Information Security MCQs with Answers
Practice important Information Security MCQs with answers and explanations.
Chapter: 20
Q401:
What aspect of security policy addresses the level of service provided?
A. Availability
B. Integrity
C. Confidentiality
D. Authorization
Correct Answer:
A
Chapter: 20
Q402:
What is the distinction between a security policy and a security mechanism?
A. A policy defines secure states; a mechanism enforces the policy
B. A policy is a technical specification; a mechanism is a conceptual framework
C. A policy is an application; a mechanism is a network protocol
D. A policy is a system hardware feature; a mechanism is a software tool
Correct Answer:
A
Chapter: 20
Q403:
Which policy deals with the protection of sensitive information during transactions?
A. Confidentiality Policy
B. Integrity Policy
C. Availability Policy
D. Authorization Policy
Correct Answer:
A
Chapter: 20
Q404:
What is the role of a policy model?
A. To represent a particular policy or set of policies
B. To enforce the security policy
C. To analyze security breaches
D. To design network hardware
Correct Answer:
A
Chapter: 20
Q405:
What does a buffer overflow typically cause in a system?
A. Execution of unintended instructions
B. System performance enhancement
C. Improved security features
D. Prevention of unauthorized access
Correct Answer:
A
Chapter: 20
Q406:
In the example provided, what is an implicit policy?
A. A policy that is not clearly defined but assumed to be understood
B. A mechanism that explicitly enforces security rules
C. A language for writing security constraints
D. A formal statement of security requirements
Correct Answer:
A
Chapter: 20
Q407:
How does a security policy relate to a formal proof?
A. A formal statement of the policy allows proving desired properties
B. A formal proof is used to implement security mechanisms
C. A formal proof verifies system hardware components
D. A formal statement describes system vulnerabilities
Correct Answer:
A
Chapter: 20
Q408:
What type of policy is exemplified by restricting actions of Java programs downloaded via a web browser?
A. High-Level Policy Language
B. Low-Level Policy Language
C. Confidentiality Policy
D. Integrity Policy
Correct Answer:
A
Chapter: 20
Q409:
What is the purpose of the UNIX-based xhost command in the X11 windowing system?
A. To control access based on host name or IP address
B. To encrypt communications between users
C. To manage system software installations
D. To monitor network traffic
Correct Answer:
A
Chapter: 21
Q410:
What is the primary focus of a military (governmental) security policy?
A. Confidentiality
B. Integrity
C. Availability
D. Availability and Integrity
Correct Answer:
A
Chapter: 21
Q411:
What is the main concern of a commercial security policy?
A. Confidentiality
B. Integrity
C. Availability
D. Compliance with regulations
Correct Answer:
B
Chapter: 21
Q412:
Which type of security policy deals only with confidentiality?
A. Military policy
B. Commercial policy
C. Integrity policy
D. Confidentiality policy
Correct Answer:
D
Chapter: 21
Q413:
What is a key characteristic of a discretionary access control (DAC)?
A. The owner can set access permissions based on identity
B. The system enforces access rules based on attributes
C. Access is controlled by an external authority
D. Permissions are predefined and cannot be altered
Correct Answer:
A
Chapter: 21
Q414:
What type of access control is described as rule-based access control?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Originator Controlled Access Control (ORCON)
Correct Answer:
B
Chapter: 21
Q415:
What does an Originator Controlled Access Control (ORCON) mechanism focus on?
A. The creator of the information controls access to it
B. The system enforces access based on predefined rules
C. The owner of the information controls access to it
D. The access control is based on user roles
Correct Answer:
A
Chapter: 21
Q416:
What role does trust play in the context of applying security patches?
A. It affects the effectiveness of the patch based on various assumptions
B. It ensures that the patch will be automatically updated
C. It guarantees that the patch will work with all systems
D. It prevents any conflicts between different software patches
Correct Answer:
A
Chapter: 21
Q417:
Which access control allows users to set permissions based on their identity?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Originator Controlled Access Control (ORCON)
Correct Answer:
A
Chapter: 21
Q418:
Which policy type primarily aims to prevent data tampering?
A. Commercial security policy
B. Military security policy
C. Confidentiality policy
D. Integrity policy
Correct Answer:
A
Chapter: 21
Q419:
What assumption is NOT involved when installing a security patch?
A. The patch is correctly installed without errors
B. The patch came from a legitimate vendor
C. The patch has been tested in all possible environments
D. The patch is applied only in the vendor's environment
Correct Answer:
C
Chapter: 21
Q420:
What does a confidentiality policy typically handle?
A. The protection of confidential information only
B. Authorized ways to alter information
C. Levels of service and accessibility
D. Integrity of transactions
Correct Answer:
A