Past Exam: Question Bank & Style Guide
Source: 6 photos in Courses/Fund. of Information Security/previous-exams/. They come from two different quizzes (both headed “Q1. Apply concepts and principles of information security to answer the following: [15 Marks]”, both ending “End of Quiz”). No student answers and no marker ink are visible (only faint mirrored print show-through from the back of the page), so nothing below says what was awarded. The cover page (page 1) of each quiz was not photographed.
Important: these quizzes test Chapters 1-2, not Chapters 3-5
Quiz A tests Chapter 1 (CIA triad, threats, design principles). Quiz B tests Chapter 2 (cryptography). The three decks in this study set are Chapter 3 (User Authentication), Chapter 4 (Access Control) and Chapter 5 (Database Security). So the past papers show the style to expect (one-word fill-in-the-blank on exact lecture terms), not the topics. Your own class notes for Chapters 1, 2 and 4 are in
University/Fund. Info security/.
Photo map (file names end in .jpeg, prefix WhatsApp Image 2026-10-21 at):
| Photo | Shows |
|---|---|
5.32.31 PM and 5.32.31 PM (1) | Quiz A page 2, parts (a)-(g) (same page photographed twice) |
5.32.33 PM | Quiz A page 3, parts (h)-(n) |
5.32.32 PM | Quiz A, part (o) then “End of Quiz” (photo is rotated 90 degrees) |
5.32.32 PM (1) | Quiz B page 2, parts (a)-(h) |
5.32.32 PM (2) | Quiz B page 3, parts (i)-(o) then “End of Quiz” |
Quiz A (Chapter 1): questions as written
| Q1 part | Question as written (blank = ____) | Expected answer (from your Chapter 1 class notes / standard terms) |
|---|---|---|
| (a) | The three key objectives of the CIA triad are Confidentiality, Integrity, and ____ | Availability |
| (b) | ____ ensures that confidential information is not disclosed to unauthorized individuals. | Confidentiality |
| (c) | The assurance that information and programs are changed only in an authorized manner is called data ____. | integrity |
| (d) | The property of being genuine and trustworthy is known as ____. | Authenticity |
| (e) | The security goal that enables actions to be traced uniquely to an individual is called ____. | Accountability |
| (f) | A threat that exploits a vulnerability is known as an ____. | attack |
| (g) | The direct release of sensitive data to an unauthorized entity is called ____. | Exposure (class notes: “expose”, under unauthorized disclosure) |
| (h) | When an unauthorized entity accesses data while it is being transmitted, this is known as ____. | Interception |
| (i) | An unauthorized entity pretending to be an authorized user is called ____. | Masquerade |
| (j) | Altering valid data in a file or database is known as ____. | Falsification |
| (k) | Preventing or interrupting system operation by disabling a component is called ____. | Incapacitation |
| (l) | The security design principle that recommends security mechanisms should be as simple as possible is called ____. | Economy of mechanism |
| (m) | The principle stating that every access request should be checked against an access control system is called ____. | Complete mediation |
| (n) | The use of multiple overlapping protection mechanisms is known as ____. | Layering (class notes: “Layers”) |
| (o) | The principle that users should have only the minimum permissions needed to perform their tasks is called ____. | Least privilege |
The answers are not printed on the photos. They come from Chapter 1(introduction).md in your vault and the usual textbook terms.
