
B. A possible cause of harm to a system
C. A software patch
D. A secure protocol
Answer: B
Explanation: Threats are potential dangers that can exploit vulnerabilities to cause damage.

4️⃣

A vulnerability is:
A. An attack tool
B. A defense mechanism
C. A weakness in defense that can be exploited
D. An antivirus feature
Answer: C
Explanation: Vulnerabilities are flaws or weaknesses in systems that threats can exploit.

5️⃣

An attack occurs when:

A. A threat is identified
B. A vulnerability is fixed
C. A threat exploits a vulnerability
D. A virus is deleted
Answer: C
Explanation: An attack actualizes a threat by taking advantage of a vulnerability.

6️⃣

Which of the following ensures data privacy?

A. Integrity
B. Confidentiality
C. Availability
D. Authenticity
Answer: B
Explanation: Confidentiality ensures only authorized users access data.

7️⃣

Ensuring data is accurate and unmodified represents:

A. Integrity
B. Availability
C. Authentication
D. Confidentiality
Answer: A
Explanation: Integrity guarantees information consistency and correctness.

8️⃣

Which term represents the guarantee that data is available to authorized users when
needed?
A. Confidentiality
B. Integrity
C. Availability
D. Authenticity
Answer: C
Explanation: Availability ensures services are up and accessible to legitimate users.

9️⃣

Malware stands for:

A. Male software
B. Malicious software
C. Manual software
D. Management software
Answer: B
Explanation: Malware is software created to harm, disrupt, or steal information.

A virus is different from a worm because:

A. Virus cannot spread automatically
B. Worm requires human action
C. Virus spreads via network automatically
D. Virus and worm are identical
Answer: A
Explanation: A virus needs a host program to spread; a worm spreads independently.

11️⃣

The main goal of firewalls is to:

A. Encrypt files
B. Filter and control network traffic
C. Delete viruses
D. Manage user accounts
Answer: B
Explanation: Firewalls act as barriers between trusted and untrusted networks.

12️⃣

Phishing is:
A. Sending fake messages to trick users
B. Encrypting data
C. Scanning vulnerabilities
D. Protecting systems
Answer: A
Explanation: Phishing deceives users into revealing confidential information.

13️⃣

The person who tests system security legally is called:

A. Black hat hacker
B. White hat hacker
C. Gray hat hacker
D. Insider threat
Answer: B
Explanation: White hats are ethical hackers improving security by testing defenses.

14️⃣

A Denial of Service (DoS) attack aims to:

A. Steal data
B. Encrypt data
C. Make systems unavailable
D. Modify files
Answer: C
Explanation: DoS attacks overwhelm systems, denying service to legitimate users.

15️⃣

A Trojan Horse is:

A. A self-replicating worm
B. A harmless game
C. A malicious program disguised as legitimate software
D. An antivirus tool
Answer: C
Explanation: Trojans trick users into executing them, opening a backdoor.

16️⃣

Authentication means:
A. Confirming identity of a user
B. Encrypting data
C. Controlling network traffic
D. Tracking logs
Answer: A
Explanation: Authentication verifies who the user really is (e.g., passwords, biometrics).

17️⃣

Authorization means:
A. Confirming user identity
B. Granting access rights to verified users
C. Encrypting passwords
D. Denying service
Answer: B
Explanation: Authorization defines what actions an authenticated user can perform.

18️⃣

The strongest password is:

A. 123456
B. Abc123
C. P@ssw0rd!2025
D. Your name
Answer: C
Explanation: A strong password mixes upper/lowercase letters, symbols, and numbers.

19️⃣

Encryption converts:
A. Ciphertext → Plaintext
B. Plaintext → Ciphertext
C. File → Virus
D. Image → Code
Answer: B
Explanation: Encryption encodes readable data into unreadable form to protect privacy.

20️⃣

Decryption is the process of:

A. Protecting data
B. Converting ciphertext to readable form
C. Deleting old files
D. Encrypting passwords
Answer: B
Explanation: Decryption reverses encryption using a secret key.

21️⃣

The mathematical formula used for encryption is called:

A. Algorithm
B. Program
C. Code
D. Script
Answer: A
Explanation: Cryptographic algorithms define how data is transformed securely.

22️⃣

Access Control ensures:

A. All users can access all files
B. Users only access authorized resources
C. Systems remain offline
D. Data is duplicated
Answer: B
Explanation: Access control enforces who can read, write, or execute data.

23️⃣

Backup refers to:

A. Copying data to another location for recovery
B. Deleting old data
C. Compressing data
D. Encrypting data
Answer: A
Explanation: Backups ensure data can be restored after loss or attack.

24️⃣

Social Engineering attack uses:

A. Software bugs
B. Human psychology
C. Encryption algorithms
D. Firewalls
Answer: B
Explanation: Social engineering manipulates people, not technology.

25️⃣

Antivirus software mainly detects and removes:

A. Hackers
B. Malware
C. Firewalls
D. Networks
Answer: B
Explanation: Antivirus scans for, detects, and removes malicious code.

26️⃣

A zero-day vulnerability is:

A. A new weakness discovered before a fix exists
B. An expired system update
C. A network password
D. A backup file
Answer: A
Explanation: Zero-day means attackers exploit a flaw before developers patch it.

27️⃣

Risk Management is about:

A. Ignoring risks
B. Identifying, analyzing, and reducing risks
C. Copying data
D. Encrypting passwords
Answer: B
Explanation: Risk management systematically protects assets from threats.

28️⃣

Intrusion Detection System (IDS):

A. Encrypts data
B. Detects unauthorized activity in networks
C. Deletes malware
D. Controls power supply
Answer: B
Explanation: IDS monitors and alerts administrators about suspicious behavior.

29️⃣

The principle of Least Privilege means:

A. Everyone should have admin rights
B. Users get only minimal access needed
C. Full access improves efficiency
D. Denying all access
Answer: B
Explanation: Limiting privileges reduces the risk of accidental or malicious misuse.

30️⃣

Physical Security refers to:

A. Protecting servers and hardware from theft or disaster
B. Encrypting files
C. Updating software
D. Changing passwords
Answer: A
Explanation: Physical security prevents unauthorized physical access to assets.

🅑 PART II — FILL-IN-THE-BLANK (10 Questions)

1️⃣. __________ ensures that data is not disclosed to unauthorized users.
Answer: Confidentiality

2️⃣. A __________ is a weakness that can be exploited by a threat.

Answer: Vulnerability

3️⃣. The process of converting plaintext to unreadable form is called __________.

Answer: Encryption

4️⃣. __________ is the process of restoring data after loss.

Answer: Backup

5️⃣. The combination of threat, vulnerability, and impact defines __________.

Answer: Risk

6️⃣. The three components of the CIA triad are __________, __________, and __________.
Answer: Confidentiality, Integrity, Availability

7️⃣. Software that harms computers is known as __________.

Answer: Malware

8️⃣. A person who tests systems legally is called a __________.

Answer: White hat hacker

9️⃣. __________ ensures that data is available whenever authorized users need it.
Answer: Availability

🔟. __________ uses human manipulation to steal information.

Answer: Social engineering
🅒 PART III — SHORT ANSWER QUESTIONS (10
Questions)

1️⃣ Define Computer Security in your own words.

Answer: Computer security is the protection of systems, networks, and data from
unauthorized access, ensuring confidentiality, integrity, and availability.
Explanation: It combines technical, human, and procedural measures.

2️⃣ Differentiate between Threat and Attack.

Answer: A threat is a potential cause of harm; an attack is when that threat becomes real by
exploiting a vulnerability.

3️⃣ What is the CIA Triad?

Answer: Confidentiality (privacy), Integrity (accuracy), and Availability (accessibility). The
three pillars of security.

4️⃣ Why is Encryption important?

Answer: It ensures data privacy by converting information into unreadable form for
unauthorized users.

5️⃣ What is the role of Firewalls?

Answer: To monitor and control network traffic between trusted and untrusted zones.

6️⃣ Define Malware and give two types.

Answer: Malicious software that harms systems. Examples: Virus, Trojan horse.

7️⃣ Explain the concept of Authentication.

Answer: It verifies the identity of a user before granting access.

8️⃣ What is Risk in Computer Security?

Answer: The possibility that a threat will exploit a vulnerability to cause damage.
9️⃣ Describe one real-life example of Social Engineering.
Answer: Phishing emails pretending to be from a bank to steal login credentials.

🔟 Why is Backup essential?

Answer: It allows data recovery after system failure, attacks, or disasters.

🅓 PART IV — TRUE / FALSE WITH DEEP

CONCEPTUAL PARAGRAPHS (10 Questions)

1️⃣

Statement: “Computer security is only about installing antivirus software.”

Answer: ❌ False
Explanation: Security involves policies, training, encryption, access control, and physical
protection — not just software tools.

2️⃣

Statement: “A vulnerability alone can damage a system.”

Answer: ❌ False
Explanation: A vulnerability needs a threat and an attack to cause damage; without
exploitation, it’s only a risk potential.

3️⃣

Statement: “Confidentiality, integrity, and availability are interdependent.”

Answer: ✅ True
Explanation: A breach in one affects others — if data is unavailable (DoS), integrity and
confidentiality may also suffer.

4️⃣

Statement: “An attack always comes from outside the organization.”

Answer: ❌ False
Explanation: Insider threats (employees, contractors) can be more dangerous than external
hackers.

5️⃣

Statement: “Encryption and decryption use keys to protect and recover data.”
Answer: ✅ True
Explanation: Encryption locks information; decryption unlocks it using mathematical keys.

6️⃣

Statement: “Social engineering attacks depend more on human weakness than technical
flaws.”
Answer: ✅ True
Explanation: It manipulates trust, curiosity, or fear to bypass security systems.

7️⃣

Statement: “Physical security has no role in cyber security.”

Answer: ❌ False
Explanation: Theft of hardware or unauthorized access to server rooms can cause severe
breaches.

