Module 1

Section: 2-Marks Questions

1. Define the CIA triad and explain its importance in information security.
The CIA triad stands for Confidentiality, Integrity, and Availability, which form the foundational model
for building information security policies. It is extremely important because it helps organizations
evaluate their security setups comprehensively, ensuring that sensitive data is kept private, remains
accurate and unaltered, and is always accessible to authorized users when needed.
2. Differentiate between confidentiality and integrity with suitable examples.
Confidentiality ensures that sensitive information is only accessed by authorized individuals, such as
keeping a user's private bank account balance hidden from strangers. In contrast, integrity guarantees
that the information remains accurate and unaltered during storage or transmission, like ensuring that a
bank transfer amount of $100 is not secretly changed to $1,000 by a hacker in transit.
4. How does availability differ from confidentiality and integrity? Give one real-world example.
While confidentiality and integrity focus on keeping data secret and accurate, availability focuses
entirely on ensuring that authorized users have reliable, uninterrupted access to the systems and data
they need. A real-world example of availability is a hospital's patient database; even if the data is
highly secure and accurate, it is useless if doctors cannot access it during a medical emergency due to
a server crash or a cyber-attack.
5. What is a threat model? Why is it important in system design?
A threat model is a structured process used to identify, evaluate, and prioritize potential security
threats and vulnerabilities within a system. It is highly important during system design because it
allows developers to proactively build security measures into the software from the very beginning,
rather than trying to patch costly security holes after the system is already built and deployed.
6. Explain the concept of an adversary model in cybersecurity.
An adversary model defines the capabilities, goals, and resources of potential attackers who might
target a system. By understanding exactly who the attacker is—whether it is an insider, a financially
motivated hacker, or a well-funded nation-state—security teams can better predict attack methods and
design focused defenses that directly counter the specific skills of those attackers.
7. Describe the steps involved in developing a basic threat model for a web application.
Developing a basic threat model involves four main steps: identifying the critical assets of the
application, mapping out the system architecture and data flow, identifying potential threats using
frameworks like STRIDE, and finally, deciding on mitigation strategies to reduce those risks. This
structured approach ensures all logical security gaps are addressed before the application goes live.
7. Classify cyber-attacks based on network, host, and application layers.
Cyber-attacks can be broadly classified into three layers based on their specific target. Network-layer
attacks target the communication infrastructure and data in transit, host-layer attacks target the
operating system or individual computer devices, and application-layer attacks target logical
vulnerabilities within the actual software code or web applications.
8. Explain two examples of network-level attacks.
Two common network-level attacks are Distributed Denial of Service (DDoS) and Packet Sniffing. In a

Module 1 1
 DDoS attack, multiple compromised systems flood a target network with fake traffic, overwhelming it
and causing a service outage. In packet sniffing, an attacker intercepts unencrypted network traffic to
steal sensitive data, like login credentials, as it travels across the internet.
9. Describe two types of host-based attacks.
Two major types of host-based attacks include Malware infections and Privilege Escalation. Malware,
such as ransomware or Trojans, infects a specific computer to steal data or lock the user out of their
own files. Privilege Escalation occurs when an attacker gains basic access to a host device and
exploits a flaw to gain administrative permissions, allowing them full, unrestricted control over the
system.
10. Explain what is meant by an application-layer attack with an example.
An application-layer attack directly targets vulnerabilities in the code or design of a software
application rather than attacking the underlying network or operating system. A classic example is a
SQL Injection, where an attacker enters malicious database commands into a website's login form to
bypass authentication and steal sensitive user data directly from the backend database.
11. Define risk in the context of information security.
In information security, risk is the potential that a specific threat will successfully exploit a vulnerability
in a system, resulting in negative consequences like financial loss, a data breach, or reputation
damage. It is generally calculated as a combination of the likelihood of a cyber-attack occurring and
the potential impact it would have on the organization.
12. Differentiate between risk assessment and risk management.
Risk assessment is the specific, analytical process of identifying and evaluating potential risks to
determine their likelihood and impact on a system. Risk management is the broader, ongoing lifecycle
that includes the initial risk assessment, followed by implementing strategies to mitigate, transfer, or
accept those risks, and continuously monitoring the system over time.
13. Explain the concept of risk mitigation strategies with examples.
Risk mitigation strategies are proactive actions taken to reduce the likelihood or impact of a security
threat to an acceptable level. Good examples include installing firewalls to block malicious traffic,
implementing multi-factor authentication to prevent unauthorized access, and maintaining regular data
backups so an organization can recover quickly from a ransomware attack.
14. What is the significance of qualitative and quantitative risk analysis?
Both analysis types are essential for a complete risk evaluation. Qualitative risk analysis uses a
subjective scoring system (like high, medium, low) to quickly categorize risks based on experience,
making it easy to prioritize urgent threats. Quantitative risk analysis assigns actual financial values and
numerical probabilities to risks, providing solid data to justify the budget needed for security
investments.
15. Define authentication and explain its different types.
Authentication is the process of verifying the identity of a user or system attempting to access a
secure resource. Its main types are categorized by factors: something you know (like a password or
PIN), something you have (like a smart card or mobile token), and something you are (like a fingerprint
or facial recognition).
16. Differentiate between authentication and authorization.
Authentication is the process of verifying who the user is, which is typically done through a username

