Contestant Number: ____________________

Time: ___________________
Rank: _______________

COMPUTER SECURITY
(320)
REGIONAL 2021

CONCEPT KNOWLEDGE:

Multiple Choice (50 @ 10 points each) _____________ (500 points)

TOTAL POINTS _____________ (500 points)

Test Time: 60 minutes

COMPUTER SECURITY
REGIONAL 2021
Page 2 of 10

GENERAL GUIDELINES:
Failure to adhere to any of the following rules will result in disqualification:
1. Contestant must hand in this test booklet and all printouts if any. Failure to do so will
result in disqualification.
2. No equipment, supplies, or materials other than those specified for this event are allowed
in the testing area. No previous BPA tests and/or sample tests (handwritten, photocopied,
or keyed) are allowed in the testing area.
3. Electronic devices will be monitored according to ACT standards.
COMPUTER SECURITY
REGIONAL 2021
Page 3 of 10

1. What type of antimalware program is able to detect viruses by recognizing various

characteristics of a known malware file?
a. Heuristic-based
b. Behavior-based
c. Agent-based
d. Signature-based

2. On a PC with Microsoft Windows, creating and maintaining blacklists and whitelists occurs
in what Windows tool?
a. Group Policy Editor
b. Computer Management
c. Task Manager
d. Local User and Groups

3. After a recent activities involving ransomware, the network administrator wants you to
restore several systems. Full backups were completed on Monday, and incremental backups
where completed on Wednesday and Thursday. What’s the required process to restore the
system on Friday?
a. Full backup
b. Full backup and all incremental backups
c. Full backup and last incremental backup
d. Only a differential backup in needed

4. In securities, the term piggybacking is a process by which _____.

a. hackers try to infiltrate networks by accessing another computer system
b. means by which hackers bypass mantraps at the perimeter defense
c. hackers use other employees credentials to enter a building
d. hackers disable the CCTV to gain entrance into a building

5. The OSI application layer protocols that manage the exchange of messages between the host
web browser and the remote web server are _____.
a. DNS and HTTP
b. HTTP and DHCP
c. HTTPS and HTTP
d. HTTPS and DNS

6. Which protocol is used for name resolution protocol often used by malware to communicate
with command-and-control servers?
a. HTTPS
b. HTTP
c. IMAP
d. DNS

7. How can IMAP be a security threat to a company?

a. Encrypted data is decrypted.
b. Someone inadvertently clicks a hidden iFrame.
c. An email can be used to bring malware to a host.
d. It can be encode stolen data an sent to another hacker.
COMPUTER SECURITY
REGIONAL 2021
Page 4 of 10

8. Why does a security analysis use the application Sguil?

a. It detects potential network intrusions.
b. It prevents malware from attacking a host.
c. It makes Snort-generated alerts readable and searchable.
d. It reports conversations between host on the network.

9. Which Windows log records events related to login attempts?

a. Setup logs
b. System logs
c. Application logs
d. Security logs

Employees and customers have certain expectations in regards to privacy. Which security Italics
10. policy act does not belong?
a. HIPPA
b. Family Education Rights and Privacy Act
c. USA Employee Rights and Protection Act 1974
d. Electronic Communications Privacy Act of 1986

11. A network administrator is building a new server for the company data center. The network
calls for striping with parity on three disks. Which RAID level should be implemented?
a. 0
b. 1
c. 5
d. 10

12. After monitoring suspicious activity overnight, the manager asks the network administrator
to find out if someone has infiltrated the network. What logging would you enable?
a. Audit
b. Syslog
c. Net viewer
d. Operating system

13. ABC Corporation has many employees that telecommute. The network administrator needs
to provide a solution to provide secure communication between remote locations and that at
work. What is a good solution for this company?
a. Fiber
b. VPN
c. T1 LINE
d. PPP

14. Which service will resolve web address to and IP address of the destination Web Server?
a. DHCP
b. DNS
c. NTP
d. ICMP
COMPUTER SECURITY
REGIONAL 2021
Page 5 of 10

15. The administrator of the network has been asked to set up local policy for passwords on
employees’ workstations. What tool would be best used in this situation?
a. Grpol.msc
b. Account policy
c. Password policy
d. Secpol.msc

16. When managing your company’s wireless access point, what wireless security would you
recommend?
a. WEP
b. WAP
c. WAP2
d. IPSEC

17. Which attack steal cookies that are used to authenticate users?
a. SYN cookies
b. CSRF
c. XSS
d. Wrapping

18. ______ is a type of attack that is carried out when the attacker places himself between the
communication paths of two users.
a. Side-channel attack
b. SQL Injection
c. Man-in-the middle attack
d. Wrapping attack

19. Which cloud model places the cloud services in complete control of the company’s
computing resources?
a. MaaS
b. SaaS
c. PaaS
d. IaaS

20. What type of key does WPA2 use?

a. TKIP
b. MIC
c. SES
d. AES

21. The CEO wants to secure all the laptops by implementing file encryption. The technician in
charge wants to select the best method. Which method of encryption will encrypt the entire
hard disk?
a. Password management
b. EFS
c. TPM
d. USB disk encryption
COMPUTER SECURITY
REGIONAL 2021
Page 6 of 10

22. What command-line utility provides network information that mirrors the output of a routing
table?
a. NBSTAT
b. NETSTAT
c. IPCONFIG /ALL
d. ARP

23. A security breach occurs in a company that processes credit card payment information.
Which industry specific law governs credit card data protection?
a. ECPA
b. GLBA
c. PCI DSS
d. SOX

24. How much overhead does the TCP header add to the data from the application layer?
a. 8 bytes
b. 16 bytes
c. 20 bytes
d. 40 bytes