8️⃣

Statement: “Integrity ensures that information remains unchanged and trustworthy.”

Answer: ✅ True
Explanation: Protects against unauthorized modification, ensuring reliability of data.

9️⃣

Statement: “A firewall’s main job is to prevent all incoming network connections.”

Answer: ❌ False
Explanation: It filters traffic based on policy — allowing legitimate access while blocking
malicious attempts.

🔟
Statement: “The principle of Least Privilege reduces the damage an attacker can cause.”
Answer: ✅ True
Explanation: By restricting user permissions, attackers gain limited access even if they
compromise an account.

✅ Total: 50 Questions

 30 MCQs
 10 Fill-in
 10 Short
 10 True/False (conceptual)

Deep explanations — components, types,

and purposes of computer security (step-by-
step for each important word)
Great — I’ll go term-by-term and explain each important word deeply: short/simple
definition, precise definition, examples, how it relates to other concepts, common
pitfalls/edge cases, a memorable analogy or mnemonic, and a quick practice/check question
you can use when teaching.

1. Component (in security)

Simple: A part or building block of a security program.
Precise: Any hardware, software, procedure, or human element that contributes to protecting
information assets and enabling secure operation. Components together form a security
architecture.

Examples: firewall (hardware), antivirus (software), access policy (procedural), user training
(human).
Relation: Components are the means — threats, vulnerabilities, attacks are the context those
means defend against. A complete security posture requires all component types working
together (defense-in-depth).

Pitfalls: Treating components in isolation — e.g., installing a firewall but ignoring user
training — creates gaps.

Analogy/Mnemonic: Components = the parts of a home security system (locks, alarm,

family rules, guard).
Quick check: Name one hardware, one software, one procedural, and one human component
in your organization.
2. Hardware Components
Simple: Physical devices used for security.
Precise: Tangible network and computing devices whose design and configuration provide
security functions (e.g., firewalls, intrusion prevention systems, secure cryptographic
modules, HSMs).

Examples:

 Network firewall appliance that filters traffic.

 Hardware Security Module (HSM) that safely stores cryptographic keys.
 Secure routers, biometric scanners.

Relation: Hardware enforces or accelerates security functions (encryption, access control)

and often provides a root of trust for higher-layer software.

Pitfalls: Assuming hardware is secure by default. Misconfigured or outdated hardware can be

a vulnerability. Supply-chain risks (tampered devices) matter.

Analogy/Mnemonic: Hardware = the physical gates, cameras, and vaults in a bank. (Think
Hardware → Hardware = Hardware vault)
Quick check: Is encryption performed faster or more securely when offloaded to a dedicated
crypto chip? (Yes — hardware acceleration & isolation.)

3. Software Components
Simple: Programs that implement security logic.
Precise: Applications, system services, and code libraries that perform security-related
functions: antivirus engines, encryption libraries, patch management agents, IDS/IPS
software.

Examples: OpenSSL (crypto library), endpoint protection platform, SIEM software.

Relation: Software implements policies and uses hardware resources; vulnerabilities in
software are common attack vectors.

Pitfalls: Relying on unpatched or third-party libraries can introduce critical vulnerabilities

(e.g., supply-chain bugs). Overly complex software increases attack surface.

Analogy/Mnemonic: Software = the rules and robots inside the bank that check IDs and lock
vaults.
Quick check: When should you apply a security patch to production software? (After testing
in staging but promptly — to reduce window of exposure.)
4. Procedural Components
Simple: Rules and processes that govern security behavior.
Precise: Documented policies, standard operating procedures, incident response plans,
change control, access control lists — the “how” of security operations.

Examples: Password policy, incident response playbook, user provisioning workflow.

Relation: Procedures translate strategy into repeatable actions; they guide humans and
automated systems.

Pitfalls: Having policies that are unrealistic or not enforced; undocumented ad-hoc changes
that break procedures.

Analogy/Mnemonic: Procedures = the bank’s rulebook for staff on how to open accounts,
audit activity, and respond to robberies.
Quick check: Does your org have a tested incident response plan? If not, it’s a high-risk gap.

5. Human Components
Simple: People and their security-related behaviors.
Precise: Training programs, awareness campaigns, role definitions, insider roles, and the
human decision-makers and operators who implement and follow security procedures.

Examples: Security awareness training, privileged user stewardship, security champions in

dev teams.
Relation: Humans are both the strongest control (judgement) and the weakest link
(susceptible to social engineering). Technical controls must assume human fallibility.

Pitfalls: Treating training as one-off checkbox; ignoring insider threat models; poor role
separation (too many admins).

Analogy/Mnemonic: Humans = bank tellers and managers — they can prevent or enable
theft. (Remember: Human = High impact)
Quick check: How often are staff trained on phishing awareness? Regular cadence reduces
risk.

6. Network Security
Simple: Protecting data while it travels and the devices that move it.
Precise: Controls and practices that defend network infrastructure and data in transit from
unauthorized access, interception, alteration, or disruption (e.g., VLANs, VPNs, TLS,
IDS/IPS, segmentation).
Examples: TLS for web traffic, VPN for remote access, network segmentation to isolate
sensitive systems.
Relation: Network security reduces attack surface by limiting lateral movement and
protecting confidentiality/integrity of transit.

Pitfalls: Blind trust of internal networks; weak segmentation; misconfigured VPNs exposing
services.

Analogy/Mnemonic: Network security = secure roads, checkpoints, and lanes that prevent
thieves from moving freely between neighborhoods.
Quick check: Can an attacker move from a low-security subnet into a sensitive subnet? If
yes, segmentation is weak.

7. Endpoint Security
Simple: Securing individual devices (laptops, phones, servers).
Precise: Measures protecting endpoints from compromise, including EDR/XDR, host
firewalls, patching, application whitelisting, and device control.

Examples: Endpoint detection and response (EDR), disk encryption, mobile device
management (MDM).
Relation: Endpoints are common entry points for attackers; endpoint security complements
network and application defenses.

Pitfalls: Ignoring unmanaged/Bring-Your-Own devices, delayed patching, overreliance on

signature-based antivirus.

Analogy/Mnemonic: Endpoint security = locks and alarms on each house and car in a
neighborhood.
Quick check: Are all endpoints in your environment encrypted and inventory-tracked?

8. Application Security
Simple: Making software itself safe.
Precise: Practices to build and maintain secure applications: secure SDLC, code review,
static/dynamic analysis, input validation, authentication/authorization testing, and
vulnerability remediation.

Examples: Threat modeling during design, automated SAST/DAST scans, secure coding
guidelines.
Relation: Application bugs commonly become vulnerabilities; application security reduces
attack surface at source.

Pitfalls: Treating security as an afterthought; ignoring third-party components; incomplete

threat modeling.
Analogy/Mnemonic: Application security = building a house with strong foundations and
windows that can’t be pried open.
Quick check: Has threat modeling been done for the app’s authentication flows?

9. Data Security
Simple: Protecting stored and processed data.
Precise: Measures ensuring confidentiality, integrity, and availability of data at rest, in
transit, and during processing: encryption, masking, tokenization, DLP, backups, and access
controls.

Examples: Encrypting databases, masking PII in test environments, retention/deletion

policies.
Relation: Data is the primary asset; many controls (network, app, endpoint) aim to protect
data.

Pitfalls: Storing sensitive data where it’s unnecessary, poor key management, weak backups
that can’t restore integrity.

Analogy/Mnemonic: Data security = lockboxes for important documents, shredding old

records, and a safe backup vault.
Quick check: Can a compromised account retrieve production PII? If yes, access controls are
insufficient.

10. Cloud Security

Simple: Managing security in cloud services and environments.
Precise: The set of controls, practices, and governance applied to cloud platforms and
services to manage shared-responsibility risks: IAM, configuration hardening, monitoring,
encryption, and compliance in IaaS/PaaS/SaaS.

Examples: Least-privilege IAM roles in AWS, cloud security posture management (CSPM),
encryption of cloud storage.
Relation: Cloud shifts some responsibilities to providers; teams must understand shared
responsibility and secure configurations.

Pitfalls: Misconfigured S3 buckets, over-privileged cloud roles, lack of visibility across

multi-cloud environments.

Analogy/Mnemonic: Cloud security = securing rented offices inside a shared building —

you control the room but not the building’s roof.
Quick check: Do you know which security responsibilities your cloud provider covers and
which you still own?
11. Primary Purpose (of Computer Security)
Simple: Protect sensitive information and keep systems running.
Precise: The primary purpose is to safeguard confidentiality, integrity, and availability of
information and computing resources so that operations continue despite adversarial actions
or failures.

Examples: Preventing data exfiltration, ensuring systems remain functional during attacks,
restoring operations quickly after incidents.

Relation: All components and types of security exist to achieve this purpose. Risk
management aligns resources to protect priorities.

Pitfalls: Focusing on single metric (e.g., only confidentiality) at expense of availability or

integrity.

Analogy/Mnemonic: The primary purpose = protecting a company’s treasure and ability to

trade without interruption.
Quick check: What are the organization’s most critical assets and how are they prioritized
for protection?

12. Secondary Purposes

Simple: Legal compliance, protecting IP, and building trust.
Precise: Secondary purposes include meeting regulatory and contractual requirements,
safeguarding intellectual property and competitive advantage, reducing liability, and
maintaining user/customer trust.

Examples: GDPR compliance, protecting trade secrets, audit trails for regulators.

Relation: Secondary purposes often drive specific controls and reporting requirements; they
align security with business, legal, and reputational goals.

Pitfalls: Treating compliance as equivalent to security — compliance is necessary but not

sufficient for robust protection.

Analogy/Mnemonic: Secondary purposes = the bank’s insurance and reputation — legal

rules you must follow and the brand trust you protect.
Quick check: Which regulations (e.g., GDPR, PCI-DSS) apply to your data, and are you
meeting their controls or only their paperwork?

