Quiz: System Security Fundamentals — 29 questions

1. Which statement best describes the overall purpose of system security?

A. It protects systems and data from unauthorized access, damage, theft, and service disruption.

B. It ensures that users can access every resource without administrative restrictions.

C. It improves system performance by allocating more resources to high-priority applications.

D. It replaces operating-system functions with independent security software components.

Answer: (A)

Explanation

System security protects computers, software, networks, and data against threats such as unauthorized access, modification, malware, exploitation, and denial of service. Improving performance may be useful, but it is not the defining objective of system security.

2. A security policy prevents an unauthorized employee from viewing confidential files but permits authorized employees to read them. Which CIA Triad property does this policy primarily protect?

A. Confidentiality

B. Availability

C. Accountability

D. Integrity

Answer: (A)

Explanation

Confidentiality limits information access to authorized users, which is the property addressed by restricting file viewing. Integrity concerns unauthorized modification, while availability concerns access to resources when needed.

3. After a user logs in successfully, which security function determines whether that user may delete a particular database record?

A. Authentication

B. Authorization

C. Accountability

D. Identification

Answer: (B)

Explanation

Authorization determines which actions an authenticated user is permitted to perform. Authentication verifies identity, whereas accountability records actions performed by users.

4. What is the defining action in a control hijacking attack?

A. Compressing program data so the application uses less memory

B. Manipulating execution flow so unintended or attacker-controlled instructions run

C. Restricting network traffic so unauthorized packets cannot reach a host

D. Changing file permissions so legitimate users lose access to resources

Answer: (B)

Explanation

Control hijacking changes a program's execution flow so it runs unintended instructions or attacker-controlled code. Restricting traffic and changing permissions are security controls, not the defining mechanism of control hijacking.

5. When does a buffer overflow occur?

A. When a program rejects input because its length matches the buffer capacity

B. When a program reads data from a buffer without changing its contents

C. When a program stores data in a buffer that was dynamically allocated at runtime

D. When a program writes more data into a fixed-size buffer than it can hold

Answer: (D)

Explanation

A buffer overflow occurs when writes exceed a fixed-size buffer's capacity, potentially overwriting adjacent memory. Dynamic allocation or reading without overwriting does not by itself constitute a buffer overflow.

6. How can a stack-based buffer overflow redirect execution after a function returns?

A. The operating system converts the overwritten buffer into a separate process

B. The function allocates a larger stack frame and resumes at its original caller

C. Excess data automatically encrypts the function's local variables before return

D. Excess data overwrites a nearby return address with an unintended target

Answer: (D)

Explanation

Data written beyond a local stack buffer can overwrite nearby stack information, including the return address, causing the function to return to an unintended location. Encryption, stack growth, and process creation do not explain this control-flow transfer.

7. What value results from adding 1 to an unsigned 8-bit integer containing 255?

A. 255 because the value is saturated

B. 0 through wraparound

C. 128 through range truncation

D. 1 through signed conversion

Answer: (B)

Explanation

An unsigned 8-bit integer represents values from 0 through 255, so adding 1 to 255 wraps around to 0. The signed range and saturation behavior do not describe unsigned 8-bit arithmetic.

8. How can integer overflow contribute to a buffer overflow?

A. It can make every input string automatically exceed its destination buffer.

B. It can prevent all memory writes by converting the size into a protected pointer.

C. It can make a calculated size unexpectedly small, leading to insufficient allocation.

D. It can replace a program's control flow with browser isolation before allocation.

Answer: (C)

Explanation

Integer overflow can reduce a large calculated size to an unexpectedly small value, causing insufficient memory allocation and later writes beyond the allocated buffer. The overflow affects the size calculation; it does not automatically enlarge every input or directly provide browser isolation.

9. Which browser protection restricts a web document's ability to interact with resources from a different origin?

A. Process isolation

B. Data Execution Prevention

C. The Same-Origin Policy

D. Address Space Layout Randomization

Answer: (C)

Explanation

The Same-Origin Policy restricts interactions between resources from different origins. ASLR randomizes memory locations, DEP/NX limits execution of non-executable memory, and process isolation separates execution contexts.

10. What does sandboxing primarily do to an application?

A. It analyzes the application without running its instructions

B. It separates the application from every other system component

C. It runs the application with restricted permissions and resource access

D. It verifies the identity of each user before execution

Answer: (C)

Explanation

Sandboxing places an application in a restricted environment that limits access to resources such as files, networks, hardware, and system calls. Separating components from one another describes isolation rather than sandboxing.