Module 1 2
 and password upon login. Authorization happens immediately afterward and determines what the
verified user is allowed to do, such as whether they have permission to read, edit, or delete a specific
file based on their assigned role.
17. Explain the working principle of the Role-Based Access Control (RBAC) model.
In the Role-Based Access Control (RBAC) model, access permissions are tied strictly to specific job
roles rather than to individual users. When a user joins an organization, they are assigned a role (such
as "Manager" or "Clerk"), and they automatically inherit all the system permissions required to perform
the duties of that role, making access management much simpler and more organized.
18. Describe the concept of Attribute-Based Access Control (ABAC) and how it differs from RBAC.
Attribute-Based Access Control (ABAC) grants access based on a flexible combination of user
attributes, resource attributes, and environmental conditions like time of day or location. Unlike RBAC,
which only looks at a static job role, ABAC provides highly dynamic and fine-grained control, allowing
strict rules like "Employees can only access these files during office hours from the company
network."
19. What is a security policy? Mention its key components.
A security policy is a formal, high-level document created by an organization that dictates how
sensitive information and technological resources should be managed and protected. Its key
components generally include a clear statement of purpose, defined roles and responsibilities, rules
for acceptable use of company assets, and the consequences of policy violations.
20. Explain the importance of Secure SDLC in software development.
A Secure Software Development Life Cycle (Secure SDLC) integrates security testing and safe coding
practices into every phase of software creation, from initial planning to final deployment. It is highly
important because it catches vulnerabilities early in the development process, which drastically
reduces the cost and effort of fixing security bugs compared to finding them after the software has
been released.

Section: 5-Marks Questions

1. Explain the CIA triad in detail. Discuss how failure in any one component can impact the overall
security of an organization with suitable examples.
The CIA triad—Confidentiality, Integrity, and Availability—is the fundamental framework for building
robust information security systems. Confidentiality ensures that sensitive data is kept completely
private and accessible only to authorized individuals. If confidentiality fails, an organization might
suffer a massive data breach, such as hackers stealing millions of customer credit card numbers,
leading to lawsuits and ruined reputation. Integrity guarantees that information remains accurate and
unchanged by unauthorized parties. If integrity fails, the consequences can be disastrous; for example,
a hacker might alter a patient's medical records or change the destination account of a large bank
transfer. Finally, Availability ensures that systems and data are always accessible to authorized users
when needed. A failure in availability, such as a Distributed Denial of Service (DDoS) attack taking
down an e-commerce website during a major holiday sale, can result in millions of dollars in lost
revenue and severe operational downtime.
2. Describe the process of threat modeling for a web-based application. Explain how identifying
assets, threats, and vulnerabilities helps in designing secure systems.
Threat modeling for a web application is a structured, proactive process used to identify and neutralize