Final teaching tip (for lecturers)

When you teach these topics, use layered examples: start with the home/physical security
analogy, then map each control (hardware/software/procedure/human) to a real case study
(misconfigured S3, phishing leading to credential theft, patched vs unpatched exploit). End
each section with a short scenario discussion and one practical lab exercise (e.g., configure a
simple firewall rule, run a static scan on sample code, or create a role in a cloud console and
apply least privilege).

1) MULTIPLE-CHOICE (30 questions —

choose best answer).
Each question: answer (letter) + short explanation.

1. Which of the following best illustrates a hardware component of security?

A. TLS library
B. Intrusion Prevention System (appliance)
C. Password policy
D. Security awareness training
Answer: B.
Explanation: IPS appliance is a physical device; TLS library is software,
policies/procedures are not hardware.
2. What is procedural security?
A. A software patching tool
B. Rules and processes that govern secure actions (e.g., incident response)
C. A hardware lockbox
D. A network protocol
Answer: B.
Explanation: Procedural components are documented workflows and policies
guiding secure behavior.
3. Which control primarily enforces confidentiality of data in transit?
A. RAID storage
B. TLS/SSL encryption
C. IDS alerting
D. Endpoint antivirus signatures
Answer: B.
Explanation: TLS encrypts network traffic, protecting confidentiality during
transmission.
4. The principle of least privilege implies:
A. Users get full admin rights for convenience
B. Users receive only the permissions necessary for their role
C. Passwords should be short
D. Backups are unnecessary
Answer: B.
Explanation: Least privilege limits access to reduce potential misuse or damage if
credentials are compromised.
5. Which is an example of endpoint security?
A. Network segmentation
B. Disk encryption on laptops
C. Cloud IAM policy
D. Physical perimeter fence
Answer: B.
 Explanation: Endpoint security focuses on devices (laptops, phones); disk encryption
protects data on endpoints.
6. What does application security primarily aim to prevent?
A. Unauthorized physical access to servers
B. Vulnerabilities in code that allow injection, authentication bypass, etc.
C. Poor network cabling
D. Power outages
Answer: B.
Explanation: Application security targets software flaws that attackers exploit.
7. A zero-day vulnerability is:
A. A vulnerability with a published patch already available
B. A vulnerability discovered and exploited publicly before a patch exists
C. A vulnerability that is harmless
D. A routine software update
Answer: B.
Explanation: Zero-day denotes no prior public fix when exploited.
8. Which approach reduces impact of ransomware by preserving trusted copies?
A. Increasing firewall rules
B. Regular, immutable backups with offline copies
C. Using longer passwords
D. Installing more apps
Answer: B.
Explanation: Immutable/offline backups prevent attackers from encrypting or
deleting all copies.
9. Network segmentation primarily helps by:
A. Increasing internet speed
B. Limiting lateral movement of attackers within a network
C. Removing need for user authentication
D. Reducing disk space usage
Answer: B.
Explanation: Segmentation isolates systems so compromise in one zone doesn't grant
access to others.
10. Which is the best definition of risk in security terms?
A. The number of installed apps
B. The product of threats, vulnerabilities, and impacts (qualitatively: likelihood ×
consequence)
C. Amount of disk space remaining
D. Number of users in a system
Answer: B.
Explanation: Risk = likelihood that a threat exploits a vulnerability × impact if
exploited.
11. Defense-in-depth means:
A. Relying on a single strong control
B. Layering multiple complementary controls across hardware, software, procedures,
and people
C. Only using network firewalls
D. Hiring more clerical staff
Answer: B.
Explanation: Multiple defensive layers reduce probability and impact of successful
attacks.
12. Which item is primarily a human component of security?
A. HSM (hardware security module)
B. Security awareness training and role responsibilities
C. Multi-factor authentication algorithm
D. TLS cipher suite
Answer: B.
Explanation: Training and defined human roles are human elements of security.
13. Cloud shared responsibility means:
A. Cloud provider handles absolutely all security tasks
B. Customers and providers each have specific security responsibilities depending on
service model (IaaS/PaaS/SaaS)
C. Cloud services are always insecure
D. No one is responsible for security in the cloud
Answer: B.
Explanation: The provider secures infrastructure; customer secures data, config, and
identity per service type.
14. What is data masking used for?
A. Encrypting data permanently in production
B. Replacing sensitive values with realistic but fake values for use in non-production
environments
C. Speeding up network transfer
D. Removing backups
Answer: B.
Explanation: Masking allows safe use of realistic data in testing without exposing
actual sensitive information.
15. Which control detects ongoing suspicious activity and raises alerts?
A. Encryption library
B. Intrusion Detection System (IDS) / SIEM
C. Physical lock
D. Password policy memo
Answer: B.
Explanation: IDS and SIEM detect anomalies and generate alerts for investigation.
16. Why is patch management important?
A. It makes systems look modern
B. It reduces exposure by remediating known vulnerabilities before attackers can
exploit them
C. It increases system downtime always
D. It is optional for security
Answer: B.
Explanation: Timely patching closes known vulnerabilities, reducing exploit
windows.
17. Threat modeling helps to:
A. Create random passwords
B. Systematically identify assets, threats, vulnerabilities, and mitigations during
design
C. Design faster UIs
D. Purchase new hardware
Answer: B.
Explanation: Threat modeling anticipates how systems can be attacked and guides
mitigations early.
18. Which is a procedural control for incident handling?
A. An HSM device
B. An incident response playbook and escalation matrix
C. Antivirus signatures
D. Encrypted hard drives
Answer: B.
Explanation: Playbooks are documented procedures for responding to incidents.
19. The primary business purpose of security (highest priority) is:
A. Ensuring only encryption is used
B. Safeguarding sensitive information and ensuring operational continuity
C. Limiting employee access to computers entirely
D. Reducing textbook purchases
Answer: B.
Explanation: Security protects assets and keeps operations functioning despite
threats.
20. Data at rest refers to:
A. Data being transmitted over the network
B. Data stored on disks, databases, backups, or other storage media
C. Data in CPU registers
D. Data that is deleted
Answer: B.
Explanation: 'At rest' is stored data; 'in transit' is moving; 'in use' is being processed.
21. Multi-factor authentication (MFA) requires:
A. Only a password
B. Two or more categories of evidence (something you know, have, are)
C. Password stored in plain text
D. Reusing passwords across sites
Answer: B.
Explanation: MFA uses independent factors to strengthen authentication.
22. APT (Advanced Persistent Threat) is best described as:
A. A one-time prank malware
B. A prolonged, targeted, well-resourced attack often by state actors or organized
groups
C. An antivirus update
D. A benign software package
Answer: B.
Explanation: APTs are persistent, stealthy campaigns targeting high-value assets.
23. Encryption key management is critical because:
A. Keys never expire
B. Poor management (loss/compromise) nullifies encryption regardless of algorithm
strength
C. Keys are the same as user passwords always
D. Keys are not part of security
Answer: B.
Explanation: Strong algorithms fail if keys are mishandled; key lifecycle practices
are essential.
24. Data exfiltration means:
A. Compressing data for storage
B. Unauthorized transfer of data out of an environment to an attacker
C. Deleting redundant files
 D. Backing up systems
Answer: B.
Explanation: Exfiltration is stealing data out of a system or network.
25. Which control helps mitigate social engineering?
A. Hardware firewall only
B. Regular security awareness training, phishing simulations, and clear verification
procedures
C. Using open Wi-Fi exclusively
D. Installing more RAM
Answer: B.
Explanation: Humans are the target of social engineering; training and procedures
reduce susceptibility.
26. Application of role-based access control (RBAC) means:
A. Assigning permissions based on individual whims
B. Granting permissions according to user roles and responsibilities
C. Everyone gets administrator rights
D. Removing all access controls
Answer: B.
Explanation: RBAC simplifies management and supports least privilege by roles.
27. Supply chain risk in security refers to:
A. Logistics of shipping goods only
B. Risks introduced by third-party components, libraries, or devices that can contain
vulnerabilities or backdoors
C. Only the financial cost of software
D. Internal staff only
Answer: B.
Explanation: Third-party components can introduce vulnerabilities that affect the
whole system.
28. What is the primary function of a Hardware Security Module (HSM)?
A. To store backup files only
B. To securely store and use cryptographic keys in tamper-resistant hardware
C. To replace firewalls
D. To encrypt network traffic on its own
Answer: B.
Explanation: HSMs provide a secure root of trust for key storage and cryptographic
operations.
29. Logging and monitoring are essential because:
A. They create noise only
B. They record events enabling detection, investigation, and forensic analysis after
incidents
C. They delete old files automatically
D. They prevent power outages
Answer: B.
Explanation: Logs provide evidence and visibility into what happened and when.
30. Privacy by design is a principle that:
A. Delays privacy until after development
B. Embeds privacy considerations into systems from the start (minimize data,
anonymize, default privacy settings)
C. Only focuses on encryption hardware purchases
D. Is optional for sensitive systems
 Answer: B.
Explanation: Privacy should be integrated into architecture and processes
proactively.

2) FILL-IN-THE-BLANK (10 items).

Provide answer and brief explanation.
1. The three pillars of information security are Confidentiality, Integrity, and
Availability.
Explanation: These form the CIA triad.
2. A device that isolates and inspects incoming/outgoing traffic at network boundaries is
called a firewall.
Explanation: Firewalls enforce network traffic rules.
3. The process of converting readable data into an unreadable format is called
encryption.
Explanation: Encryption protects confidentiality.
4. A remote access technology that creates an encrypted tunnel over public networks is a
VPN (Virtual Private Network).
Explanation: VPNs secure remote communications.
5. The intentional or accidental misuse of legitimate user credentials is an example of an
insider threat.
Explanation: Insiders can cause damage using authorized access.
6. A plan that defines roles, responsibilities, and steps to recover from a security incident
is an incident response plan.
Explanation: IR plans guide coordinated reaction to incidents.
7. Tools that automatically scan code for security weaknesses during development are
called SAST (Static Application Security Testing) or DAST (Dynamic).
Explanation: SAST analyzes source code; DAST tests running apps.
8. Protecting data stored in cloud object storage by preventing public read access and
enabling encryption is part of cloud security.
Explanation: Cloud security includes proper configuration and encryption.
9. An attack that floods a target with traffic to render it unavailable is called Denial of
Service (DoS) or Distributed DoS (DDoS).
Explanation: DoS/DDoS overwhelm resources to deny service.
10. The practice of reducing the amount and retention time of personal data to minimize
exposure is called data minimization.
Explanation: Minimization reduces the footprint of sensitive data.

