DC Incentro Cyber Security 08-08-2022

• quiz
• Basisschool
• Groep 1

Why should you always lock your computer screen when you step away from your computer?

1. Someone can add or delete files from your computer
2. Colleagues might use your computer to announce that you're buying lunch for everyone!
3. An unauthorized person can have access to confidential client data
4. You save power!

"What does the “https://” at the beginning of a URL
denote, as opposed to ""http://"" (without the “s”)?"

1. That the site is the newest version available
2. That information entered into the site is encrypted
3. The site is not accessible to certain computers
4. That the site has special high definition

What is not an element of cyber security

1. confidentiality
2. reproducability
3. integrity
4. integrity

What is an example of shadow IT?

1. a hacker group
2. Joining an online meeting with not enough light so your face can not be seen
3. Having an IT job that is higly confidential so you can't talk about it at social gatherings
4. The use of your kids school tabet to join an online meeting

A memory leak is an example of a cyber security issue

1. False, it is a bug in the code
2. True, a hacker can use it to take down your application
3. False, my code never has memory leaks
4. It's mark Rutte not recollecting major political things

HTTPS is helpful for?

1. For preventing CSRF attacks
2. For preventing XSS attacks
3. For preventing SQL injections
4. For preventing Sniffing attacks

The best way to store passwords is by

1. Make sure that POST, PUT, PATCH & DELETE calls are idempotent
2. Transmit the CSRF token by only using cookies
3. Generate the CSRF token on the service-side and require a custom-HTTP-header per request
4. Only permit HTTPS requests

Which of the following is the most secure password option?

1. x509 certificate
2. Welkom2007
3. hI678gbCV#?$%:t:u7?3H%>-3tH(e3SksNr.b#
4. pointed-silica-womb-garden

I can use my API key in multiple locations without security issues

1. Yes, API keys are secure by design
2. Yes, but only in related services
3. Nope, usage in multiple places gives a higher risk of a security breach

To make account management easier I should create a single user for my whole team

1. Yes, this ensures that if people leave the team we still have the credentials
2. Yes, I can then easily onboard people by sharing the same password
3. No, because I don't like sharing
4. No, because this will hide who does what

I only need to think about securing my API if and when I make it public

1. TRUE
2. FALSE

If I find a cool open source librarly I can use it without problems, as long as it has many github stars

1. True, many github stars mean that lots of people use it, so any issues wil be quickly fixed
2. False, I still need to review the code itself before using it
3. False, I also need to look at when the latest update has happened to make sure it is still up to date

What flaw can lead to exposure of resources or functionality to unintended actors?

1. Improper Authentication
2. Session Fixation
3. Insecure Cryptographic Storage
4. Unvalidated Redirects and Forwards

What security risk is GraphQL known for?

1. DoS attacks using expensive queries
2. Apollo Server having major security holes in major version releases
3. GraphQL doesn't support JWT tokens
4. Blabla, REST is better, blabla

What information can you trust from a JWT you received?

1. The user ID
2. The expiration date
3. The algorithm that was used to sign it
4. Everything, as long as you validate the signature with your private key.

What should you do to keep your Angular application up to date regarding security?

1. Nothing, Angular got you covered
2. Keep current with the latest Angular library releases
3. Use a 3rd party library
4. Don't modify your copy of Angular

An unexpected result when two actions do not occur in the same order is called what?

1. De-referencing
2. A race condition
3. An insecure function
4. Improper error handling

Logging is only meant to tell me my code is misbehaving

1. True, it is only written so a developer can see what is happening
2. False, it can also be used as a reporting tool
3. False, it can also give insights in common and unexpected usage of my code

I should commit passwords with my code as my repository is protection enough

1. TRUE
2. FALSE

I should provide as much information in my error message as possible

1. True, this makes debugging easier
2. False, this would make the payload larger than necessary
3. False, this might expose the behaviour of my code

Which statement is true?

1. REST APIs should deny access by default, except public resources
2. JWT tokens can manually be invalidated
3. The following header is valid, “Access-Control-Alllow-origin: https://*.website.com”
4. Limit the rate of API access does not minimize the harm from automated attack tooling

You just received an email that looks phishy, what do you do with it?

1. Report it to [e-mail]
2. Ignore it and throw it in the digital bin
3. Report it through the Google phishing report-button
4. Click all the available links to investigate where it came from so you can report them.

You just received an email that looks phishy, and have clicked the link... now what?

1. Report it to [e-mail]
2. Ignore it and throw it in the digital bin
3. Report it through the Google phishing report-button
4. Click all the available links to investigate where it came from so you can report them.

What is the most common cause of IT security breaches

1. Hackers
2. Code errors
3. Human behavior
4. Phishing emails

Which threat vector is most commonly exploited by attackers who are at a distance

1. email
2. direct access
3. wireless
4. Removable media

Which ones are valid web security vulnerabilities?

1. CSRF
2. XSS
3. UDP
4. SSRF

What should you do to protect a React application against XSS attacks?

1. Sanitize all the user content strings you output
2. Nothing, React has built-in XSS protection
3. Throw an error if a user tries to input characters like `<>`
4. alert(1);

Which signs should I check in order to recognize a phishing email?

1. The time it was sent
2. Content poorly written, often with misspelling
3. Including suspicious links and/or attachments
4. Sent by a wrong domain

Spoofing a WiFi Access point is also called?

1. An evil twin attack
2. Pineapple attack
3. A keystroke Injection
4. Nmap scan Attack

To prevent an CSRF attack, an web application should?

1. Make sure that POST, PUT, PATCH & DELETE calls are idempotent
2. Transmit the CSRF token by only using cookies
3. Generate the CSRF token on the service-side and require a custom-HTTP-header per request
4. Only permit HTTPS requests

Which statement is true?

1. REST APIs should deny access by default, except public resources
2. JWT tokens can manually be invalidated
3. The following header is valid, “Access-Control-Alllow-origin: https://*.website.com”
4. Limit the rate of API access does not minimize the harm from automated attack tooling