Quiz: IT Fundamentals Module 06: Security Fundamentals (Module 06 of 06)

What is the primary purpose of authentication?

What is the primary purpose of authorization?

Which of the following is the correct order of operations when a user accesses a system?

True or False: Logging in with a username and password is an example of authentication.

A user logs into a company application and can view reports but cannot delete them. Which concept controls what the user can and cannot do after logging in?

In your own words, explain the difference between authentication and authorization. Give one example of each.

Which of the following is considered a weak password?

Why is reusing the same password across multiple websites dangerous?

What is the primary purpose of a password manager?

True or False: A password manager allows you to use a single strong, unique password for every account without having to memorize each one individually.

Which of the following is a best practice for creating strong passwords? (Select THREE.)Select multiple

What does MFA stand for?

Which of the following best describes multi-factor authentication (MFA)?

Which of the following are common categories of authentication factors? (Select THREE.)Select multiple

A user logs in with a password and then enters a six-digit code from an authenticator app on their phone. Which type of security is this an example of?

True or False: MFA is less secure than using a password alone because it adds complexity.

In your own words, explain why MFA significantly improves account security compared to using only a password.

What is encryption?

What is the difference between plaintext and ciphertext?

In symmetric encryption, how many keys are used?

In asymmetric encryption, how many keys are used?

Which of the following correctly describes a key difference between symmetric and asymmetric encryption?

True or False: In asymmetric encryption, the public key can be shared openly, but the private key must be kept secret.

What does "encryption at rest" protect?

What does "encryption in transit" protect?

A company stores customer records in a database and encrypts the database files on disk. Which type of encryption is this?

When you visit a website using HTTPS, your browser and the server encrypt the data exchanged between them. Which type of encryption is this?

What does HTTPS stand for?

What is the role of TLS (Transport Layer Security) in HTTPS?

True or False: A website using HTTP (without the "S") transmits data in plaintext, meaning anyone who intercepts the traffic can read it.

How can you tell if a website is using HTTPS?

What is the principle of least privilege?

A web application needs to read images from a storage service. According to the principle of least privilege, what permissions should it have?

True or False: The principle of least privilege helps limit the damage that can occur if a user's credentials are compromised.

What is a firewall?

Which of the following best describes how a firewall works?

True or False: A firewall can block incoming traffic on specific ports while allowing traffic on other ports.

What is phishing?

Which of the following is a common sign of a phishing email? (Select THREE.)Select multiple

What is malware?

Which of the following are types of malware? (Select THREE.)Select multiple

What is social engineering in the context of cybersecurity?

True or False: Social engineering attacks target human behavior rather than technical vulnerabilities in software.

A developer is building a web application that connects to a database. Where should they store the database password?

Why is hardcoding secrets (such as API keys, passwords, or tokens) directly in source code considered a serious security risk?

True or False: Environment variables are a common and recommended way to provide sensitive configuration values (like API keys and database passwords) to an application without putting them in the source code.

Why is it important to keep software, libraries, and dependencies updated?

A company discovers that an attacker gained access to their system by exploiting a known vulnerability in an outdated software library. Which security best practice would have prevented this?

Which of the following are security best practices for developers? (Select THREE.)Select multiple

In your own words, describe three security best practices that every developer should follow and explain why each one is important.