3) SHORT-ANSWER (10 items). Provide

model answer + explanation.
1. Q: Explain why defense-in-depth is better than a single security control.
A: Layered controls (technical, procedural, human, physical) provide redundancy: if
one fails, others still protect assets, reducing single points of failure and increasing
resilience.
Explanation: Attackers face multiple obstacles; defenders gain time and detection
opportunities.
2. Q: Briefly describe how encryption and key management work together.
A: Encryption transforms plaintext with an algorithm using keys; key management
governs key generation, storage (e.g., HSM), rotation, distribution, and revocation.
Both are needed: strong algorithms and secure keys.
Explanation: Poor key handling undermines encryption security.
3. Q: What is network segmentation and a practical use case?
A: Partitioning a network into zones (VLANs, subnets) to isolate sensitive systems
(e.g., separating payment systems from corporate Wi-Fi) so a breach in one zone
doesn’t expose everything.
Explanation: Limits lateral movement and contains incidents.
4. Q: Define social engineering and give one defensive measure.
A: Manipulating people to divulge confidential info or perform actions (phishing,
pretexting). Defense: regular targeted awareness training and simulated phishing plus
verification procedures.
Explanation: Technical controls alone can’t fully prevent human manipulation.
5. Q: How does least privilege reduce risk?
A: By granting minimal permissions, it limits what an attacker or compromised
account can access, reducing potential damage and spread.
Explanation: Limits scope of incidents and accidental misuse.
6. Q: Why are backups part of security strategy?
A: Backups enable recovery from loss, corruption, or ransomware; they preserve
integrity and availability of data and support business continuity.
Explanation: Without backups, recovery options are limited and costly.
7. Q: What’s the difference between IDS and IPS?
A: IDS detects and alerts on suspicious activity (passive), IPS can actively block or
prevent that traffic (inline, active).
Explanation: IDS = monitor; IPS = prevent/mitigate in real time.
8. Q: Give one reason cloud misconfiguration is a serious security issue.
A: Misconfigured permissions or public storage (e.g., S3 bucket open) can expose
sensitive data to the internet, enabling large-scale data breaches.
Explanation: Easy to make mistakes—high impact when access is mismanaged.
9. Q: What role do policies play in compliance?
A: Policies document expected controls and behaviors, provide audit evidence, and
map to legal/regulatory requirements, forming the governance foundation for
compliance efforts.
Explanation: Compliance requires both controls and documented evidence of them.
10. Q: Explain why security testing during development is more cost-effective than
testing after deployment.
A: Finding and fixing design/code flaws early avoids expensive rework, reduces
vulnerabilities in production, and lowers remediation costs and operational risk.
Explanation: Early mitigation prevents wide impact and complexity of fixes.
4) TRUE / FALSE — Each item is a
conceptual paragraph (answer +
explanation).
T/F 1
Paragraph: “Installing an antivirus on every endpoint is sufficient to ensure an
organization’s security posture; with antivirus in place, no further technical or procedural
defenses are necessary because malware will be caught and removed automatically.”
Answer: False.
Explanation: Antivirus is one layer (signature or heuristic-based); modern attacks include
zero-day exploits, supply-chain compromises, social engineering, and fileless malware that
can evade AV. Effective security requires layered controls — patch management, EDR/XDR,
network defenses, access control, monitoring, backups, and human training. Relying solely
on AV creates a single point of failure.

T/F 2
Paragraph: “A vulnerability that has no known exploit is not a security concern and can
safely be ignored indefinitely because attackers focus only on vulnerabilities that are already
being exploited.”
Answer: False.
Explanation: Unexploited vulnerabilities still represent risk: attackers may develop exploits
later (turning it into a zero-day), or automated exploit kits may appear. Risk assessment
should prioritize but not ignore unexploited vulnerabilities; patching and mitigation reduce
future exposure.

T/F 3
Paragraph: “Confidentiality, integrity, and availability are independent; improving one never
impacts the others, so you can optimize them separately without tradeoffs.”
Answer: False.
Explanation: CIA properties interact and sometimes conflict: e.g., strong confidentiality
(strict access controls) may reduce availability; integrity checks can add latency. Security
design must balance and choose appropriate tradeoffs per business needs; actions to improve
one property can affect the others.

T/F 4
Paragraph: “An effective incident response plan requires only a written document and does
not benefit from tabletop exercises, role assignments, or technical runbooks.”
Answer: False.
Explanation: A plan is necessary but insufficient alone. Regular exercises, defined roles,
tested playbooks, communication protocols, and rehearsals ensure that the plan works under
pressure. Unpracticed plans fail in real incidents.
T/F 5
Paragraph: “Encrypting data at rest eliminates the need for access controls because
encrypted files are unreadable by unauthorized users.”
Answer: False.
Explanation: Encryption protects data if keys are protected and access to keys is controlled.
If an attacker can access keys (via privileged account compromise) or legitimately authorized
services decrypt for attackers, encryption alone is insufficient. Access controls, key
management, and monitoring remain essential.

T/F 6
Paragraph: “Cloud providers fully secure customer data in all service models; customers
have no responsibilities regarding configuration, access, or data protection.”
Answer: False.
Explanation: The shared responsibility model assigns some security tasks to providers and
some to customers depending on IaaS/PaaS/SaaS. Customers must secure their data,
identities, configurations, and applications; providers secure infrastructure.

T/F 7
Paragraph: “Multi-factor authentication (MFA) is a silver bullet that will prevent any
unauthorized access even if credentials are phished or stolen.”
Answer: False.
Explanation: MFA substantially reduces risk but is not infallible: MFA can be bypassed via
session hijacking, MFA-prompt fatigue, SIM swapping, stolen hardware tokens, or honest
users approving fraudulent prompts. MFA should be combined with monitoring, phishing
resistance, and step-up auth for high risk actions.

T/F 8
Paragraph: “Logging every event in unlimited detail is always beneficial and has no
downsides; more logs always mean better detection and forensics.”
Answer: False.
Explanation: While logs are valuable, excessive logging leads to storage cost, noise, reduced
signal-to-noise ratio, privacy concerns, and difficulties in analysis. Effective logging focuses
on relevant events, retention policies, log integrity, and tooling (SIEM) to make logs
actionable.

T/F 9
Paragraph: “A security policy that is technically perfect but not communicated or enforced
will still deliver strong security outcomes because users will intuitively follow best
practices.”
Answer: False.
Explanation: Policies must be communicated, understood, supported by training and
enforced by technical or managerial controls. Without buy-in and enforcement, policies are
only documentation — likely ignored or inconsistently applied.

T/F 10
Paragraph: “Reducing the retention of personal data and collecting only necessary fields
(data minimization) not only improves privacy but also reduces the organization’s legal
exposure and attack surface.”
Answer: True.
Explanation: Minimization reduces the amount of sensitive data that can be breached,
simplifies compliance, lowers storage and handling costs, and narrows the scope of potential
incidents — a sound security and privacy practice.

Threat (and Types of Threats)

1. Simple: Any potential bad thing that could happen to systems, networks, or data.
2. Formal: A circumstance, event, or actor with the capability and intent (or accidental
potential) to exploit a vulnerability and cause harm to information assets.
3. Examples: nation-state hackers, ransomware gangs, phishing campaigns, a storm that
floods a datacenter.
4. Relation: A threat is one side of the risk equation — it needs a vulnerability to become an
attack and affect an asset.
5. Pitfalls / edge cases: Treating every potential threat as equally likely; ignoring physical or
insider threats because they are less “glamorous.” Threats can be non-malicious (natural
disasters).
6. Analogy / mnemonic: Threat = “storm on the horizon” — it signals possible danger even
if it hasn’t struck. (Think T in R = LikeliTy × Impact.)
7. Practice Q: Give two examples of a human threat and two examples of a non-human
threat.

Malware Threats
1. Simple: Malicious programs that damage, steal, or disrupt.
2. Formal: Software designed to infiltrate, damage, or gain unauthorized control of devices
or networks (viruses, worms, ransomware, spyware, trojans).
3. Examples: Ransomware encrypting files; spyware exfiltrating keystrokes.
4. Relation: Malware exploits software/human vulnerabilities; detective controls (IDS/AV)
aim to detect it; backups and corrective controls remediate damage.
5. Pitfalls: Overreliance on signature-based antivirus (misses new variants); failing to isolate
infected hosts.
6. Analogy: Malware is like a parasite — it attaches to a host and spreads or consumes
resources.
7. Practice Q: What control(s) reduce the effectiveness of ransomware?
Phishing Threats
1. Simple: Deceptive messages that trick people into revealing secrets.
2. Formal: Social-engineering attacks using email, SMS, or calls to manipulate users into
disclosing credentials, clicking malicious links, or installing malware.
3. Examples: A spoofed bank email asking to “verify” your password; SMS with a fake
verification link.
4. Relation: Targets human vulnerabilities; best mitigated by training, MFA, and verification
procedures.
5. Pitfalls: Assuming only technical controls solve phishing — human training and processes
are essential.
6. Analogy: Phishing = bait on a hook; only a cautious user avoids taking the bait.
7. Practice Q: Name two procedural and two technical defenses against phishing.

