INFORMATION SECURITY SAQs – UNIT-WISE ANSWERS
📚 UNIT 1: Introduction to Information Security
1. What are the multiple layers of security?\ Information security is built on multiple layers to protect
data from various types of threats:
• Physical Security: Safeguards physical devices and locations from unauthorized access.
• Personnel Security: Protects people authorized to access systems from manipulation or
compromise.
• Operations Security: Protects the way in which operations are carried out, including procedures.
• Communications Security: Secures data during transmission through communication channels.
• Network Security: Protects the integrity of internal and external networks.
• Information Security: Maintains confidentiality, integrity, and availability of data.
2. What are the three main goals of Information Security?\ These goals form the CIA triad:
• Confidentiality: Ensures information is not disclosed to unauthorized individuals.
• Integrity: Ensures data is not altered or destroyed in an unauthorized way.
• Availability: Ensures reliable access to data and resources when needed.
3. What is the threat to information security?\ Threats include any potential cause of an unwanted
impact to a system or data, such as:
• Human threats (e.g., hacking, phishing, insider threats)
• Natural threats (e.g., floods, fires)
• Technical threats (e.g., software bugs, network failures)
4. How to balance security and access?\ An ideal system provides enough security without making
legitimate access difficult. This balance is achieved by:
• Granting access on a need-to-know basis.
• Using multi-factor authentication.
• Applying role-based access control.
5. What are the critical characteristics of information?
• Availability: Information is accessible when needed.
• Accuracy: Information is correct and free of errors.
• Authenticity: Information is genuine and from a trusted source.
• Confidentiality: Information is only accessible by authorized users.
• Integrity: Information remains unaltered.
• Utility: Information is useful for intended purposes.
• Possession: Ownership or control over information.
1
📄 UNIT 2: Legal, Ethical and Risk Issues
6. How to document the result of Risk assessments?\ Use a Ranked Vulnerability Worksheet containing:
• Asset Identification
• Asset Value
• Vulnerability Details
• Likelihood of Exploitation
• Potential Loss
• Risk Rating (Low/Medium/High)
7. What is risk management?\ It involves identifying, evaluating, and mitigating risks to organizational
assets. Main strategies include:
• Defense (prevent attacks)
• Transference (shift risk to third party)
• Mitigation (reduce impact)
• Acceptance (acknowledge and accept risk)
• Termination (avoid the risk entirely)
8. What is the purpose of certification and accreditation?
• Certification: A technical evaluation that security measures are properly implemented.
• Accreditation: A formal approval by management to operate the system based on certification
results.
10. List the Legal bodies of information security.\ Legal bodies include:
• U.S. Federal Laws (CFAA, HIPAA, SOX, etc.)
• International Laws (EU GDPR, WIPO)
• Regulatory Organizations (PCI-DSS, ISO/IEC)
• Government Agencies (NIST, NSA, FTC)
🔧 UNIT 3: Security Planning and Technology
9. What is the need of firewalls?\ Firewalls filter traffic between networks. They:
• Block unauthorized access
• Allow legitimate traffic
• Monitor incoming/outgoing data for threats
11. What are intrusion prevention systems (IPS)?\ IPS detects malicious activities and actively blocks
them in real time, unlike IDS which only alerts.
12. What is Intrusion Detection System (IDS)?\ IDS monitors network/system activity and sends alerts on
detecting suspicious behavior, helping in analysis and response.
2
13. What is a VPN (Virtual Private Network)?\ A VPN encrypts internet connections, creating a secure
private channel over public networks, ensuring privacy and anonymity.
14. What is meant by physical design in security?\ It refers to the arrangement of security devices
(firewalls, servers, routers) to physically and logically safeguard networks and data centers.
15. What are the general groups of system specific policy?
• Managerial Guidance: Sets user behavior rules.
• Technical Specifications: Details system configurations like ACLs and firewall rules.
16. Differentiate security certification from accreditation.
• Certification: Verifies if security features are properly installed.
• Accreditation: Authorizes system use based on certification outcome.
17. Two technical aspects of security implementation:
• Access Control Lists (ACLs): Define who can access what.
• Configuration Rules: Set operational rules for devices like firewalls or IDPS.
18. Define security management model.\ It provides a structured approach to secure organizational
assets by integrating people, processes, and technology with policies and controls.
🔒 UNIT 5: Implementation and Cryptography
19. What is cryptanalysis, and how does it differ from brute force attacks?
• Cryptanalysis: Uses logic, patterns, and analysis to break encryption.
• Brute Force: Tries all key combinations until the correct one is found.
20. Name any two cryptographic tools.
• Pretty Good Privacy (PGP)
• Secure Shell (SSH)
21. List any two cipher methods.
• Substitution Cipher: Replaces each letter with another.
• Transposition Cipher: Rearranges the letters without changing them.
22. What are cryptographic algorithms?\ Mathematical functions used for encryption and decryption
(e.g., AES, RSA).
23. What is the purpose of secure communication protocols?\ To ensure privacy, data integrity, and
authentication over communication networks (e.g., SSL, TLS, HTTPS).
3
24. What is cross-site scripting (XSS)?\ A type of attack where malicious scripts are injected into trusted
websites, executed in user browsers.
25. What is Secure Multi-party Computation (SMPC)?\ A cryptographic method allowing multiple parties
to compute a result without revealing their private data to each other.
Let me know if you want this exported as a PDF or formatted differently.
yup make a pdf