Module 1 3
 potential security risks before the software is fully built. The process begins by identifying the
application's critical assets, such as user databases, payment gateways, and personal data. Next,
developers map out the system's architecture to see how data flows and pinpoint potential
vulnerabilities, like weak login pages or unencrypted data transfers. By actively brainstorming threats—
such as an attacker using SQL injection to steal passwords—the team can understand exactly how a
hacker might exploit these weak points. This comprehensive picture of assets, threats, and
vulnerabilities is absolutely vital for secure system design. It allows developers to implement targeted
security controls, such as strict input validation and strong encryption, exactly where they are needed
most, saving the organization time and money by preventing costly security breaches after
deployment.
3. Classify cyber attacks based on network, host, and application levels. Compare their
characteristics and provide examples for each category.
Cyber attacks are generally classified into three distinct levels based on the specific technological area
they target. Network-level attacks focus on the communication infrastructure, attempting to intercept,
alter, or disrupt data as it travels across the internet. A primary characteristic is overwhelming traffic or
eavesdropping, with classic examples being Distributed Denial of Service (DDoS) attacks and packet
sniffing. Host-level attacks bypass the network and directly target individual devices, servers, or
operating systems. These are usually characterized by malicious files or software that grant
unauthorized control to an attacker. Examples include ransomware that encrypts a local hard drive or
privilege escalation where a basic user account gains administrative rights. Lastly, application-level
attacks target logical flaws and vulnerabilities within the software code itself. These attacks are
dangerous because they often look like normal user traffic to security tools. A prime example is a SQL
injection, where malicious commands are entered into a website's login form to steal private backend
data.
4. Explain the steps involved in risk assessment and risk management. Discuss different risk
treatment strategies with examples.
Risk management is a continuous organizational lifecycle that begins with a thorough risk assessment.
The assessment step involves identifying valuable business assets, discovering potential threats and
system vulnerabilities, and then calculating both the likelihood of an attack occurring and the financial
impact it would cause. Once the risks are clearly scored and prioritized, the broader risk management
phase involves choosing appropriate risk treatment strategies. An organization can choose to mitigate
the risk by implementing direct security controls, such as installing advanced firewalls to block
hackers. They can transfer the risk to a third party, for example, by purchasing comprehensive
cybersecurity insurance to cover financial losses after a breach. If the cost of fixing a minor
vulnerability is far higher than the potential loss, management might simply accept the risk and monitor
it. Finally, they can avoid the risk entirely by shutting down a highly vulnerable legacy system or
discontinuing a risky business process.
5. Differentiate between authentication and authorization. Explain various authentication
mechanisms and their strengths and weaknesses.
Authentication and authorization are two distinct but tightly connected security processes.
Authentication verifies the specific identity of a user—confirming who they are—while authorization
occurs immediately afterward to determine what that verified user is allowed to do, such as accessing
or deleting specific files. Authentication mechanisms are divided into three main categories.
"Something you know," like a password or PIN, is very cheap and easy to implement, but its major

Module 1 4
 weakness is that it can be easily guessed, forgotten, or stolen. "Something you have," such as a
physical smart card or a mobile OTP token, offers much stronger security because it requires physical
possession of an item, though a weakness is that users can easily lose these devices. Lastly,
"Something you are" utilizes biometrics like fingerprints or facial recognition. This is highly secure and
convenient since physical traits cannot be easily shared or lost; however, it is expensive to set up and
raises significant privacy concerns if biometric data is ever compromised.
6. Compare and contrast Role-Based Access Control (RBAC) and Attribute-Based Access Control
(ABAC) models. Discuss their advantages, limitations, and suitable use cases.
Both RBAC and ABAC are popular models used to manage user permissions, but they operate using
very different logic. RBAC grants system access based strictly on a user's static job role, such as
"Manager" or "Clerk." Its main advantage is simplicity; it is incredibly easy to manage in structured
organizations because when an employee changes departments, their role is simply updated.
However, its limitation is a lack of flexibility, as it cannot enforce situational security rules. In contrast,
ABAC grants access based on dynamic attributes involving the user, the resource, and the
environment, such as time of day, location, or project clearance. ABAC's primary advantage is its
immense flexibility and fine-grained security control. It is perfectly suited for complex use cases like
healthcare, where a doctor might only be allowed to view patient records during their hospital shift and
from a secure hospital computer. The main limitation of ABAC is that it is highly complex and time-
consuming to initially design and maintain compared to the straightforward nature of RBAC.
7. Discuss how improper implementation of access control mechanisms can lead to security
breaches. Support your answer with relevant examples.
Access control mechanisms act as the internal security guards of a system, and their improper
implementation can quickly lead to devastating data breaches. When access controls are weak,
misconfigured, or overly permissive, unauthorized users can easily view, modify, or destroy sensitive
information. For example, if a company fails to enforce the principle of least privilege, a low-level data
entry employee might accidentally be given administrative rights. If that employee's account is
compromised by a hacker, the attacker instantly gains full, unrestricted control over the entire
corporate network. Another common failure is Broken Object Level Authorization (BOLA) in web
applications. In this scenario, a user might log into their bank account and simply change their account
number in the web browser's URL to another person's account number. If the backend system does
not properly verify that the user is actually authorized to view that new account, it will display the other
person's private financial data, resulting in a severe security breach.
8. Explain the importance of security policies in an organization. Describe the key components and
challenges in implementing effective security policies.
Security policies are absolutely crucial for an organization because they provide a formal, top-down
blueprint for how sensitive data and technology resources must be protected. They establish a strict
standard of behavior for employees, outline incident response plans, and form the necessary
foundation for legal compliance and security audits. Key components of a robust security policy
include a clear statement of purpose, clearly defined roles and IT responsibilities, guidelines for the
acceptable use of company internet and hardware, and the strict disciplinary consequences for policy
violations. Despite their importance, implementing these policies presents significant challenges. The
biggest hurdle is often employee resistance or a lack of awareness; if policies are too complex or
restrict productivity, employees may find dangerous workarounds that compromise security.
Additionally, keeping the policies continuously updated with the rapidly evolving landscape of cyber