DDoS Threats
1. Simple: Overwhelming a service so legitimate users can’t use it.
2. Formal: Distributed Denial of Service attacks use many compromised hosts to flood a
target’s resources (bandwidth, CPU, connections) to cause unavailability.
3. Examples: Botnet sending massive HTTP requests to a website; UDP flood saturating
network link.
4. Relation: Targets availability (CIA triad); mitigated by network-level controls, rate
limiting, and scalable architectures.
5. Pitfalls: Ignoring the business impact of temporary outages; assuming small sites are
immune.
6. Analogy: DDoS = a crowd blocking a store entrance so real customers can’t get in.
7. Practice Q: What architectural design reduces the impact of DDoS on web services?

Insider Threats
1. Simple: Authorized people who intentionally or accidentally harm systems.
2. Formal: Malicious or negligent actions by employees, contractors, or partners that result
in data loss, policy breaches, or service disruption.
3. Examples: An admin exfiltrating files; an employee misconfiguring a server.
4. Relation: Insider actions exploit human and procedural vulnerabilities; controls include
least privilege, monitoring, and separation of duties.
5. Pitfalls: Focusing only on external attackers and underestimating disgruntled or careless
insiders.
6. Analogy: Insider threat = a trusted employee using a master key to enter restricted rooms.
7. Practice Q: List two signals that might indicate an insider threat.

Physical Threats
1. Simple: Direct physical harm to hardware/infrastructure.
2. Formal: Tangible acts or events (theft, vandalism, tampering, environmental disasters)
that damage or compromise computing assets.
3. Examples: Stolen laptops, damaged network cables, data center fire.
4. Relation: Physical threats can lead to confidentiality, integrity, or availability loss;
physical controls (locks, CCTV, access badges) are required.
5. Pitfalls: Assuming cybersecurity alone covers physical risks; neglecting environmental
controls (fire suppression, HVAC).
6. Analogy: Physical threat = someone breaking into the building and stealing the safe.
7. Practice Q: Name three physical controls that reduce risk of hardware theft.

Vulnerability (and Types)

1. Simple: A weakness that can be exploited.
2. Formal: An inherent flaw or misconfiguration in hardware, software, procedures, or
human practice that can be exploited by a threat actor to cause harm.
3. Examples: Unpatched software, default passwords, exposed management ports, lack of
input validation in code.
4. Relation: Vulnerabilities are necessary for threats to become attacks; risk = likelihood ×
impact (vulnerabilities increase likelihood).
5. Pitfalls: Confusing vulnerability with exploit — a vulnerability is a potential, not the
realized harm.
6. Analogy / mnemonic: Vulnerability = unlocked window — not broken yet, but easy to
breach. (V for Vulnerable → V for Vulnerability window)
7. Practice Q: Differentiate a configuration error from a code bug as vulnerability examples.

Software Vulnerabilities
1. Simple: Flaws in code or libraries.
2. Formal: Bugs, insecure defaults, or unpatched components (buffer overflows, injection
flaws, unsafe deserialization) that allow attackers to alter behavior or gain control.
3. Examples: SQL injection, Heartbleed, outdated OpenSSL.
4. Relation: Common vector for malware and exploits; software security and patching reduce
exposure.
5. Pitfalls: Ignoring third-party dependencies (supply chain); failing to patch in a timely
manner.
6. Analogy: Software bug = a crack in the foundation of a house — small initially but can
lead to collapse.
7. Practice Q: What are SAST and DAST and when are they used?

Hardware Vulnerabilities
1. Simple: Flaws in chips, firmware, or design that attackers can exploit.
2. Formal: Defects in physical devices or their firmware (side-channel leaks like
Spectre/Meltdown, insecure boot, tampered supply chain) that undermine trust or reveal
secrets.
3. Examples: Spectre/Meltdown (speculative execution side-channels), compromised
firmware in network cards.
4. Relation: Harder to patch than software; may require firmware updates or physical
replacements and strong supply-chain controls.
5. Pitfalls: Assuming firmware is immutable or secure; neglecting vendor trust.
6. Analogy: Hardware flaw = a hidden tunnel under the bank vault that bypasses locks.
7. Practice Q: Why are hardware vulnerabilities often higher impact than software bugs?

Human Vulnerabilities
1. Simple: Weaknesses in people or processes.
2. Formal: Cognitive biases, lack of awareness, poor habits (weak passwords, clicking links),
or omission of procedures that make people susceptible to social engineering or mistakes.
3. Examples: Reusing passwords, falling for phishing, failing to follow backup procedures.
4. Relation: Humans are often the easiest attack vector; training + processes + technical
controls address this.
5. Pitfalls: Treating training as one-off checkbox; not measuring effectiveness.
6. Analogy: Human vulnerability = leaving the front door unlocked because you assume
everyone is honest.
7. Practice Q: What metrics show training is reducing phishing click-through rates?

Network Vulnerabilities
1. Simple: Weaknesses in network design or configuration.
2. Formal: Misconfigurations, weak encryption, open ports, lack of segmentation, or
insecure wireless that provide attackers access or allow eavesdropping.
3. Examples: Default router credentials, unencrypted Wi-Fi (WEP), exposed management
interfaces.
4. Relation: Network vulnerabilities enable lateral movement and data interception;
mitigated by segmentation, strong protocols, and secure config management.
5. Pitfalls: Trusting internal networks implicitly; forgetting to secure management interfaces.
6. Analogy: Network vulnerability = an unlocked alley that lets thieves sneak between
buildings.
7. Practice Q: How does network segmentation reduce the blast radius of a breach?

Controls (Safeguards) — Types and Deep

Meaning
Controls = safeguards that reduce likelihood or impact. Controls are grouped by function:
preventive, detective, corrective, administrative.

Preventive Controls
1. Simple: Stop bad things from happening.
2. Formal: Measures designed to prevent unauthorized actions or reduce exposure — e.g.,
firewalls, access control lists, strong authentication, secure coding.
3. Examples: MFA, input validation, network ACLs, patching.
4. Relation: Reduce likelihood of successful attacks; form the first line of defense in defense-
in-depth.
5. Pitfalls: Overrestrictive prevention harms usability; gaps in prevention still require
detection/correction.
6. Analogy: Preventive = locks and fences.
7. Practice Q: Give two preventive controls for protecting a web application.

Detective Controls
1. Simple: Find intrusions and suspicious events.
2. Formal: Mechanisms that identify, log, and report security events (IDS, SIEM, audit logs,
file integrity monitoring).
3. Examples: IDS alerts, log aggregation showing unusual login patterns.
4. Relation: Detection complements prevention by shortening dwell time and enabling
response; detection informs corrective actions.
5. Pitfalls: High false positives without tuning; insufficient logging granularity leaves blind
spots.
6. Analogy: Detective = burglar alarm and CCTV that tell you something happened.
7. Practice Q: What’s the difference between host-based and network-based detection?

Corrective Controls
1. Simple: Fix or restore after an incident.
2. Formal: Measures that restore systems and data to normal operation and reduce future
recurrence (backups, patch rollouts, disaster recovery, containment procedures).
3. Examples: Restoring from backup after ransomware; applying hotfixes; rebuilding
compromised hosts.
4. Relation: Corrective controls minimize impact and recovery time; they rely on good
detective controls to trigger.
5. Pitfalls: Unverified backups that are corrupted; slow recovery plans that worsen
downtime.
6. Analogy: Corrective = emergency services and backup vaults after a fire.
7. Practice Q: What makes a backup secure and reliable for recovery?
Administrative Controls
1. Simple: Policies and people-centric measures.
2. Formal: Governance-level documents and processes (security policies, role definitions,
training, incident response plans, change control) that steer behavior and enforce
accountability.
3. Examples: Acceptable use policy, separation of duties, mandatory training.
4. Relation: Administrative controls set the rules that technical controls implement; they
ensure consistent, auditable practices.
5. Pitfalls: Policies that are unrealistic or unenforced; lacking role clarity.
6. Analogy: Administrative = company rulebook and employee training.
7. Practice Q: How does separation of duties reduce fraud risk?

Risk — Definition, Formula, and

Components
1. Simple: The chance that something bad happens and how bad it would be.
2. Formal & formula: Risk = Likelihood × Impact. It’s the expected negative outcome when
a threat exploits a vulnerability affecting an asset.
3. Examples: High-likelihood phishing + high-impact access to payroll = high risk of payroll
fraud.
4. Relation: Risk ties together threats, vulnerabilities, assets, likelihood, and impact — it’s
the primary driver for prioritizing controls.
5. Pitfalls: Treating risk qualitatively without measurement; ignoring business context (high
impact for one org could be low for another).
6. Analogy: Risk = probability a storm hits × the value of property exposed (storm × house
value).
7. Practice Q: Given an asset worth $1M, likelihood 0.1, estimated impact 0.5 ($500k) —
compute the expected loss.

Components of Risk (each explained briefly)

Threat Component

 Simple: Source of potential harm (hacker, natural disaster).

 Practice Q: Give an example of a threat actor and their likely motive.

Vulnerability Component

 Simple: The weakness that enables exploitation.

 Practice Q: Identify a common vulnerability in public web apps.
Asset Component

 Simple: Anything valuable (data, servers, reputation).

 Practice Q: List 3 assets in an e-commerce site.

Impact Component

 Simple: Severity of consequences (financial loss, downtime, reputation).

 Practice Q: What non-financial impacts might follow a data breach?

Likelihood Component

 Simple: Probability an attack will succeed (influenced by exposure and

attractiveness).
 Practice Q: What factors increase likelihood of a successful phishing attack?

Security Goals (CIA + extras)

Confidentiality
Simple: Keep secrets secret.
Formal: Ensures information is accessible only to authorized parties.
Examples: Encryption, access control lists, data classification.
Pitfall: Overzealous confidentiality can block legitimate access and operations.
Analogy: Confidentiality = sealed envelopes.

Integrity
Simple: Keep data correct and unaltered.
Formal: Ensures accuracy, completeness, and trustworthiness of information.
Examples: Checksums, digital signatures, version control.
Pitfall: Focusing only on access without verifying correctness (accepted but corrupted data).
Analogy: Integrity = tamper-evident seal on a package.

