Which two methods would provide two-factor authentication when used together?
A password and a fingerprint scan
A user logs in with their password and then enters a one-time code sent to their mobile phone. Why is this more secure than a password alone?
Someone who learns the password still cannot log in without the code
An employee needs to look at customer records but must not change or delete them. Which access level should they be given?
Read only
Why does locking the door of a server room help to protect an organisation's data?
It stops unauthorised people from reaching the servers
A company uses a key lock on its stock room door. Which of these is a drawback of this method of access restriction?
There is no record of who has entered or left the room
Which rule should staff follow when creating a strong password?
Use upper and lower case letters, numbers and symbols
Why is it a risk for a member of staff to use the same password on several different accounts?
If one account is hacked, the attacker can get into the others
Which of these is a benefit of using fingerprint recognition instead of a password to control access?
A user can identify themselves quickly
A hospital uses fingerprint recognition to let staff into its records room. Which of these is a drawback of this method?
A genuine user may be refused entry if their finger is injured
An organisation's password policy says that staff must change their password every 60 days. Why does this help to protect data?
A password that someone else has learned only works for a short time
A company gives every member of staff full control of its customer database. Why is this a risk to the data?
Any member of staff could change or delete records by mistake
An office asks staff to log in with a password and a one-time code sent to their mobile phone. Which of these is a drawback of this method?
Staff cannot log in if they do not have their phone with them
A company replaces the key lock on its stock room door with a key card swipe lock. Which of these is a drawback of using key cards?
A card has to be cancelled as soon as its owner leaves the company
A junior member of staff has been asked to produce a financial report but cannot open the files they need. What is the most likely cause?
Their level of permitted access is too low
What is the name for the method of identifying a user from a part of their body, such as a fingerprint, an iris pattern or their voice?
Biometrics
What is meant by levels of permitted access?
Settings that control which parts of a system a user can view or change
Which term describes measures such as locks, keycards and CCTV that stop an attacker from getting close to or touching equipment and data?
Physical security
What is meant by two-factor authentication?
A user identifies themselves using two different types of factor
Which term describes a secret string of letters, numbers and symbols that a user types in to prove who they are?
Password
Which of these is an example of something the user has when proving their identity?
A key fob
What is the purpose of a password checker?
It tells a user how strong or weak their password is
A firewall sits between a company's local area network and its internet connection. What is its main job?
Monitor and block incoming and outgoing traffic
A member of staff connects a personal USB memory stick to a work laptop. How does anti-virus software protect the laptop?
It scans the memory stick for malware before files are opened
A student ticks 'stay logged in' when signing in to a shared college computer. Why does this create a security risk?
The next person to use the computer can reach the account
A company wants to stop confidential files being copied from its laptops onto portable devices. Which device hardening method should it use?
Disable the unused USB ports on the laptops
A technician is about to replace a hard drive in a company server. Why should a backup be taken first?
So the data can be restored if the work causes a failure
A company encrypts the whole drive of every laptop it issues. Why does this protect the data if a laptop is stolen?
The data cannot be read without the decryption key
A padlock symbol is shown next to the web address of an online shop. What does this tell the customer?
Traffic between the customer and the site is encrypted
An online shop's checkout fills in a customer's saved address and card details automatically. Why does this create a security risk?
Anyone using the same device can enter the saved details
Anti-virus software finds a file infected with a trojan on a school computer. How does the software stop the trojan spreading?
It quarantines the file so the trojan cannot run
A firewall on a laptop displays an alert that a program is trying to connect to the internet. Why is this alert useful?
The user can decide whether the connection should be allowed
A hospital gives each employee access only to the patient records they need for their work. Why does this protect the data?
Employees cannot open or change records that are not part of their job
A technician removes an unused file-sharing program from a company computer. Why does this make the computer more secure?
It reduces the number of ways an attacker could get into the computer
A company sets its backup software to run every night without anyone starting it. Why is this better than asking staff to run the backups?
Backups are taken regularly without staff having to remember
Which term describes hardware or software that sits between a local area network and an external connection and monitors the traffic passing through it?
Firewall
What is meant by 'device hardening'?
Applying security measures such as closing unused ports, removing unused software and setting user access rights
What is the name for software that monitors a system, scans files, links and removable storage for threats, and removes or quarantines anything it finds?
Anti-virus software
What is the name for the scrambled, unreadable form of data that is produced when readable data is put through an encryption algorithm with a key?
Ciphertext
Which interface design feature helps to protect data by showing dots or asterisks instead of the characters a user types into a field?
Obscuring data entry
What is meant by a backup?
A copy of data taken automatically on a schedule or manually before a change, which allows the data to be restored after a major system failure
Which device hardening method involves installing updates that fix known security weaknesses in an operating system?
Applying security patches
Which term describes the list a firewall uses to decide which traffic is allowed through and which is blocked?
Access control list
Which of these best describes ethical hacking?
Breaking into a system to find weaknesses without causing damage
Which statement describes a white hat hacker?
An expert who is paid or invited to test a system
Which statement describes a grey hat hacker?
An outsider who finds a weakness without exploiting it for gain
Why do organisations employ penetration testers to attack their own systems?
To find weaknesses before an attacker can exploit them
Which of these would a penetration tester report as a security weakness?
Data and network traffic that are not encrypted
What is the purpose of an internal penetration test?
To find out how much damage a dishonest employee could cause
A penetration tester has gained access to a system and exploited a weakness. What should they do next?
Report the issues found and recommend improvements
Network logs show a large amount of data being sent to an unknown address at night. Why is analysing this data useful?
It can reveal a potential risk that needs investigating
A team of ethical hackers is hired to test a company's system. What must the team have before testing begins?
Authorisation to act from the company
What is meant by penetration testing?
Attempting to break into a system to find weaknesses
A company wants to find out whether staff are using its computers for personal activities. Which method would show this?
Checking the internet history saved on each computer
A company has fixed all of the weaknesses that a penetration test found. What should the company do next?
Test the system again to check the fixes work
Testers walked into a company office, plugged a laptop into an empty network socket and accessed the network. Which weakness does this show?
Poor physical security practice
During a penetration test, a tester finds that a server has not been updated for two years. Why does this make the server vulnerable?
Known weaknesses in the software are still unfixed
A company asks a team of testers to try to break into its network from outside the building. What is the team trying to find out?