11. A system places two applications in separate processes so that one cannot interfere with the other, even when their permissions are similar. Which security concept does this illustrate?

A. Isolation, because it creates a boundary between components

B. Authentication, because it distinguishes the two applications

C. Input validation, because it filters data before processing

D. Sandboxing, because it limits each application's available actions

Answer: (A)

Explanation

Isolation separates processes, users, applications, or resources to prevent unwanted interaction. Sandboxing instead focuses on restricting what an application may do through policies and limited permissions.

12. Which practice is a recognized technique for improving software robustness?

A. Granting broad permissions so unexpected operations can continue

B. Ignoring unusual input to reduce the amount of error handling

C. Disabling code review to accelerate the release process

D. Using secure defaults and testing the system for security weaknesses

Answer: (D)

Explanation

Secure defaults and security testing are among the techniques that improve robustness, along with input validation, safe error handling, and least privilege. Broad permissions and reduced review weaken the system rather than making it more robust.

13. Which analysis method combines concrete execution with symbolic reasoning to explore alternative program paths?

A. Static analysis

B. Manual code review

C. Concolic analysis

D. Dynamic analysis

Answer: (C)

Explanation

Concolic analysis executes a program with concrete values while using symbolic reasoning to derive additional path constraints. Static analysis does not execute the program, while dynamic analysis observes execution without this combined symbolic approach.

14. A concolic testing tool executes a program with one concrete input and then derives another input from symbolic constraints. What is the main limitation that can restrict this approach?

A. The program cannot be executed with concrete values

B. The technique examines source code without running it

C. The number of execution paths can grow explosively

D. The method cannot maintain constraints during execution

Answer: (C)

Explanation

Concolic execution can generate inputs for alternative paths, but path explosion makes systematic exploration difficult as the number of paths increases. The method does execute the program with concrete inputs and maintains symbolic constraints.

15. Which example best represents a privilege?

A. A rule that separates two applications into different processes

B. Permission for a process to modify a protected system configuration

C. A record describing the identity used to log into an account

D. A technique that detects flaws without executing a program

Answer: (B)

Explanation

A privilege is permission granted to a user, process, or program to perform a particular operation, such as changing system configuration. Identity records, process separation, and program analysis describe different security concepts.

16. An attacker with an ordinary account accesses another ordinary user's files without gaining administrator capabilities. What type of privilege escalation is this?

A. Vertical escalation, because the attacker moves between different accounts

B. Authentication failure, because the attacker cannot identify the account

C. Role-based control, because permissions are assigned through roles

D. Horizontal escalation, because the accessed user has a similar privilege level

Answer: (D)

Explanation

Horizontal privilege escalation gives one user access to another user at a similar privilege level. Vertical escalation instead involves moving from a lower privilege level to a higher one.

17. What is the primary function of access control?

A. To determine which subjects may perform which operations on resources

B. To establish and verify the identity claimed by a subject

C. To encrypt every resource before any subject can access it

D. To detect software defects by examining program execution

Answer: (A)

Explanation

Access control determines which subjects can access which resources and which operations they may perform. Establishing identity is authentication, while encryption and program analysis serve different security purposes.

18. Which access-control model assigns permissions to roles and then grants users access through those roles?

A. Attribute-based access control

B. Role-based access control

C. Discretionary access control

D. Mandatory access control

Answer: (B)

Explanation

Role-based access control assigns permissions to roles, with users receiving permissions through their assigned roles. Discretionary control relies on resource owners, mandatory control uses centrally defined policies and labels, and attribute-based control evaluates attributes such as location or device.

19. What security property prevents one process from directly reading another process’s memory under normal conditions?

A. Shared access places related processes in a common address space.

B. File permissions restrict processes from opening executable files.

C. Privilege separation gives every process identical memory permissions.

D. Process isolation assigns each process a protected address space.

Answer: (D)

Explanation

Process isolation separates address spaces so that a process cannot normally access another process’s memory directly. Shared access would permit processes to read memory in a common space, which is the opposite property.

20. A memory page marked R-X has which permissions?

A. It can be written and executed but not read.

B. It can be read and executed but not written.

C. It can be read and written but not executed.

D. It can be read, written, and executed.

Answer: (B)

Explanation

The R, W, and X flags represent read, write, and execute permissions, so R-X permits reading and execution without writing. An R-W page instead permits reading and writing but lacks execute permission.