Availability
Simple: Systems are usable when needed.
Formal: Ensures reliable access to information and services for authorized users.
Examples: Redundancy, failover clusters, DDoS mitigation.
Pitfall: Over-securing can reduce availability (too strict controls make systems unusable).
Analogy: Availability = keys and doors that always work when you need them.

Authenticity
Simple: Confirm the real identity of users or data sources.
Formal: Assurance that a user, device, or message is genuine and not forged (authentication
and provenance).
Examples: Digital certificates, PKI, signed emails.
Pitfall: Weak identity proofing leads to impersonation.
Analogy: Authenticity = checking an ID card.

Non-repudiation
Simple: Ensure actions or transactions cannot be denied later.
Formal: Providing cryptographic or procedural evidence that a particular party performed an
action (e.g., signed contract).
Examples: Digital signatures, immutable logs with trusted timestamps.
Pitfall: Poor key custody undermines non-repudiation (if private keys are shared, signatures
lose meaning).
Analogy: Non-repudiation = a signed receipt you cannot later claim you didn’t sign.

Accountability
Simple: Link actions to specific individuals or systems.
Formal: Ensuring that actions are traceable to responsible parties through logging,
authentication, and auditing.
Examples: Audit trails, user activity logs, role-based access controls.
Pitfall: Incomplete logs or shared accounts prevent accurate attribution.
Analogy: Accountability = CCTV footage that shows who entered a room.

Final quick checklist (use in lecture slides

or exam revision)
 Threat × Vulnerability → Attack → Impact on Asset = Risk.
 Controls: Preventive (stop), Detective (find), Corrective (fix), Administrative
(govern).
 Protect Confidentiality, Integrity, Availability — also ensure Authenticity, Non-
repudiation, Accountability.
 People are both strongest defense and weakest link — combine training + technical
controls.
 Prioritize by Risk (likelihood × impact), not by ease of implementation.

COMPUTER SECURITY — FINAL

EXAM (CONCEPTUAL)
Part A: Multiple Choice (30 Questions)
1. Which of the following best defines a threat in computer security?
A. A software patch
B. Any event or circumstance that can exploit a vulnerability and cause harm
C. A firewall configuration
D. Encryption algorithm
Answer: B
Explanation: A threat is any potential cause of harm that can exploit vulnerabilities,
affecting systems, data, or networks.

2. Malware, ransomware, spyware, and worms are examples of:

A. Human vulnerabilities
B. Malware threats
C. Preventive controls
D. Risk components
Answer: B
Explanation: Malware threats are malicious programs designed to damage, disrupt, or steal
data.

3. Which type of threat uses deceptive messages to trick users into revealing sensitive
information?
A. Insider threat
B. DDoS
C. Phishing
D. Malware
Answer: C
Explanation: Phishing is a social engineering tactic aimed at human vulnerabilities.

4. Distributed Denial of Service (DDoS) attacks primarily target:

A. Confidentiality
B. Availability
C. Integrity
D. Non-repudiation
Answer: B
Explanation: DDoS attacks flood systems to make them unavailable, affecting availability.

5. Insider threats occur when:

A. Only external hackers attack the system
B. Authorized individuals misuse access intentionally or accidentally
C. Firewalls fail
D. Network traffic is encrypted
Answer: B
Explanation: Insiders can exploit privileges, intentionally or by mistake, compromising
security.

6. Unpatched software, misconfigured routers, and weak passwords are examples of:
A. Threats
B. Vulnerabilities
C. Preventive controls
D. Assets
Answer: B
Explanation: These are weaknesses in systems that can be exploited by threats.

7. Which vulnerability can occur due to poor awareness or lack of training?

A. Hardware vulnerability
B. Human vulnerability
C. Network vulnerability
D. Application vulnerability
Answer: B
Explanation: Human vulnerabilities arise from errors, lack of training, or social engineering
susceptibility.

8. What is the primary purpose of a firewall?

A. Detect malware
B. Prevent unauthorized network access
C. Back up data
D. Train employees
Answer: B
Explanation: Firewalls are preventive controls that block unauthorized access.

9. Intrusion detection systems (IDS) are an example of:

A. Preventive controls
B. Detective controls
C. Corrective controls
D. Administrative controls
Answer: B
Explanation: IDS detect and alert on suspicious activity to inform response.

10. Backups and disaster recovery plans are examples of:

A. Preventive controls
B. Detective controls
C. Corrective controls
D. Human vulnerabilities
Answer: C
Explanation: Corrective controls restore normal operations after an incident.

11. Policies, training, and procedures are examples of:

A. Administrative controls
B. Preventive controls
C. Corrective controls
D. Network controls
Answer: A
Explanation: Administrative controls guide user behavior and enforce security practices.

12. Risk in computer security is calculated as:

A. Likelihood ÷ Impact
B. Likelihood × Impact
C. Threat + Vulnerability
D. Asset × Likelihood
Answer: B
Explanation: Risk = Likelihood × Impact; it quantifies potential harm.

13. Which component of risk is the valuable resource at stake?

A. Vulnerability
B. Asset
C. Threat
D. Likelihood
Answer: B
Explanation: Assets are the critical resources (data, servers, systems) exposed to risk.

14. The CIA triad consists of:

A. Confidentiality, Integrity, Availability
B. Control, Investigation, Authentication
C. Corrective, Internal, Administrative
D. Compliance, Integrity, Authentication
Answer: A
Explanation: CIA triad is the foundation of security goals.

15. Ensuring data is not altered or tampered with is called:

A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Answer: B
Explanation: Integrity protects accuracy, completeness, and trustworthiness of data.

16. Confirming the true identity of a user or system is called:

A. Authenticity
B. Availability
C. Accountability
D. Integrity
Answer: A
Explanation: Authenticity ensures the system or user is genuine.

17. Non-repudiation ensures that:

A. Actions or transactions cannot be denied
B. Only authorized users access data
C. Data is always encrypted
D. Threats are mitigated
Answer: A
Explanation: Non-repudiation provides evidence of action or transaction.

18. What is the main goal of network segmentation?

A. Increase encryption
B. Reduce the blast radius of attacks
C. Backup data more efficiently
D. Detect malware
Answer: B
Explanation: Segmentation isolates systems to limit damage from breaches.

19. A vulnerability that has no known exploit is:

A. Not a concern
B. Still a potential risk
C. A threat
D. An administrative control
Answer: B
Explanation: Even unexploited vulnerabilities can be targeted in the future.

20. Multi-factor authentication (MFA) is an example of:

A. Corrective control
B. Preventive control
C. Administrative control
D. Detective control
Answer: B
Explanation: MFA prevents unauthorized access by requiring multiple proofs.

21. A stolen laptop exposing sensitive data is an example of:

A. Physical threat
B. Malware threat
C. Phishing threat
D. Network vulnerability
Answer: A
Explanation: Physical threats involve tangible actions affecting hardware or infrastructure.

22. An attack flooding a web server with traffic is an example of:

A. Insider threat
B. DDoS
C. Phishing
D. Data minimization
Answer: B
Explanation: DDoS attacks compromise availability by overwhelming resources.

23. SQL injection is a type of:

A. Network vulnerability
B. Software vulnerability
C. Hardware vulnerability
D. Human vulnerability
Answer: B
Explanation: SQL injection exploits weaknesses in code or application design.

24. Side-channel attacks like Spectre and Meltdown exploit:

A. Software vulnerability
B. Hardware vulnerability
C. Human vulnerability
D. Network vulnerability
Answer: B
Explanation: Hardware-level flaws in CPU design allow sensitive data leaks.
25. Data masking is primarily used for:
A. Backup
B. Protecting sensitive data in non-production environments
C. Encrypting network traffic
D. Authenticating users
Answer: B
Explanation: Data masking substitutes sensitive data with fake but realistic values for
testing.

26. A security control that restores normal operation after an incident is:
A. Preventive
B. Detective
C. Corrective
D. Administrative
Answer: C
Explanation: Corrective controls fix problems and restore system availability.

27. Role-based access control (RBAC) is an example of:

A. Detective control
B. Preventive control
C. Corrective control
D. Administrative control
Answer: B
Explanation: RBAC prevents unauthorized access by enforcing least privilege.

28. Supply-chain risk involves:

A. Internal employee negligence
B. Third-party components introducing vulnerabilities
C. DDoS attacks
D. Backup failures
Answer: B
Explanation: Third-party dependencies can carry hidden vulnerabilities affecting the main
system.

29. Logging and monitoring primarily support:

A. Availability
B. Detection of incidents
C. Encryption
D. Physical security
Answer: B
Explanation: Logs and monitoring detect unauthorized activity and support investigations.

30. Defense-in-depth means:

A. Relying on one control
B. Layering multiple security controls (technical, procedural, human)
C. Encrypting all data
D. Using cloud services
Answer: B
Explanation: Multiple layers reduce risk and increase resilience.
Part B: Fill in the Blank (10 Questions)
1. A weakness that can be exploited by threats is called a vulnerability.
2. The primary formula to quantify risk is Risk = Likelihood × Impact.
3. Ensuring only authorized individuals can access information defines confidentiality.
4. Restoring systems after an incident is a function of corrective controls.
5. A stolen password due to phishing is an example of a human vulnerability.
6. Unauthorized actions by an employee are referred to as insider threats.
7. Measures like firewalls or access restrictions are examples of preventive controls.
8. Protecting data stored in the cloud includes cloud security and encryption.
9. SQL injection exploits a software vulnerability.
10. Confirming the source of a message to prevent denial is non-repudiation.