Module 1 5
 threats requires constant effort, and enforcing the rules evenly across large, diverse departments can
be very difficult without strong executive support.
9. Describe the concept of Secure Software Development Life Cycle (Secure SDLC). Explain how
security can be integrated into each phase of SDLC.
The Secure Software Development Life Cycle (Secure SDLC) is the modern practice of embedding
security testing and safe coding measures into every single phase of software creation, rather than
treating security as an afterthought. This proactive approach drastically reduces the number of
vulnerabilities and fixes flaws when they are cheapest to resolve. During the initial planning and
requirements phase, teams identify necessary security goals and regulatory compliance needs. In the
design phase, developers perform threat modeling to map out potential attack paths and plan strong
security architectures. During the coding phase, programmers strictly follow secure coding guidelines
and use automated tools to scan the written code for known vulnerabilities. In the testing phase,
comprehensive security tests, including penetration testing, are conducted to actively try and hack the
software before release. Finally, during the deployment and maintenance phase, the live system is
continuously monitored for new threats, and regular security patches are developed to keep the
application safe over its entire lifespan.
10. Analyze the relationship between risk management and security controls. How do organizations
prioritize risks and allocate resources effectively?
Risk management and security controls share a direct cause-and-effect relationship; risk management
is the analytical process of identifying and evaluating the threats facing an organization, while security
controls are the physical, technical, or administrative tools deployed to neutralize those specific risks.
Because no organization has unlimited money to fix every single vulnerability, they must prioritize risks
to allocate their budget effectively. This is done by calculating a risk score, which multiplies the
likelihood of a cyber attack by the potential financial and operational impact it would cause. High-
priority risks—such as a critical vulnerability in a payment processing server—will receive immediate
attention and heavy resource allocation, leading to the deployment of strong preventive controls like
advanced firewalls and data encryption. Conversely, low-priority risks that pose minimal impact might
simply be accepted or passively monitored, ensuring that the organization does not waste valuable
time and money fixing minor issues while leaving critical business assets exposed.
11. Discuss various types of threat actors and their motivations. Explain how understanding
adversary behavior improves security posture.
Threat actors in cybersecurity come in various forms, each driven by entirely different motivations.
Script kiddies are generally unskilled attackers looking for a quick thrill or bragging rights by using
pre-made hacking tools. Insider threats are disgruntled or negligent employees who steal data or
cause system damage for revenge or personal financial gain. Hacktivists target specific organizations
to promote a political or social ideology, often by defacing websites or causing public service outages.
Cybercriminals are highly organized groups strictly motivated by money, frequently stealing credit
card data or launching ransomware attacks to extort companies. Lastly, Nation-state actors are
heavily funded government groups conducting corporate espionage or sabotage for global political
dominance. Understanding the specific behavior, capabilities, and goals of these adversaries is crucial
because it allows an organization to build a proactive, tailored security posture. If a bank knows it is
highly targeted by financial cybercriminals, it can heavily focus its budget on anti-fraud measures and
ransomware defenses rather than generic security software.