21. Which set of resources falls within the protection responsibilities of operating system security?

A. Printers, keyboards, displays, applications, and removable media

B. Processes, memory, files, users, devices, and system calls

C. Passwords, encryption keys, browsers, networks, and cloud accounts

D. Source code, user interfaces, websites, databases, and documentation

Answer: (B)

Explanation

Operating system security protects processes, memory, files, users, devices, system calls, the kernel, and network resources. The other sets contain related assets but do not represent the stated scope as completely.

22. What does exploitation mean in the context of software security?

A. Identifying a weakness without attempting to affect system behavior

B. Applying a security update to remove a weakness from software

C. Using a vulnerability to cause unintended system behavior

D. Monitoring normal program activity to detect unusual system behavior

Answer: (C)

Explanation

Exploitation takes advantage of a vulnerability to produce unintended behavior. A vulnerability is the underlying weakness itself, so identifying one does not necessarily constitute exploitation.

23. What happens during a code injection attack?

A. An attacker reuses existing instruction sequences without adding commands.

B. Attacker-controlled input is interpreted or executed as code or commands.

C. A program stores valid input in memory after checking its data type.

D. A process accesses a released memory region after its allocation ends.

Answer: (B)

Explanation

Code injection occurs when input is caused to be interpreted or executed as code or commands, as in SQL, command, or script injection. Ordinary data remains data and does not trigger this behavior merely by being stored.

24. Which situation describes a use-after-free vulnerability?

A. A program executes input that has been interpreted as a shell command.

B. A process reads memory belonging to another isolated process.

C. A program uses existing instruction sequences to perform a task.

D. A program accesses memory after that memory has been released.

Answer: (D)

Explanation

A use-after-free occurs when software uses memory after releasing it, which can cause crashes, corruption, or further security consequences. Executing injected commands describes code injection, while reusing instruction sequences describes return-oriented programming.

25. What is the defining activity of fuzzing?

A. Restricting a program to a small set of carefully selected normal inputs

B. Manually examining a system to identify and exploit security weaknesses

C. Automatically supplying many unexpected inputs while monitoring program behavior

D. Reviewing source code to prove that every input-validation rule is correct

Answer: (C)

Explanation

Fuzzing automatically generates or supplies large amounts of malformed, random, unexpected, or specially designed input and observes the results. Penetration testing is a broader investigation of exploitable weaknesses rather than this specific automated input-generation method.

26. Which sequence best represents a basic fuzzing workflow?

A. Create a specification, compile the target, optimize execution, and remove logs

B. Analyze source code, patch defects, deploy updates, and review user reports

C. Authenticate users, assign permissions, isolate processes, and audit access

D. Generate input, submit it, monitor behavior, save notable cases, and analyze results

Answer: (D)

Explanation

A basic fuzzing workflow generates test inputs, submits them, monitors for crashes or interesting behavior, saves notable inputs, and analyzes the findings. The other sequences describe security administration, software development, or unrelated analysis activities.

27. Which pairing correctly distinguishes black-box and white-box fuzzing?

A. Black-box fuzzing uses code coverage, while white-box fuzzing avoids implementation information.

B. Black-box fuzzing requires source code, while white-box fuzzing tests without implementation details.

C. Black-box fuzzing modifies valid inputs, while white-box fuzzing creates grammar-based inputs.

D. Black-box fuzzing uses little internal knowledge, while white-box fuzzing uses program structure.

Answer: (D)

Explanation

Black-box fuzzing operates with little knowledge of the implementation, whereas white-box fuzzing uses internal program structure. Mutation versus generation describes how inputs are produced, not the distinction between black-box and white-box knowledge.

28. Which defense makes designated memory regions non-executable, helping prevent injected code from running there?

A. Stack canaries

B. Control-flow integrity

C. DEP/NX

D. ASLR

Answer: (C)

Explanation

DEP/NX marks designated data regions as non-executable, blocking code execution from those areas. ASLR instead makes memory addresses harder to predict, so it does not provide the same protection.

29. Which sequence correctly distinguishes a vulnerability, an exploit, and an attack?

A. A malicious goal, a weakness that enables it, and a defensive technique against it

B. An unusual behavior, a complete assessment, and a technique for restricting permissions

C. A defensive control, an unexpected input, and a weakness discovered during testing

D. A weakness, a technique that uses it, and broader malicious activity pursuing a goal

Answer: (D)

Explanation

A vulnerability is a weakness, an exploit is a technique, code, or input that takes advantage of it, and an attack is broader malicious activity aimed at achieving a goal. Treating the vulnerability itself as the exploit confuses the weakness with the means of using it.