ETHC303 · Major 2 — Term 253 (Sec 82)

What does Infrastructure as a Service (IaaS) provide and manage for the customer?

aOnly social spaces for employees. bHardware resources such as CPU, storage, and communication bandwidth. cApplication development platforms exclusively. dBARCODE replacement logistics systems.

✓Correct Answer: b)

IaaS delivers the raw hardware layer — compute, storage and bandwidth. Development platforms are PaaS (c), and finished applications are SaaS.

From a social perspective, how are small companies disadvantaged when competing with the biggest players regarding cloud resources?

aThey are legally prohibited from using any SaaS applications. bThey are forced to pay higher incremental fees than large corporations. cThey might not have the same resources/tools available or receive the same attention from the cloud provider to solve service issues. dThey are banned from utilizing mobile banking apps and virtual transactions.

✓Correct Answer: c)

The disadvantage is access and attention: a small account does not command the same tooling or the same provider support when something breaks. Nothing legally bars small firms from SaaS (a) or banking apps (d).

What is identified as the single biggest threat to privacy regarding the government's utilization of biometrics?

aThe financial cost of maintaining the biometric databases. bThe immediate destruction of physical passport files. cThe government's ability to use it for mass surveillance through face recognition and tracking. dThe automatic sharing of data with third-party marketers.

✓Correct Answer: c)

The central worry is mass surveillance — face recognition and tracking at population scale, applied to people who are not suspected of anything. Cost (a) is a budget issue, not a privacy threat.

Which social engineering attack vector is primarily conducted over the phone?

aPhishing. bSmishing. cVishing. dDumpster Diving.

✓Correct Answer: c)

Vishing is voice phishing — the attack is carried out in a phone call. Phishing is email, smishing is SMS, and dumpster diving is physical trash retrieval.

What component of a cyberattack represents the reason or goal driving the attacker?

aMethod. bMotive. cVulnerability. dAll of the above.

✓Correct Answer: b)

An attack needs motive (the goal), method (how it is carried out) and a vulnerability (the weakness exploited). The reason driving the attacker is specifically the motive.

Which element of the CIA triad ensures that information is accessible and usable in a timely and reliable manner?

aConfidentiality. bIntegrity. cNon-repudiation. dAvailability.

✓Correct Answer: d)

Availability is the timely, reliable access to information and systems. Confidentiality restricts who may see it, integrity protects it from unauthorized change, and non-repudiation is not one of the three CIA elements.

Why are IT help desk employees classified as a major security hole for Vishing scams?

aThey have full administrative access to encryption firewalls. bThey are trained to be friendly and give out information, often with minimal security education. cThey use automated software bots that bypass caller ID security. dAll of the above.

✓Correct Answer: b)

The help desk's job is to be helpful and hand out information quickly, and its staff often get little security training — exactly the combination a vishing caller exploits.

What type of threat involves a long-term targeted attack where an attacker remains undetected for an extended period?

aAdvanced Persistent Threat (APT). bShrink-Wrap Code Exploit. cInsider Threat. dC & B.

✓Correct Answer: a)

An Advanced Persistent Threat is defined by persistence and stealth — a targeted intruder who stays inside the network undetected for a long time to keep extracting information.

A user receives an urgent text message stating their primary bank account will face immediate suspension unless they follow an embedded web link. What combination of tactics is the threat actor utilizing?

aVishing utilizing help desk exploit variables. bSMiShing utilizing fear-based terminology. cVishing utilizing help desk exploit variables. dDoxing utilizing publicly available databases.

✓Correct Answer: b)

The message arrives by SMS — SMiShing — and its lever is fear: an urgent threat of account suspension to push the victim into clicking before thinking. A phone call would be vishing.

Q10

What is a common source of data leakage and network spoofing attacks today?

aEmerging smartphone and mobile phone technology threats. bOutdated company dumpsters and trashing materials. cA & B. dNone.

✓Correct Answer: a)

Smartphone and mobile technology is the current source — mobile devices carry corporate data, join untrusted networks and run apps with broad permissions. Dumpster diving is an older physical vector, not the source of network spoofing.

Q2 · Part A 4 points

List four different types of high-tech tools, equipment, or sensors that can be carried or utilized by surveillance drones.

Any four from the list — one per line.

Q2 · Part B 3 points

State three negative drawbacks or business risks of promoting a brand on social media platforms.

Any three — one per line.

Q2 · Part C 3 points

List three specific vulnerabilities or threat types that are explicitly categorized as application-level threats.

Any three — one per line.

Answer all 10 multiple-choice questions before submitting, or wait for the 60 minute timer — the paper auto-submits when time runs out.

Cloud Services, Social Engineering &Attack Fundamentals

Cloud Services, Social Engineering &
Attack Fundamentals