Module 1 6
 12. Explain different categories of cyber attacks and discuss appropriate preventive and detective
controls for each category.
Cyber attacks generally fall into three categories: network-level, host-level, and application-level
attacks, each requiring specific security controls. For network-level attacks, such as unauthorized
packet sniffing or DDoS, organizations use preventive controls like strong data encryption and firewalls
to block malicious traffic. The corresponding detective controls include Intrusion Detection Systems
(IDS) that alert IT staff when unusual traffic spikes occur. For host-level attacks, such as malware or
ransomware infecting a computer, preventive controls involve robust antivirus software and strict
policies that stop users from downloading unapproved applications. Detective controls for hosts
involve continuous endpoint monitoring and analyzing system logs to catch suspicious file behaviors.
Finally, for application-level attacks like SQL injections, preventive controls involve secure coding
practices, input validation, and using Web Application Firewalls (WAF) to filter out malicious web
commands. Detective controls in this category include regular automated vulnerability scanning and
monitoring application error logs to detect an attacker actively trying to exploit the code.
13. Examine the legal and ethical issues related to information security. Discuss the consequences
of non-compliance with cybersecurity laws and regulations.
Information security is deeply intertwined with complex legal and ethical issues, primarily centering
around user privacy, data protection, and corporate responsibility. Ethically, organizations have a duty
to heavily protect the personal information entrusted to them by their customers, ensuring they do not
misuse this data for profit or conduct overly intrusive surveillance on their employees without
transparency. Legally, companies must adhere to strict cybersecurity frameworks like GDPR or HIPAA,
which mandate high, specific standards for secure data handling. The consequences of non-
compliance with these laws are exceptionally severe. If a company suffers a data breach due to
negligence, it can face massive regulatory fines that run into the millions, alongside devastating class-
action lawsuits from affected individuals. Beyond immediate financial ruin, non-compliance heavily
damages the organization's public reputation, resulting in a massive loss of customer trust. In extreme
cases of deliberate negligence or cover-ups, corporate executives can even face criminal charges and
prison time.
14. Describe how authentication mechanisms and access control models together ensure secure
system operation. Provide a suitable example.
Authentication mechanisms and access control models work closely together as a two-step security
gateway to guarantee secure system operations. Authentication acts as the locked front door, utilizing
passwords, biometrics, or security tokens to verify the exact identity of the person trying to enter the
system. Once the user is successfully authenticated and allowed inside, the access control model—
such as Role-Based Access Control (RBAC)—acts as the interior security guard. It strictly dictates
exactly what that specific user is permitted to view, edit, or delete based on their authorized privileges.
For example, in a hospital's digital system, a nurse logs in using an ID badge and a secure PIN
(authentication). Once her identity is verified, the access control system recognizes her job role. It
permits her to view patient medical records to administer daily medication, but it completely blocks her
from accessing the hospital's financial payroll databases or altering doctors' surgical schedules
(authorization), ensuring all sensitive operations remain secure.
15. Discuss the role of security governance, policies, and compliance in protecting digital assets.
How do they contribute to organizational risk reduction?
Security governance, policies, and compliance form the strategic backbone of an organization's

Module 1 7
 defense, ensuring that cybersecurity is not treated just as a technical IT issue, but as a core business
priority driven by top management. Governance provides the leadership structure and strategic vision,
aligning security efforts with the company's overall business goals. Security policies act as the
practical, everyday rulebook; they clearly define acceptable employee behaviors, data handling
procedures, and the technical standards required to protect digital assets. Compliance ensures that the
organization strictly and consistently follows both these internal policies and external legal regulations,
like industry data protection laws. Together, they drastically reduce organizational risk by creating a
proactive, company-wide culture of security. By holding employees accountable, mandating regular
security audits, and ensuring that adequate budgets are allocated to critical defense systems, this
structured framework minimizes the likelihood of human error and effectively shields the company
from cyber threats and legal penalties.

Section: 10-Marks Questions

1. Explain the CIA triad in detail and analyze how it forms the foundation of information security.
Illustrate how confidentiality, integrity, and availability are maintained in a modern enterprise
system.
The CIA triad, consisting of Confidentiality, Integrity, and Availability, is the ultimate foundation of
information security because it provides a complete framework for protecting any digital asset.
Confidentiality ensures that data is kept private and is only seen by people who are authorized to see
it. Integrity ensures that the data is perfectly accurate, trustworthy, and has not been secretly changed
or corrupted. Availability ensures that the authorized users can quickly and reliably access the data
and systems whenever they need them for business operations. Together, these three pillars guide
every security decision; if an organization builds a system that ignores even one of these pillars, the
entire security posture collapses.
In a modern enterprise system, maintaining these three elements requires a combination of strong
tools and policies. To maintain confidentiality, an enterprise heavily relies on strong data encryption
(both when data is stored and when it is sent over the internet) and strict password policies. To
maintain integrity, the system uses digital signatures, regular data backups, and cryptographic
hashing, which acts like a digital fingerprint to detect if a file has been tampered with. To maintain
availability, the enterprise uses backup power supplies, multiple redundant internet connections, and
cloud-based load balancers that distribute web traffic evenly to prevent the servers from crashing
during high demand or a Distributed Denial of Service (DDoS) attack.
2. Describe the complete process of threat modeling for a software application. Explain how
identifying assets, attack surfaces, threat actors, and mitigation strategies improves system
security.
Threat modeling is a highly proactive process where developers think like hackers to find and fix
security weaknesses before the software is even built. The process starts by identifying the critical
assets, which are the most valuable pieces of data the application holds, such as user passwords or
credit card numbers. Next, the team maps out the attack surface, which includes all the possible entry
points a hacker could use to get into the system, like login pages, search bars, or API connections.
After this, they identify potential threat actors—ranging from automated botnets to skilled financial
hackers—and analyze what specific methods they might use to break in.