Part C: Short Answer (10 Questions)

1. Define threat and give an example.
Answer: Potential event capable of causing harm to a system or data; e.g.,
ransomware attack.
Explanation: Threats exploit vulnerabilities to impact assets.
2. What is the difference between preventive and detective controls?
Answer: Preventive controls block incidents (firewalls, RBAC), detective controls
identify incidents (IDS, logs).
Explanation: One stops attacks; the other detects them.
3. Explain CIA triad.
Answer: Confidentiality (authorized access only), Integrity (accuracy), Availability
(timely access).
Explanation: Fundamental security goals guiding control implementation.
4. Give an example of a human vulnerability.
Answer: Clicking phishing emails due to lack of training.
Explanation: Humans are often the weakest security link.
5. Describe risk in computer security.
Answer: Likelihood that a threat exploits a vulnerability × potential impact on assets.
Explanation: Helps prioritize security measures.
6. How does multi-factor authentication improve security?
Answer: Requires multiple proofs (knowledge, possession, biometric) reducing
unauthorized access likelihood.
Explanation: Strengthens authentication against stolen credentials.
7. Explain non-repudiation.
Answer: Providing evidence that a user performed an action or transaction that
cannot be denied.
Explanation: Achieved via digital signatures and audit logs.
8. Name two corrective controls.
Answer: Backups, disaster recovery plans.
Explanation: Restore normal operations after incidents.
 9. What is a physical threat? Give one example.
Answer: Threats targeting tangible infrastructure; e.g., theft of servers.
Explanation: Physical threats affect availability and confidentiality.
10. Define network vulnerability and provide an example.
Answer: Weakness in network configuration or protocol; e.g., default admin
password on router.
Explanation: Enables attackers to gain unauthorized access or eavesdrop.

Part D: True/False (10 Questions, conceptual paragraphs)

1. “Antivirus software alone is sufficient to prevent all malware threats; no other controls are
necessary.”
Answer: False
Explanation: Modern attacks include zero-day exploits, fileless malware, and social
engineering; layered defenses are essential.

2. “A vulnerability without a known exploit is not a risk and can be ignored.”

Answer: False
Explanation: Unexploited vulnerabilities may still be targeted in the future; proactive
mitigation is important.

3. “Confidentiality, integrity, and availability are independent and improving one has no
effect on the others.”
Answer: False
Explanation: These goals interact; e.g., strong confidentiality may limit availability.

4. “Incident response plans only require written documents; exercises or role assignments are
optional.”
Answer: False
Explanation: Plans must be tested with exercises, clearly defined roles, and

ChatGPT said:

communication channels to be effective.

5. “Phishing attacks are purely technical attacks and do not exploit human weaknesses.”
Answer: False
Explanation: Phishing primarily exploits human vulnerabilities like lack of awareness or
poor judgment.

6. “Corrective controls should be implemented before preventive controls.”

Answer: False
Explanation: Preventive controls block attacks; corrective controls respond after incidents;
both are essential but preventive comes first.
7. “Risk can be completely eliminated with sufficient controls.”
Answer: False
Explanation: Risk can be minimized but never fully eliminated; residual risk always exists.

8. “Insider threats are always malicious; accidental mistakes by employees do not count.”
Answer: False
Explanation: Insider threats include both intentional and unintentional actions compromising
security.

9. “Non-repudiation ensures accountability by linking actions to users and preventing denial.”

Answer: True
Explanation: Digital signatures and logs support non-repudiation and traceability.

10. “Layering preventive, detective, corrective, and administrative controls is the essence of
defense-in-depth.”
Answer: True
Explanation: Defense-in-depth uses multiple layers to reduce likelihood and impact of
attacks.

1. Availability
Definition: Ensuring that computer and network assets are accessible and usable by
authorized parties when needed.

Deep Explanation:
Availability is a core pillar of the CIA triad (Confidentiality, Integrity, Availability). It
requires that systems, services, and data remain operational even in the face of hardware
failures, software bugs, attacks, or natural disasters. Availability ensures business continuity
and uninterrupted access to critical resources.

Examples:

 A website remains responsive during a Distributed Denial of Service (DDoS) attack.

 Cloud storage services remain online for authorized users.

Relation to Other Concepts:

 Availability attacks are often linked to interruption attacks.

 Complementary to integrity and confidentiality; over-securing systems can sometimes
reduce availability.

Common Pitfalls:

 Assuming availability is automatic with redundant hardware.

 Ignoring software failures or misconfigurations that can cause downtime.

Analogy: Think of availability as the water supply to your house — it must be there when
you turn the tap.
Practice Question: Give an example of an attack that specifically targets availability.

2. Integrity
Definition: Ensuring data is accurate, complete, and unaltered except by authorized parties.

Deep Explanation:
Integrity protects against both intentional and accidental modifications, deletions, or additions
of messages or data. It guarantees that information transmitted across networks or stored in
databases remains trustworthy. Without integrity, decisions made using the data may be
flawed or harmful.

Examples:

 A financial transaction record cannot be altered without detection.

 Use of digital signatures to verify document authenticity.

Relation to Other Concepts:

 Integrity is often compromised in modification attacks.

 Related to authentication because knowing who modifies the data is critical.

Common Pitfalls:

 Focusing only on external threats and ignoring internal accidental errors.

 Not using verification mechanisms like hashes or checksums.

Analogy: Integrity = sealed letters that cannot be tampered with.

Practice Question: What cryptographic technique helps ensure integrity of a message?

3. Confidentiality
Definition: Ensuring information is accessible only to authorized users.

Deep Explanation:
Confidentiality prevents unauthorized disclosure of sensitive data. It requires identity
verification of users (authentication) and access control enforcement. Breaches in
confidentiality can lead to loss of privacy, theft of intellectual property, or regulatory
penalties.

Examples:

 Encryption of emails so only the recipient can read them.

  Role-based access control in databases.

Relation to Other Concepts:

 Closely tied with authentication and authorization.

 Interception attacks compromise confidentiality.

Common Pitfalls:

 Overlooking insider threats.

 Assuming technical controls alone ensure confidentiality without procedural
safeguards.

Analogy: Confidentiality = keeping your diary locked with a key.

Practice Question: Give an example of a breach of confidentiality.

4. Authentication
Definition: Verifying the true identity of users or systems.

Deep Explanation:
Authentication ensures that communicating parties are genuine and not impersonators. It is a
prerequisite for authorization. Techniques include passwords, biometrics, security tokens, and
certificates.

Examples:

 Logging into an email account with a password and OTP (Two-Factor

Authentication).
 Server verifying the identity of clients using SSL/TLS certificates.

Relation to Other Concepts:

 Authentication underpins confidentiality, integrity, and accountability.

 Without authentication, authorization cannot be reliably enforced.

Common Pitfalls:

 Weak passwords or single-factor authentication.

 Misconfigured authentication servers leading to unauthorized access.

Analogy: Authentication = checking the ID card of someone before letting them into a
restricted building.

Practice Question: Name two common authentication methods used today.

5. Authorization
Definition: Assigning access rights to different types of users based on their roles or
privileges.

Deep Explanation:
Authorization controls what an authenticated user is allowed to do within a system. It
enforces policies to prevent unauthorized access to sensitive resources.

Examples:

 Only network administrators can configure firewall settings.

 Regular users can read files but cannot delete them.

Relation to Other Concepts:

 Depends on proper authentication to verify user identity.

 Helps maintain confidentiality and integrity.

Common Pitfalls:

 Giving excessive privileges (privilege creep).

 Ignoring separation of duties in critical systems.

Analogy: Authorization = a VIP pass that allows access only to certain areas of a
building.

Practice Question: What is the difference between authentication and authorization?

6. Security Attacks
Definition: Intentional attempts to breach security controls by exploiting vulnerabilities.

Deep Explanation:
Security attacks aim to compromise confidentiality, integrity, or availability. They exploit
weaknesses in hardware, software, processes, or human behavior. Attacks can be passive
(eavesdropping) or active (tampering).

Types of Security Attacks:

 Passive Attacks: Monitoring traffic or intercepting data without altering it.

 Active Attacks: Injecting malware, modifying data, or disrupting systems.
 Social Engineering: Manipulating people to reveal confidential info.
 Physical Attacks: Theft of devices or tampering with hardware.
Relation to Other Concepts:

 Each attack targets one or more security goals (CIA + others).

Common Pitfalls:

 Ignoring social engineering as a serious threat.

 Assuming physical security is not part of cybersecurity.

Analogy: Attack = a burglar trying to enter a house through the weakest point.

Practice Question: Give one example of an active attack and one example of a passive
attack.

7. Categories of Attacks
Definition: Classification of attacks based on which security goal they compromise.

Categories:

 Interruption: Attacks on availability (e.g., DDoS).

 Interception: Attacks on confidentiality (e.g., packet sniffing).
 Modification: Attacks on integrity (e.g., data tampering).
 Fabrication: Attacks on authenticity (e.g., fake messages, identity forgery).

Analogy: Each attack type is like a different type of damage to a building — theft,
vandalism, fake documents, or blocked entrances.

Practice Question: Identify which category a ransomware attack falls into.

8. Security Policies
Definition: Documented rules outlining acceptable behaviors and procedures for maintaining
security.

Types of Security Policies:

 Access Control Policies: Who can access what.

 Data Protection Policies: How sensitive data is handled and stored.
 Incident Response Policies: How to detect, report, and recover from incidents.
 Acceptable Use Policies: How resources can be used.

Relation: Policies guide both technical and administrative controls.

Common Pitfalls: Policies exist only on paper but are not enforced or updated.

Analogy: Policies = the rulebook for employees to follow to stay safe.

Practice Question: Why is it important to have both technical and administrative

enforcement of policies?

9. Security Mechanisms
Definition: Tools or technologies that implement and enforce security policies.

Examples:

 Firewalls: Block unauthorized network traffic.

 Encryption: Protects confidentiality of data in transit or at rest.
 Multi-Factor Authentication: Strengthens authentication.

Relation: Mechanisms are the practical implementation of policies and controls.

Analogy: Security mechanisms = locks, alarms, and cameras in a building.

Practice Question: Name one mechanism that supports integrity.

10. Proactive Measures (Preventive

Controls)
Definition: Measures designed to prevent security incidents before they occur.

Examples:

 Strong password policies.

