netsec quiz Drei

The practice and study of techniques for securing communication and data.

It ensures that data is not altered during transmission or storage.

It verifies that a message comes from the stated sender.

It ensures only authorized users can access information.

It ensures the sender cannot deny sending a message.

By using hash functions.

A one-way function that produces a fixed-size digest.

It has known security weaknesses.

It has cryptographic flaws.

A family of secure hash algorithms (SHA-256, SHA-384, SHA-512).

SHA-256, SHA-384, and SHA-512.

A hash function combined with a secret key.

Authentication and integrity.

Only parties with the shared secret key.

Encryption using the same secret key for encryption and decryption.

It is fast and uses less CPU.

128 bits.

Encryption using a public and private key pair.

Encrypting data.

Decrypting data.

1,024 bits or higher.

Securing HTTPS communications.

Secure remote server access.

Establishing secure IPsec VPN connections.

Email encryption.

A secure key exchange method without sending the key directly.

Protecting systems, networks, and data from cyber threats.

Anything valuable to an organization.

A weakness that can be exploited.

A potential cause of harm.

A method that takes advantage of a vulnerability.

The likelihood and impact of a threat exploiting a vulnerability.

Individuals or groups that attack systems.

Actors who exploit system weaknesses.

Hackers who expose vulnerabilities without malicious intent.

Hackers motivated by political or social causes.

Hackers backed by governments for espionage or sabotage.

Paths attackers use to enter systems.

External and internal.

When data is stolen, leaked, or destroyed.

Financial loss, legal penalties, and reputation damage.

Malicious software designed to harm systems or steal data.

Human error.

Confidentiality, integrity, and availability.

Malware that requires user action to spread.

Self-replicating malware that spreads automatically.

Malware disguised as legitimate software.

Malware that encrypts files and demands payment.

Malware that secretly collects user data.

Malware that hides itself with high-level access.

They protect against ransomware.

Layered security.

No, multiple defenses are required.

Authorized testing to find vulnerabilities.

Tools that detect known weaknesses.

Tools that capture network traffic.

They can be used for attack or defense.

Forging ARP messages to perform MITM attacks.

It has no authentication.

Hiding data inside DNS traffic.

A rogue server giving false network settings.

To assess risk and apply proper defenses.

They may contain hidden vulnerabilities.

Exploits appear quickly after vulnerabilities are disclosed.

A 2000 email worm that spread globally, overwriting files.

Onel de Guzman, a Filipino programmer.

Shutting down email systems, updating antivirus, restoring backups.

A 2023 ransomware attack that encrypted and leaked sensitive medical data.

Medusa ransomware group.

Shut down systems and worked with cybersecurity experts.

Attackers used HVAC vendor access to deploy BlackPOS malware.

\$202 million in losses.

Attackers intercepted SWIFT transactions using sniffers & MITM attacks.

\$81 million.

Exploited Apache Struts vulnerability CVE-2017-5638.

\$425 million in damages.

Weak SHA-1 hashing without salt exposed 165 million passwords.

Aircrack-ng used to capture wireless traffic, \$256 million loss.

Nessus used for IP spoofing & DoS attacks, \$171 million loss.

Hacktivist attack exposed data of ~55 million voters.

Pinoy Grayhats breached the student portal but did not leak data.

Chinese hackers stole Philippine military documents via cloud provider.

Shamoon malware destroyed 35,000 computers; recovery took 5 months.

Email system shutdown, antivirus updates, backups.

Multi-layered defense: backups, segmentation, education, patching.

Vendor access control, network monitoring, strong authentication.

Regular patching, strong hashing, salted passwords, vulnerability scanning.

Use secure protocols, VLAN segmentation, static ARP entries, DHCP snooping, DNS authentication.

User training, backups, MFA, layered security.

DLP tools, access control, encrypted devices, cloud security best practices.