Module 1 8
 Once all the threats are identified and understood, the final step is to develop clear mitigation
strategies to block them. By formally identifying assets, developers know exactly what needs the
heaviest protection. By understanding the attack surface and the threat actors, they can accurately
predict where and how attacks will happen. Finally, creating mitigation strategies allows them to build
specific security controls, like input validation or encryption, directly into the code. This structured
process drastically improves system security because it is much cheaper and highly effective to
prevent vulnerabilities during the design phase rather than trying to fix a broken, live application after it
has already been hacked.
3. Classify and compare network-level, host-level, and application-level attacks. Discuss their
impact, detection mechanisms, and preventive controls with suitable examples.
Cyber attacks are classified into three main levels based on their target. Network-level attacks target
the communication pathways between computers. A common example is a Distributed Denial of
Service (DDoS) attack, which floods a network with fake traffic to cause a complete shutdown. The
impact is massive operational downtime. Organizations detect these attacks using Intrusion Detection
Systems (IDS) that monitor for unusual traffic spikes, and they prevent them using strong firewalls and
specialized traffic-filtering services. Because these attacks happen on the "highway" of data, they
affect the entire infrastructure at once.
Host-level attacks bypass the network and directly target individual computers or servers. An example
is a ransomware infection that locks a specific computer's hard drive. The impact is severe local data
loss and system hijacking. These attacks are usually detected by modern Antivirus software and
Endpoint Detection and Response (EDR) tools that scan for malicious file behavior. They are prevented
by keeping operating systems regularly patched and restricting users from downloading unapproved
software. Finally, Application-level attacks target the actual software code, such as a SQL Injection on
a website's login page. The impact here is direct database theft. These are detected by monitoring
application error logs and prevented by using secure coding practices and Web Application Firewalls
(WAF). While network and host attacks target the infrastructure, application attacks are highly targeted
and often look like normal user behavior, making them trickier to stop.
4. Explain the concepts of risk assessment and risk management in information security. Discuss
qualitative and quantitative risk analysis methods and various risk treatment strategies.
Risk management is the broad, continuous organizational lifecycle used to identify, evaluate, and
respond to cyber threats. Within this lifecycle is risk assessment, which is the specific, analytical step
of discovering system vulnerabilities, identifying potential threats, and calculating the damage an
attack would cause. To calculate this damage, organizations use two analysis methods. Qualitative risk
analysis is a subjective method that uses human experience to quickly group risks into categories like
"High," "Medium," or "Low." It is fast and great for prioritizing obvious threats. Quantitative risk
analysis, on the other hand, is a highly objective method that assigns real dollar values and
mathematical probabilities to risks (for example, calculating that a server crash has a 10% chance of
happening and will cost $50,000). This provides hard data to justify security budgets.
Once risks are assessed, the organization must decide on risk treatment strategies. They can choose
to "Mitigate" the risk by installing security tools, like putting an antivirus on computers to block
malware. They can "Transfer" the risk by buying cybersecurity insurance, shifting the financial burden
of a hack to an insurance company. If the cost to fix a minor issue is higher than the damage it would
cause, they might "Accept" the risk and simply keep an eye on it. Finally, they can "Avoid" the risk