25. Which information is found in both the TCP and UDP headers?
a. Source port, destination port and checksum
b. Source port, window and sequence number
c. Source port, destination port and sequence number
d. Source port, destination port and options

26. Refer to the exhibit below. A security analyst is using Wireshark to review a PCAP file.
When the technician initiated the file download request, which source socket pair was used?

a. 209.165.202.133:6666
b. 209.165.200.235:6666
c. 209.165.202.133:48598
d. 209.165.200.235:48598
COMPUTER SECURITY
REGIONAL 2021
Page 7 of 10

27. What are two of the 5 tuples?

a. ACL and IPS
b. Source IP address and IDS
c. Protocol in use and IPS
d. Port number and Protocol in use

28. _____ is a type of attack where the thief is gathering information and looking for
vulnerabilities within the network?
a. Access attack
b. DoS attack
c. Reconnaissance attack
d. Social engineering attack

29. Which protocol provides the framework for configuring secure VPNs?
a. IP
b. TCP
c. IPsec
d. DNS

30. IPsec protects all traffic from Layer ____ through Layer ____ of the OSI Model.
a. 3,6
b. 4,6
c. 3,7
d. 4,7

31. What is one of the primary difference between TACACS+ and RADIUS?
a. Protocols are used to communicate between routers.
b. TACACS+ Encrypts only the password.
c. RADIUS combines authentication and authorization as one process.
d. TACACS+ uses UDP port 59.

32. Caesar’s cipher is also known as _____.

a. ROT3
b. 3DES
c. AES
d. CBC

33. The type of encryption that utilizes different keys for encryption and decryption is _____.
a. DES
b. Symmetric encryption
c. Asymmetric encryption
d. Blowfish

34. The hashing algorithms MD5 creates _____.

a. 160/256/512 bit encryption
b. 128 bit encryption
c. 32/64 bit encryption
d. 160 bit encryption
COMPUTER SECURITY
REGIONAL 2021
Page 8 of 10

35. What is the method of encryption that hides information in pictures, documents and MP3
sound files?
a. Steganography
b. Digital Signature
c. Hashing
d. RSA

36. _____ is a type of remote access over the network that offers encryption between client and
network devices?
a. Telnet
b. SSH
c. BitLocker
d. TLS

37. Linux application that is used password-cracking is _____.

a. THC-HYDRA
b. John the Ripper
c. Brutus
d. Crypto Tool

38. In researching the log files, you come across the following address: 0xde.0xaa.0xcd.0x1a.
What is the decimal equivalent?
a. 222.170.206.26
b. 16.216.170.131
c. 202.170.216.131
d. 131.410.10.11

39. 802.11b uses how many channels in the United States?

a. 4
b. 11
c. 12
d. 24

40. NAT can be used to translate between private and public addresses. What is true about
private addresses?
a. Private addresses are routable
b. Private addresses are non-routable
c. IPv6 utilizes NAT that same way IPv4 does
d. 172.15.255.255 is a private address

41. What method is widely used to identify firewalls?

a. Packet Filtering
b. Stateful inspections
c. Port scanning
d. Firewalking
COMPUTER SECURITY
REGIONAL 2021
Page 9 of 10

42. What is the value of network administrators creating a honeypot?

a. Attracts hackers to a vulnerable spot in the firewall
b. Attracts hackers to vulnerable spots in the router
c. Attracts hackers away from the real network
d. Has a high level of production value

43. Companies that allow employees to bring their own device (BYOD) generate security
policies that protect against security risks. Which of the following should not be allowed in a
company’s security policy procedures?
a. Requirements for encryption
b. Ability to wipe device remotely
c. Jailbroken devices and rooted devices pose no threats
d. Ban on Apps that pose a threat

44. Which of the following is not used for traceback?

a. IPID analysis
b. TTL inspection
c. IP header size
d. TCP window size

45. You believe one of your host systems has been infected. Which of the following tools can
you use to look for malicious traffic in real time?
a. NetworkMiner
b. Netstat
c. Tripwire
d. Wireshark

46. Which type of attack is carried out by compromising a co-resident user in the cloud?
a. SOAP attack
b. Wrapping attack
c. Side Channel
d. Passive sniffing

47. Which botnet adds fields to existing web pages?

a. HTML injection
b. TAN grabber
c. TAN injection
d. HTML form grabber

48. Which cloud model uses all assets of the cloud provider?
a. IaaS
b. MaaS
c. SaaS
d. PaaS
COMPUTER SECURITY
REGIONAL 2021
Page 10 of 10

49. Which of the following is an example of a botnet?

a. Smurf
b. Storm
c. Teardrop
d. Firesheep

50. DiskProbe can be used for which of the following tasks?

a. Spoofing a PKI certificate
b. Forensics purposes
c. Recovery of an entire folder of EFS encrypted files
d. Cracking an MD5 hash
 COMPUTER SECURITY
(320)
REGIONAL 2021

CONCEPT KNOWLEDGE:

Multiple Choice (50 @ 10 points each) ______________ (500 points)

TOTAL POINTS ______________ (500 points)

Test Time: 60 minutes

COMPUTER SECURITY
REGIONAL 2021
Page 2 of 2

1. D 26. D
2. A 27. D
3. B 28. C
4. B 29. C
5. C 30. D
6. D 31. C
7. C 32. A
8. C 33. C
9. D 34. B
10. C 35. A
11. C 36. B
12. A 37. B
13. B 38. A
14. B 39. B
15. D 40. B
16. C 41. C
17. C 42. C
18. C 43. C
19. B 44. D
20. D 45. B
21. C 46. C
22. B 47. A
23. C 48. C
24. C 49. B
25. A 50. B