CS-503-C Cyber Security - Nov 2022 Question Paper

Under each question, How to answer lists the points an answer should cover, outlined by CampusPrep from the syllabus. Check the details against your textbook.

1. 7 Marks
   aWhich are more threatening to cyber security between viruses and worms? Describe precisely.
   How to answer

   • Define virus vs worm and propagation method
   • Compare spread speed, need for host/action, network impact
   • Judge which is more threatening with reasons
   • Give examples and countermeasures
2. 7 Marks
   bIllustrate, how password-based authentication system contributes to strengthening Secure System Design.
   How to answer

   • Define password-based authentication
   • Explain password storage, hashing, salting, policy
   • Link to secure system design principles
   • Strengths and limitations
3. 7 Marks
   aDetermine the conceptual differences between Spoofing and Session Hijacking.
   How to answer

   • Define spoofing with types
   • Define session hijacking and mechanism
   • Tabular conceptual differences
   • Security implications
4. 7 Marks
   bTalk about the different issues and challenges of cybercrime. Also explain the power and characteristics of cyber terrorism.
   How to answer

   • List issues and challenges of cybercrime
   • Explain jurisdiction, anonymity, scale factors
   • Define cyber terrorism, its power
   • Characteristics and examples
5. 7 Marks
   aDiscuss the importance of digital signatures and certificates in the formation of SSL/TLS-based sessions.
   How to answer

   • Role of digital signature in server authentication
   • Role of certificates and CA chain in SSL/TLS
   • Handshake steps using certificates
   • Trust, integrity and confidentiality benefits
6. 7 Marks
   bAnalyse how phishing and pharming assaults have affected various web-based transactions.
   How to answer

   • Define phishing and pharming
   • Mechanism of attacks on web transactions
   • Impact on e-commerce, banking, credentials
   • Countermeasures
7. 7 Marks
   aWrite short note on "Strategies to tackle Cyber Crime and Trends".
   How to answer

   • Define cyber crime trends
   • Preventive, detective and legal strategies
   • Role of awareness, technology, law enforcement
   • Conclusion
8. 7 Marks
   bConsider the following script: <html><body> <form name="attack_form" action="http://VULNERABLE_APP/attack.php" method="POST"> <input type="hidden" name="attack_param" value="POST_ATTACK"> </form> <script type = "text/javascript" > document.attack_form.submit(); </script> </body></html> What type of vulnerabilities can be possible with the above script? Justify your answer with proper explanation.
   How to answer

   • Explain auto-submitting hidden form as CSRF/XSS vector
   • Identify vulnerability: cross-site request forgery
   • Explain exploitation against VULNERABLE_APP
   • Justify with POST attack flow and prevention
9. 7 Marks
   auser=request.POSt['user_name'] passwd=request.POST['password'] query1= "SELECT id FROM users WHERE username="" + user+ "" AND password="" + passwd + """ database.execute(query1) Analyse the above statements for any threat? If it exists, write the alternative statements to make them safe.
   How to answer

   • Identify SQL injection due to string concatenation
   • Show bypass payload example
   • Provide parameterized/prepared statement alternative
   • Input validation and least privilege
10. 7 Marks
    bExplain Electronic Signature Certificate. What are the duties of subscriber in relation to it?
    How to answer

    • Define Electronic Signature Certificate
    • Issuance and contents of certificate
    • Duties of subscriber: security, disclosure
    • Legal obligations
11. 7 Marks
    aDiscuss the roles of Document Object Model (DOM) in web security. What is cross-window attack?
    How to answer

    • Define DOM and its access to page content
    • DOM-based XSS and manipulation risks
    • Define cross-window attack e.g. via window.opener
    • Mitigations
12. 7 Marks
    bExplain the role of cookies in enhancing threats against various web applications?
    How to answer

    • Define cookies and session use
    • How theft, tampering, XSS/CSRF use cookies
    • Threats to web applications
    • Secure flags HttpOnly, Secure, SameSite
13. 7 Marks
    aWhat are the different types of offence in Information Technology Act 2000? Discuss cyber offence control mechanism under this Act.
    How to answer

    • List offences under IT Act 2000
    • Explain key sections e.g. hacking, data theft
    • Control mechanism: adjudication, CERT-In, penalties
    • Conclusion
14. 7 Marks
    bHow can attacker inject the malicious code in a specific address and execute it as per requirement using buffer overflow attack? - Explain it with suitable example.
    How to answer

    • Define buffer overflow and stack layout
    • Explain injecting shellcode at address and overwriting return
    • Give example with strcpy / input
    • Countermeasures
15. 7 Marks
    aDiscuss the different issues and challenges of cybercrime? Also explain the power and characteristics of cyber terrorism.
    How to answer

    • List issues and challenges of cybercrime
    • Explain jurisdiction, anonymity, scale factors
    • Define cyber terrorism, its power
    • Characteristics and examples
16. 7 Marks
    bDiscuss the importance of TLS handshaking in a secure session establishment.
    How to answer

    • Outline TLS handshake steps
    • Role in authentication and key exchange
    • How secure session established
    • Security benefits