Module 1 9
 completely by shutting down a highly vulnerable system or refusing to participate in a risky business
activity.
5. Differentiate between authentication and authorization. Explain different authentication
techniques and critically analyze their effectiveness in protecting systems.
Authentication and authorization are the two primary steps for granting secure access to a system.
Authentication is the process of proving who you are, usually by entering a username and password.
Authorization happens immediately afterward and dictates what you are allowed to do once inside,
such as whether you can read, edit, or delete a file. You cannot have authorization without first having
proper authentication.
Authentication techniques are grouped into three main factors. The first is "Something you know," like
a password or PIN. While it is extremely cheap and easy to set up, it is the least effective because
passwords can be easily guessed, stolen, or forgotten. The second is "Something you have," like a
physical smart card or a code sent to your mobile phone. This is highly effective because a remote
hacker cannot easily steal a physical object in your pocket, though users can sometimes lose their
phones. The third is "Something you are," which involves biometrics like fingerprint scanners or facial
recognition. This is the most effective and secure method because physical traits cannot be easily
shared or stolen; however, it is expensive to implement and raises significant privacy concerns. To
maximize effectiveness, modern systems combine two or more of these techniques, known as Multi-
Factor Authentication (MFA), making it incredibly difficult for attackers to break in.
6. Compare Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models
in detail. Discuss their architecture, policy enforcement mechanisms, advantages, limitations, and
real-world applications.
RBAC and ABAC are two distinct models used to control what users can do inside a system. In RBAC
(Role-Based Access Control), the architecture is built entirely around job titles. The enforcement
mechanism simply checks the user's assigned role—like "Manager" or "Intern"—and grants all the
permissions tied to that role. Its massive advantage is simplicity; it is very easy for IT teams to manage
because when a new employee joins, they are simply assigned a pre-configured role. However, its
limitation is a lack of flexibility; it cannot enforce situational rules. A real-world application of RBAC is a
corporate office where the HR department naturally gets access to payroll systems while the marketing
team gets access to social media accounts.
In contrast, ABAC (Attribute-Based Access Control) has a highly dynamic architecture based on
specific characteristics (attributes) of the user, the data, and the environment. Its enforcement
mechanism evaluates complex rules in real-time, such as "Is this user a manager AND using a
company laptop AND accessing the file during office hours?" Its main advantage is incredible flexibility
and fine-grained security, making it vastly superior for sensitive environments. Its limitation is that it is
highly complex and time-consuming to initially design and program. A real-world application of ABAC
is a military or healthcare system, where a doctor might only be allowed to view a specific patient's
medical history if they are currently inside the hospital and actively assigned to that patient's ward.
7. Discuss the importance of security policies and governance in organizations. Explain the process
of developing, implementing, and enforcing security policies.
Security governance and policies are essential because technology alone cannot protect an
organization; human behavior must also be controlled. Governance represents the leadership and
strategic vision, ensuring that cybersecurity efforts directly align with the company's broader business

Module 1 10
 goals and legal obligations. Security policies are the formal, written rules born from this governance.
They define exactly how employees should behave, how sensitive data must be handled, and what
technologies must be used, ensuring that everyone in the company is on the same page and held to
the same standard.
The process of managing these policies happens in three stages. First is "Developing," where a team
assesses the company's risks, reviews legal requirements, and drafts clear, readable rules—such as a
policy stating passwords must be 12 characters long. The second stage is "Implementing," which is
often the hardest part. It involves distributing the policy, heavily training the employees, and setting up
the IT infrastructure to support the new rules. The final stage is "Enforcing," which guarantees the
rules are actually followed. This involves conducting regular security audits, monitoring network
activity, and having clear disciplinary actions—ranging from a warning to termination—for employees
who repeatedly violate the security policies.
8. Describe the concept of Secure Software Development Life Cycle (Secure SDLC). Explain how
security controls can be integrated at each phase of the SDLC to prevent vulnerabilities.
The Secure Software Development Life Cycle (Secure SDLC) is the practice of embedding security
directly into every single stage of building a software application. In the past, companies would build
the entire software first and only test for security at the very end. This was dangerous and expensive
because finding a major flaw meant rewriting huge portions of the code. Secure SDLC "shifts security
left," meaning it starts at the very beginning of the project, drastically reducing the number of
vulnerabilities and making the final product inherently safer.
Security is integrated at every phase. During the "Planning" phase, developers identify the security
and privacy laws the software must follow. In the "Design" phase, the team performs threat modeling
to map out potential weaknesses before writing any code. During the "Development" phase,
programmers follow strict secure coding guidelines and use automated tools to scan their code for
common errors as they type. In the "Testing" phase, dedicated security teams perform heavy
penetration testing (ethical hacking) to try and break the software. Finally, during "Deployment and
Maintenance," the live application is continuously monitored for unusual activity, and regular patches
are created to fix any newly discovered vulnerabilities over time.
9. Analyze how improper access control, weak authentication, and poor policy enforcement can
lead to security breaches. Support your answer with examples.
Security breaches rarely happen due to a single failure; they are usually the result of multiple weak
points combining, specifically in access control, authentication, and policy enforcement. Weak
authentication is often the front door for attackers. If a company allows employees to use simple
passwords without requiring Multi-Factor Authentication (MFA), a hacker can easily guess the
password or buy it on the dark web. For example, if a hacker guesses a network administrator's weak
password, they easily bypass the first line of defense.
Once inside, improper access control turns a small intrusion into a massive disaster. If an organization
fails to follow the principle of least privilege, a low-level employee account might accidentally have
permission to view sensitive company financial records. If a hacker compromises that low-level
account, they instantly gain access to data they should never have been able to reach. Finally, poor
policy enforcement allows these bad practices to persist. If a company has a policy against sharing
passwords but never audits or enforces it, employees will write passwords on sticky notes. For
instance, an employee might leave a sticky note with their credentials on their desk, allowing an insider