 Software updates and patching.
 Firewalls and access controls.

Relation: These are primarily preventive controls in the control taxonomy.

Analogy: Preventive = wearing a helmet to prevent head injury.

Practice Question: What is one proactive measure against social engineering attacks?
11. Detection Tools (Detective Controls)
Definition: Tools and processes to identify security anomalies or incidents.

Examples:

 IDS (Intrusion Detection Systems).

 SIEM (Security Information and Event Management).
 Antivirus scans.

Relation: Detective controls support corrective measures and incident response.

Analogy: Detective = smoke detectors and security cameras.

Practice Question: How does an IDS complement a firewall?

12. Deterrent Measures

Definition: Strategies aimed at discouraging attackers by increasing perceived risk or cost.

Examples:

 Visible security warnings.

 Legal prosecutions.
 User education programs.

Relation: Deterrents reduce likelihood of attack by affecting attacker behavior.

Analogy: Deterrent = “Beware of Dog” sign preventing break-ins.

Practice Question: Give two deterrent measures that protect digital systems.

This framework covers all the key terms from your notes in deep, conceptual ways, ready
for lecture notes, study guides, or exam preparation.

I can also generate a 50-question final exam (MCQ + short answer + T/F) specifically
based on these availability, integrity, confidentiality, authentication, authorization,
attacks, policies, mechanisms, controls, and deterrents — fully with answers and
explanations — similar to the last full exam I created.
COMPUTER SECURITY FINAL EXAM
(CONCEPTUAL)

Part A: Multiple Choice (30 Questions)

1. Availability ensures that:
A. Only authorized users can access data
B. Systems and services remain operational during attacks
C. Data cannot be modified
D. Users cannot deny their actions
Answer: B
Explanation: Availability ensures systems provide designated services even under attack or
failure.

2. Integrity guarantees that:

A. Data is encrypted
B. Data is altered only by authorized parties
C. Users are authenticated
D. Systems are always available
Answer: B
Explanation: Integrity protects against unauthorized modifications, whether accidental or
malicious.

3. Confidentiality ensures that:

A. Data is correct and complete
B. Only authorized parties can read the information
C. Systems remain operational
D. Users are held accountable
Answer: B
Explanation: Confidentiality prevents unauthorized disclosure of sensitive information.

4. Authentication is important because:

A. It verifies the true identity of parties
B. It enforces access rights
C. It encrypts messages
D. It monitors network traffic
Answer: A
Explanation: Authentication ensures that the communicating parties are genuine, preventing
impersonation.

5. Authorization is:
A. The process of verifying identity
B. The assignment of access rights based on user roles
C. Detecting network attacks
D. Encrypting data
Answer: B
Explanation: Authorization controls what authenticated users are allowed to do.

6. Passive attacks:
A. Modify or destroy data
B. Monitor or eavesdrop without changing data
C. Perform phishing
D. Physically steal servers
Answer: B
Explanation: Passive attacks gather information without altering the system.

7. Active attacks:
A. Monitor traffic only
B. Modify, inject, or destroy data
C. Log network activity
D. Educate users
Answer: B
Explanation: Active attacks directly interfere with systems or data.

8. Social engineering attacks exploit:

A. Hardware vulnerabilities
B. Human vulnerabilities
C. Software vulnerabilities
D. Network bandwidth
Answer: B
Explanation: Social engineering manipulates people to reveal confidential information.

9. Physical attacks involve:

A. DDoS attacks
B. Device theft or tampering with hardware
C. Malware injections
D. SQL injections
Answer: B
Explanation: Physical attacks target tangible resources to compromise security.

10. An attack that prevents a service from functioning is an attack on:

A. Integrity
B. Confidentiality
C. Availability
D. Authentication
Answer: C
Explanation: Denial-of-service attacks interrupt system availability.

11. An attack that reads sensitive data without authorization is:

A. Interruption
B. Interception
C. Modification
D. Fabrication
Answer: B
Explanation: Interception attacks compromise confidentiality.
12. An attacker altering messages in transit is performing:
A. Interception
B. Interruption
C. Modification
D. Fabrication
Answer: C
Explanation: Modification attacks compromise integrity.

13. Fabrication attacks involve:

A. Denial of service
B. Sending false messages to deceive users
C. Eavesdropping
D. Deleting data
Answer: B
Explanation: Fabrication attacks target authenticity by creating fake information.

14. Firewalls are examples of:

A. Detective controls
B. Preventive mechanisms
C. Corrective controls
D. Deterrents
Answer: B
Explanation: Firewalls prevent unauthorized access to network resources.

15. Encryption primarily protects:

A. Availability
B. Integrity
C. Confidentiality
D. Authorization
Answer: C
Explanation: Encryption ensures that only authorized parties can read the data.

16. Multi-factor authentication strengthens:

A. Integrity
B. Authentication
C. Availability
D. Deterrence
Answer: B
Explanation: MFA verifies identity using multiple verification factors.

17. Strong password policies are examples of:

A. Detective controls
B. Preventive measures
C. Corrective controls
D. Deterrents
Answer: B
Explanation: They proactively reduce the risk of unauthorized access.

18. IDS (Intrusion Detection System) is a:

A. Preventive mechanism
B. Detective control
C. Corrective control
D. Deterrent
Answer: B
Explanation: IDS identifies suspicious activities but does not block them.

19. Visible security warnings are an example of:

A. Detective control
B. Preventive control
C. Deterrent
D. Corrective control
Answer: C
Explanation: They discourage attacks by increasing perceived risk for attackers.

20. SIEM systems are used for:

A. Proactive prevention
B. Detection and analysis of security incidents
C. Restricting access
D. Encrypting data
Answer: B
Explanation: SIEM collects and analyzes logs to detect anomalies.

21. A DDoS attack is an example of:

A. Passive attack
B. Active attack
C. Deterrent
D. Corrective control
Answer: B
Explanation: DDoS actively disrupts services, affecting availability.

22. SQL injection targets:

A. Network availability
B. Application integrity
C. Physical security
D. User education
Answer: B
Explanation: SQL injection modifies or manipulates data, impacting integrity.

23. Role-based access control (RBAC) enforces:

A. Authentication
B. Authorization
C. Deterrence
D. Encryption
Answer: B
Explanation: RBAC limits user actions based on roles.

24. Incident response policies primarily guide:

A. Prevention of attacks
B. Detection and recovery after security events
C. Encryption standards
D. Firewall rules
Answer: B
Explanation: They define how to handle security incidents systematically.

25. Acceptable use policies define:

A. Which users can access what data
B. How organizational resources may be used
C. Backup schedules
D. Encryption methods
Answer: B
Explanation: These policies outline permissible behavior on company systems.

26. Deterrent measures reduce attacks by:

A. Preventing vulnerabilities
B. Increasing attacker’s perceived cost or risk
C. Detecting anomalies
D. Correcting errors
Answer: B
Explanation: Deterrents discourage attacks rather than directly preventing them.

27. Antivirus software is a:

A. Detective control
B. Preventive mechanism
C. Corrective control
D. Deterrent
Answer: B
Explanation: It proactively prevents malware infections.

28. Physical locks on servers are an example of:

A. Preventive control
B. Detective control
C. Corrective control
D. Deterrent
Answer: A
Explanation: Locks physically restrict unauthorized access.

29. Software patching is considered a:

A. Corrective measure
B. Preventive measure
C. Detective control
D. Deterrent
Answer: B
Explanation: Patching addresses known vulnerabilities before exploitation.

30. Security mechanisms implement:

A. Policies and controls
B. Attacks
C. Deterrents only
D. Corrective controls only
Answer: A
Explanation: Mechanisms are practical tools to enforce security rules.

Part B: Fill-in-the-Blank (10 Questions)

1. Ensuring systems remain operational for authorized users is called availability.
2. Data altered only by authorized parties maintains integrity.
3. Confidentiality prevents unauthorized access to sensitive information.
4. Verifying the identity of communicating parties is authentication.
5. Assigning permissions and rights is authorization.
6. Monitoring network traffic for anomalies is a form of detective control.
7. Enforcing strong password rules is a preventive measure.
8. Signs warning of surveillance serve as deterrent measures.
9. Denial-of-service attacks compromise availability.
10. Creating false messages to deceive recipients is called fabrication.

Part C: Short Answer (10 Questions)

1. Explain the difference between active and passive attacks.
Answer: Active attacks modify, inject, or destroy data; passive attacks only observe
without changing data.
2. What is a social engineering attack? Give an example.
Answer: Manipulating people to reveal confidential information; e.g., phishing
emails.
3. Define the term “deterrent” in computer security.
Answer: Measures to discourage attacks by increasing perceived risk or cost.
4. What is the role of incident response policies?
Answer: Guide detection, reporting, and recovery from security incidents.
5. How do firewalls help in security?
Answer: Block unauthorized network traffic and enforce access rules.
6. Give two examples of preventive controls.
Answer: Strong passwords, software patching.
7. Name two detective controls.
Answer: IDS, SIEM.
8. Explain the difference between authentication and authorization.
Answer: Authentication verifies identity; authorization assigns access rights.
9. What is a modification attack?
Answer: Unauthorized alteration of data impacting integrity.
10. Give an example of a fabrication attack.
Answer: Sending fake invoices or false emails claiming to be from management.

Part D: True/False (10 Questions)

1. Multi-factor authentication improves availability. False – It strengthens
authentication.
2. Social engineering attacks exploit technical vulnerabilities only. False – They exploit
human vulnerabilities.
3. Firewalls are preventive controls. True
4. Deterrent measures directly restore system functionality. False – They discourage
attacks.
5. Confidentiality ensures data is correct and complete. False – That is integrity.
6. Passive attacks include eavesdropping. True
7. Acceptable use policies define the use of organizational resources. True
8. DDoS attacks are passive attacks. False – They are active attacks affecting
availability.
9. Patching software addresses vulnerabilities before exploitation. True
10. Visible warnings and legal prosecutions are examples of deterrents. True