Quiz B (Chapter 2): questions as written
| Q1 part | Question as written | Expected answer (from your Chapter 2 class notes) |
|---|---|---|
| (a) | The ____ algorithm, developed in 1977, is the only widely accepted public-key encryption algorithm. | RSA |
| (b) | A ____ is a fundamental tool that ensures the integrity of a message by detecting any unauthorized modifications. | hash function |
| (c) | ____ cryptography provides security similar to RSA but utilizes much smaller keys, leading to better efficiency. | Elliptic curve (ECC) |
| (d) | The Diffie-Hellman algorithm is specifically used for the secure ____ of a secret key between two parties. | exchange |
| (e) | A digital ____ is a cryptographic mechanism used to verify the authenticity and origin of a digital message or document. | signature |
| (f) | In public-key cryptography, a ____ key is shared openly, while a private key must remain confidential. | public |
| (g) | What mathematical operation is used to find the remainder after division? | modulo (mod) |
| (h) | Unlike symmetric encryption, public-key encryption algorithms rely on two mathematically linked keys: a public key and a ____ key. | private |
| (i) | The ____ Signature Standard (DSS) is a widely used algorithm specifically designed for creating digital signatures. | Digital |
| (j) | An encryption technique that uses a shared secret key for both encryption and decryption is known as ____ encryption. | symmetric |
| (k) | Hash algorithms are commonly used in conjunction with ____ to provide both data integrity and authentication. | most likely “digital signatures” (could also be read as public-key encryption; not stated on the photo) |
| (l) | Security in public-key systems is based on the difficulty of solving specific ____ problems, such as integer factorization. | mathematical |
| (m) | When using RSA, the ____ key is used to encrypt messages, while the ____ key is used to decrypt them. | public; private |
| (n) | Which mode of operation encrypts each plaintext block independently using the same key? (photo cut off at the right edge, ends “using th… same key?”) | ECB (Electronic Codebook) |
| (o) | When encrypting color values, what modulus is used? | 256 (colour channels go 0-255, your Chapter 2 notes: wrap past the 255 mark) |
Style of the exam
- One-word or short fill-in-the-blank, no calculations in the pages seen. 15 blanks on one 15-mark question, so each blank is probably worth 1 mark (inferred, the paper does not print per-blank marks).
- Questions use the lecture’s exact wording and terms (“economy of mechanism”, “complete mediation”, “incapacitation”). Learn the exact name, not a paraphrase.
- Each sentence is a definition turned into a blank: you must go from definition to term. Practise both directions.
- Both quizzes are headed “Apply concepts and principles of information security”, so the exam will likely stay at “name the term” level with a few “which / what” questions (Quiz B (g), (n), (o)).
- Opening line is always “Q1.” with 15 marks, which suggests a quiz of one question; the real midterm may add longer questions (not shown, do not assume).
What the three new decks give you (same style, new topics)
Use this to rehearse the same format on Chapters 3-5. Terms below come from the slides.
| Likely blank | Term | Deck / slide |
|---|---|---|
| The process of verifying an identity claimed by a system entity | user authentication | 03 s.4 |
| Something the individual knows / possesses / is / does | password, token, static biometrics, dynamic biometrics | 03 s.5 |
| Random value added before hashing to stop duplicate hashes | salt | 03 s.13 |
| Hashed passwords stored in a separate file from user IDs | shadow password file | 03 s.19 |
| System periodically runs its own password cracker | reactive password checking | 03 s.20 |
| User picks a password and the system rejects weak ones | proactive password checking | 03 s.20 |
| Card that stores but does not process data | memory card | 03 s.22 |
| Host sends a random number r, user returns f(r, h(P)) | challenge-response | 03 s.26 |
| Attacker repeats a previously captured user response | replay | 03 s.31 |
| Access control based on identity and rules, owner may pass rights on | DAC (discretionary) | 04 s.4 |
| Access control comparing security labels with clearances | MAC (mandatory) | 04 s.5 |
| Access control based on roles, many-to-many user-to-role | RBAC | 04 s.6, 21 |
| Each entity gets the minimum resources needed | least privilege | 04 s.8 |
| Policy that allows only accesses specifically authorized | closed policy | 04 s.9 |
| RBAC model that adds role hierarchies / constraints | RBAC1 / RBAC2 | 04 s.24 |
| Injected tautology such as OR ‘a’=‘a’ | tautology (in-band SQLi) | 05 s.17 |
| Attack where data is deduced from behaviour/timing | inferential (blind) SQLi | 05 s.16, 18 |
| SQL command that gives a user rights; revoke them | GRANT; REVOKE | 05 s.22 |
| Deducing unauthorized data from authorized query answers | inference | 05 s.25 |
Practice questions in the Quiz style (Chapters 3-5)
- Biometric systems can make two errors: false
____and false non-match. (false match, 03 s.25) - The Unix password scheme
Crypt(3)uses a____-bit salt. (12, 03 s.14) - A
____policy allows all accesses except those expressly prohibited. (open, 04 s.9) - In RBAC, a user can be assigned to only one role of a set under the
____constraint. (mutual exclusion, 04 s.27) - The two SQL commands for access rights are
____and____. (GRANT, REVOKE, 05 s.22) - Describe how a salt makes rainbow table attacks harder. (03 s.13, 16)
- Explain what a tautology SQL injection does, using
name' OR 'a'='a. (05 s.13-14) - Compare DAC, MAC and RBAC in a table. (04 s.4-6)
Related: 03 User Authentication - Index, 04 Access Control - Index, 05 Database Security - Index