Module 1 11
 threat (like a disgruntled coworker) to log in, bypass weak access controls, and steal customer
databases without leaving a personal trace.
10. Examine various legal and ethical issues in cybersecurity. Discuss data protection laws, privacy
concerns, intellectual property rights, and ethical responsibilities of IT professionals.
Cybersecurity is heavily bound by both strict laws and complex moral guidelines. On the legal side,
data protection laws like GDPR in Europe and HIPAA in healthcare legally force organizations to secure
personal user data. If a company is hacked due to negligence, these laws allow governments to issue
massive financial fines and allow users to sue the company. Privacy is another major concern;
companies must legally balance their need to monitor their network for threats without unethically
spying on their employees' personal communications. Additionally, intellectual property rights require
companies to protect their own trade secrets from cyber espionage while ensuring they do not illegally
use pirated software to run their business.
Beyond the law, IT professionals carry heavy ethical responsibilities. Because system administrators
have the "keys to the kingdom," they can access almost any file or email in the company. Ethically, they
must never abuse this power for personal curiosity, revenge, or financial gain. Furthermore, ethical
hackers (white-hats) who find vulnerabilities in software have a moral duty to report these flaws
directly to the software creator responsibly, giving them time to fix it, rather than publicly exposing the
flaw on the internet where malicious hackers can exploit it.
11. Discuss how risk management, threat modeling, and attack taxonomy collectively contribute to
building a resilient cybersecurity framework in an organization.
Building a highly resilient cybersecurity framework requires a layered, strategic approach, and this is
perfectly achieved by combining risk management, threat modeling, and attack taxonomy. Risk
management acts as the strategic compass for the organization. It identifies the most valuable
business assets and calculates which threats pose the biggest financial danger, allowing leadership to
prioritize their limited security budget effectively. Instead of trying to protect everything equally, risk
management points the organization toward what matters most.
Once the critical priorities are set, threat modeling provides the proactive defense. Developers and
security teams look closely at the high-risk systems identified by management and deeply analyze
how an attacker might try to break into them, fixing design flaws before the system goes live. Finally,
attack taxonomy—which is the structured classification of different cyber-attacks (like network, host,
or application attacks)—gives the IT team the specific tactical knowledge they need. By understanding
exactly how a DDoS attack or a SQL injection works, the team can select and deploy the exact
technical tools (like firewalls or WAFs) needed to stop them. Together, these three concepts ensure the
organization is strategically focused, proactively designed, and tactically prepared.
12. Consider a case where an organization is migrating to cloud infrastructure. Discuss how CIA
principles, access control models, risk assessment, security policies, and Secure SDLC practices
should be applied to ensure secure deployment.
Migrating an entire organization's digital assets to the cloud is a massive undertaking that requires
every pillar of cybersecurity. First, the CIA principles must be strictly enforced: Confidentiality is
maintained by heavily encrypting all company data before it is uploaded to the cloud, Integrity is
ensured by using data hashing to verify that files don't get corrupted during the transfer, and
Availability is guaranteed by choosing a cloud provider with a strong uptime SLA (Service Level
Agreement) and backup data centers. Before the move, a thorough Risk Assessment must be

Module 1 12
 conducted to identify vendor-specific risks, such as what happens if the cloud provider itself is hacked
or goes out of business.
Once in the cloud, Access Control models become critical. The organization should implement
Attribute-Based Access Control (ABAC) or strict Role-Based Access Control (RBAC) paired with Multi-
Factor Authentication (MFA) to ensure that only authorized employees can access the cloud portal
from safe locations. Simultaneously, Security Policies must be completely updated to reflect the new
environment, setting strict rules for remote work and cloud data sharing. Finally, the development
teams must apply Secure SDLC practices. Because cloud environments are different from local
servers, developers must proactively design their applications to use secure cloud-native APIs and
continuously scan their code to prevent cloud misconfigurations that could expose sensitive data to
the public internet.

Module 1 13