CECS 378 MIDTERM 1 EXAM QUESTIONS ANSWERED CORRECTLY LATEST UPDATE 2026
Computer security - Answers The protection of an information system to preserve confidentiality,
integrity, and availability.
The CIA triad - Answers Confidentiality, integrity, and availability.
Confidentiality - Answers Prevent unauthorized disclosure of information.
Integrity - Answers Prevent unauthorized modification or destruction of information.
Availability - Answers Ensure timely, reliable access to information and systems for authorized users.
CIA tradeoff - Answers Improving one CIA goal can reduce another (for example, more confidentiality
can reduce availability).
Asset - Answers Something valuable to protect (hardware, software, data, networks).
Vulnerability - Answers A weakness that can be exploited to violate security.
Threat - Answers Something capable of exploiting a vulnerability.
Attack - Answers An executed threat (a real attempt).
Countermeasure - Answers An action, device, or technique that reduces threats, vulnerabilities, or
attacks.
Countermeasure goals - Answers Prevent, detect, and recover.
Confidentiality loss (leak) - Answers Unauthorized disclosure of information.
Integrity loss (corruption) - Answers Unauthorized modification or destruction of information.
Availability loss (disruption) - Answers System access is prevented or severely slowed.
Passive attack - Answers An attempt to learn information without affecting system resources.
Active attack - Answers An attempt to alter system resources or affect operations.
Passive attack example - Answers Eavesdropping or monitoring.
Active attack example - Answers Replay, masquerade, message modification, or denial of service.
Replay attack - Answers Capturing a valid transmission and retransmitting it later.
Masquerade attack - Answers An attacker pretends to be an authorized user.
Message modification - Answers An attacker alters a legitimate message in transit.
Denial of service (DoS) - Answers An attacker prevents or inhibits normal system/service use.
Insider attack - Answers An attack initiated from inside the security perimeter or by an authorized
user.
Outsider attack - Answers An attack initiated from outside the security perimeter or by an illegitimate
user.
Attack surface - Answers All reachable and exploitable entry points/vulnerabilities in a system.
Attack surface examples - Answers Open ports, exposed services, input forms, interpreters, and
people/social engineering.
Attack tree - Answers A structured breakdown of paths/steps to reach an attack goal.
Attack surface vs attack tree - Answers Surface is where you can get in; tree is how you would do it
step-by-step.
Why security is hard - Answers Attackers need one weakness; defenders must cover all weaknesses.
Why security is costly - Answers Security often requires monitoring, time, and money.
Why security is counterintuitive - Answers Security procedures can feel inconvenient even if they are
correct.
Security design principles - Answers General rules for designing secure systems.
Economy of mechanism - Answers Keep the design simple to reduce bugs.
Fail-safe defaults - Answers Deny by default; allow only when explicitly permitted.
Complete mediation - Answers Check every access every time, not just once.
Open design - Answers Do not rely on secrecy of design for security.
Separation of privilege - Answers Require more than one condition or permission for access.
Least privilege - Answers Give only the minimum permissions needed.
Least common mechanism - Answers Minimize shared mechanisms used by multiple users.
Psychological acceptability - Answers Security should be usable so people actually follow it.
Least astonishment - Answers System behavior should be predictable to avoid mistakes.
Fail-safe defaults (code flaw) - Answers Allowing access for anything that is not explicitly "access
denied" can grant access on unexpected errors.
Fail-safe defaults (fix) - Answers Default deny, and only allow when you explicitly get a
success/allowed result.
ATM confidentiality example - Answers Protect PIN, card data, and account information.
Computer security - Answers The protection of an information system to preserve confidentiality,
integrity, and availability.
The CIA triad - Answers Confidentiality, integrity, and availability.
Confidentiality - Answers Prevent unauthorized disclosure of information.
Integrity - Answers Prevent unauthorized modification or destruction of information.
Availability - Answers Ensure timely, reliable access to information and systems for authorized users.
CIA tradeoff - Answers Improving one CIA goal can reduce another (for example, more confidentiality
can reduce availability).
Asset - Answers Something valuable to protect (hardware, software, data, networks).
Vulnerability - Answers A weakness that can be exploited to violate security.
Threat - Answers Something capable of exploiting a vulnerability.
Attack - Answers An executed threat (a real attempt).
Countermeasure - Answers An action, device, or technique that reduces threats, vulnerabilities, or
attacks.
Countermeasure goals - Answers Prevent, detect, and recover.
Confidentiality loss (leak) - Answers Unauthorized disclosure of information.
Integrity loss (corruption) - Answers Unauthorized modification or destruction of information.
Availability loss (disruption) - Answers System access is prevented or severely slowed.
Passive attack - Answers An attempt to learn information without affecting system resources.
Active attack - Answers An attempt to alter system resources or affect operations.
Passive attack example - Answers Eavesdropping or monitoring.
Active attack example - Answers Replay, masquerade, message modification, or denial of service.
Replay attack - Answers Capturing a valid transmission and retransmitting it later.
Masquerade attack - Answers An attacker pretends to be an authorized user.
Message modification - Answers An attacker alters a legitimate message in transit.
Denial of service (DoS) - Answers An attacker prevents or inhibits normal system/service use.
Insider attack - Answers An attack initiated from inside the security perimeter or by an authorized
user.
Outsider attack - Answers An attack initiated from outside the security perimeter or by an illegitimate
user.
Attack surface - Answers All reachable and exploitable entry points/vulnerabilities in a system.
Attack surface examples - Answers Open ports, exposed services, input forms, interpreters, and
people/social engineering.
Attack tree - Answers A structured breakdown of paths/steps to reach an attack goal.
Attack surface vs attack tree - Answers Surface is where you can get in; tree is how you would do it
step-by-step.
Why security is hard - Answers Attackers need one weakness; defenders must cover all weaknesses.
Why security is costly - Answers Security often requires monitoring, time, and money.
Why security is counterintuitive - Answers Security procedures can feel inconvenient even if they are
correct.
Security design principles - Answers General rules for designing secure systems.
Economy of mechanism - Answers Keep the design simple to reduce bugs.
Fail-safe defaults - Answers Deny by default; allow only when explicitly permitted.
Complete mediation - Answers Check every access every time, not just once.
Open design - Answers Do not rely on secrecy of design for security.
Separation of privilege - Answers Require more than one condition or permission for access.
Least privilege - Answers Give only the minimum permissions needed.
Least common mechanism - Answers Minimize shared mechanisms used by multiple users.
Psychological acceptability - Answers Security should be usable so people actually follow it.
Least astonishment - Answers System behavior should be predictable to avoid mistakes.
Fail-safe defaults (code flaw) - Answers Allowing access for anything that is not explicitly "access
denied" can grant access on unexpected errors.
Fail-safe defaults (fix) - Answers Default deny, and only allow when you explicitly get a
success/allowed result.
ATM confidentiality example - Answers Protect PIN, card data, and account information.
