CS419 Exam 2

100 Points - 25 Questions - 4 Points each

For each statement, select the most appropriate answer.

1. Why might a company configure a device to use biometric authentication with a higher FAR (false acceptance rate)?
   (a) So that it will be easier to add multifactor authentication.
   (b) For improved security, since that also implies a higher FRR (false rejection rate).
   (c) To comply with international biometric data collection regulations that mandate higher FARs.
   (d) To provide a better user experience.
2. Which of the following is an example of a behavioral biometric?
   (a) Iris pattern.
   (b) Signature dynamics.
   (c) Facial recognition.
   (d) Palm print.
3. How does biometric authentication differ from other authentication systems, such as passkeys?
   (a) Biometric authentication is much more secure than passkeys or passwords.
   (b) Biometric authentication is a form of two-factor authentication, providing more robust security.
   (c) Biometric authentication uses thresholds to allow for variations in data.
   (d) Biometric authentication can be performed faster and more efficiently than using either passkeys or passwords.
4. How do hash pointers contribute to the immutability of a blockchain?
   (a) By ensuring that any change in the content of a block would invalidate the hash pointer in the next block.
   (b) By encrypting the contents of each block.
   (c) By linking blocks with a unique identifier that does not depend on the block's content.
   (d) By hashing the pointer so that attackers cannot identify the reference.
5. The price of Bitcoin recently increased in anticipation of the upcoming halving event. Halving is when:
   (a) The payment for adding a block to the chain gets cut in half.
   (b) The fee for each transaction is reduced by 50%.
   (c) The time to add a block to the blockchain is cut in half, which will double the transaction rate.
   (d) The mining difficulty will be cut in half, making adding a block to the chain more computationally efficient.
6. Computing a proof of work in Bitcoin is:
   (a) Discovering a number that results in a hash smaller than some specified value.
   (b) Proving that every single transaction in a block is valid.
   (c) Computing the inverse of a hash.
   (d) A negotiation process among servers to agree on the transaction details before recording them on the blockchain.
7. The setuid (set user ID) mechanism in Linux/Unix systems:
   (a) Allows a program to run with the authority of the user running the program rather than the program's owner.
   (b) Allows a program to run with the authority of the owner of the file rather than the user who is running it.
   (c) Enables users to change their login name while keeping the same underlying user ID.
   (d) Enables the operating system to generate a unique numeric user ID for a user.
8. The first versions of Microsoft Windows did not use timer interrupts. What was the side effect of this?
   (a) A process could freely overwrite any files in the system.
   (b) The operating system could not protect a process from overwriting memory used by another process.
   (c) A process could keep other processes from running.
   (d) Race conditions between two processes could arise, leading to security vulnerabilities.
9. Which statement is true about capability lists?
   (a) A capability list is part of an Access Control List and is a set of access permissions for a specific user or group.
   (b) Capability lists define the set of computer resources that a process requires to execute correctly.
   (c) A capability list enumerates the privileged system calls that a process is permitted to invoke.
   (d) A capability list is a slice of an Access Control Matrix representing all resources a user can access.
10. In a strict implementation of the Bell-LaPadula which operation cannot take place?
    (a) A user with top-secret clearance writes a secret document.
    (b) A user with top-secret clearance reads a top-secret document.
    (c) A user with secret clearance writes a top-secret document.
    (d) A user with top-secret clearance reads a secret document.
11. How are access rights determined in a Mandatory Access Control (MAC) system?
    (a) Users determine their own access rights, subject to approval by a central IT department.
    (b) Through a centralized policy set by the system administrator, which cannot be modified by end users.
    (c) Based on the roles assigned to each user within an organization, adjusting access as users change positions.
    (d) Access rights are determined by the file or resource owner, who sets permissions for other users.
12. Which access control model was designed to prevent a process from overwriting "more important" files?
    (a) Bell-LaPadula.
    (b) Role-Based Access Control.
    (c) Biba.
    (d) Chinese Wall.
13. Which security model will change object access permissions based on what objects you read in the past?
    (a) Bell-LaPadula.
    (b) Biba.
    (c) Role-Based Access Control.
    (d) Chinese Wall.
14. A stack canary is:
    (a) A thread that monitors the behavior of the stack, checking for overwrites of the return address.
    (b) A technique to place the stack at random memory locations each time the program is run.
    (c) Compiler-generated code that adds checks to ensure a function cannot overflow its buffers.
    (d) Data on the stack that, if overwritten, indicates that there is a risk of the return address having been overwritten.
15. A return-to-libc attack:
    (a) Requires modifying only the frame (base) pointer and not the return address on the stack.
    (b) Does not involve placing executable code in the buffer.
    (c) Overwrites only the return address on the stack and does not modify any buffer contents.
    (d) Exploits weaknesses in standard libraries rather than in the application.
16. In buffer overflow attacks, unsafe functions are those that:
    (a) Might accidentally overwrite their own stack frame.
    (b) Use local variables that are allocated on the stack.
    (c) Write data into an array without knowing the size of the array.
    (d) Contain bugs in their implementation.
17. Address Space Layout Randomization (ASLR):
    (a) Makes it difficult to inject meaningful memory locations into the stack or heap.
    (b) Makes it impossible to overflow the function's stack frame.
    (c) Prevents heap buffer overflows in addition to stack buffer overflows.
    (d) Mixes up the ordering of the stack, heap, static data, program code, and libraries in memory.
18. A shadow stack:
    (a) Is a backup copy of the main stack.
    (b) Stores only a function's parameters and local variables but not return addresses.
    (c) Stores a sequence of stack frames.
    (d) Only stores return addresses.
19. Return Oriented Programming (ROP) is designed to get around:
    (a) Stack canaries.
    (b) Address Space Layout Randomization (ASLR).
    (c) Data Execution Prevention (DEP).
    (d) Encrypted pointers.
20. An integer overflow in C might:
    (a) Create an overflow into adjacent memory.
    (b) Turn a positive number into a negative one.
    (c) Lose precision by truncating the least significant bits.
    (d) Cause a process to exit with an exception.
21. What can replace the need for setuid programs on Linux?
    (a) Control groups.
    (b) Chroot.
    (c) Namespaces.
    (d) Capabilities.
22. The first isolation mechanism in Unix was chroot. What isolation did it provide?
    (a) Limited access to the file system.
    (b) Restricted access to privileged system calls.
    (c) A separate virtualized network interface.
    (d) Limitations on how much memory or CPU time a process could use.
23. An example of a TOCTTOU vulnerability is:
    (a) Creating a query that contains a string provided by the user.
    (b) Deleting an empty file.
    (c) Creating a file with read-write permissions for everyone.
    (d) Checking that a user-provided filename does not contain a / character before creating the file.
24. Command injection may be possible when:
    (a) Prepared statements were used to include user-supplied parameters in a database query.
    (b) A system does not use data execution protection (DEP).
    (c) User input is used as an argument in a command.
    (d) A program doesn't check buffer limits.
25. What is a common goal of a pathname parsing attack?
    (a) To cause a denial of service by creating recursive links.
    (b) To intercept and modify data in transit between the client and server.
    (c) To change access permissions on files, making them accessible to the attacker.
    (d) To gain access to files or directories that the server should not provide.