Computer Science MCQs – Page 83 (Q821-830)

The purpose of Windows Defender, or similar built-in security tools, is correctly to provide built-in antivirus and security protection within the operating system, offering baseline malware detection, real-time threat monitoring, and firewall functionality automatically included with Windows at no additional cost, without requiring users to purchase or install a separate third-party antivirus solution. Windows Defender has significantly improved in effectiveness over the years, evolving from a relatively basic anti-spyware tool into a comprehensive security suite that performs competitively with many paid third-party antivirus products in independent testing. Having built-in security tools automatically active by default helps ensure that even users who don't proactively seek out and install additional security software still have some baseline level of malware protection running on their systems. Understanding built-in security tools like Windows Defender highlights how operating system vendors have increasingly integrated essential cybersecurity protection directly into their core products rather than treating it as a purely optional add-on.

Quarantine, when an antivirus program detects a threat, correctly means isolating the suspicious file to prevent it from harming the system while allowing review, moving the potentially malicious file to a secure, restricted location where it cannot execute or interact with the rest of the system, while still preserving it in case the detection turns out to be a false positive requiring restoration. This cautious, non-destructive approach contrasts with immediately and permanently deleting a detected file, since quarantine allows for verification and potential recovery if a legitimate file was mistakenly flagged as a threat, a phenomenon known as a false positive. Users can typically review their antivirus software's quarantine list, choosing to permanently delete confirmed threats or restore files that were incorrectly flagged, providing an important safety check within the automated detection process. Understanding quarantine as this cautious, reversible containment strategy helps clarify how antivirus software balances proactive threat neutralization against the risk of inappropriately destroying legitimate, mistakenly flagged files.

Software should only be downloaded from official or trusted sources correctly because unofficial sources may bundle malware with the software, meaning that third-party download sites, particularly those offering popular paid software for free or promising cracked versions of premium applications, often secretly package additional malicious software alongside the seemingly desired program, infecting a user's system during what appears to be a legitimate installation process. Official sources, such as a developer's own website or established app stores like the Microsoft Store or Google Play, typically implement at least some level of security vetting and verification, significantly reducing, though not entirely eliminating, the risk of downloading disguised malware. This risk is particularly pronounced with pirated or 'cracked' software specifically designed to bypass licensing restrictions, since such files are especially common vectors for malware distribution, exploiting users' desire to avoid paying for legitimate software licenses. Understanding this download-source risk is a fundamental, practical cybersecurity habit relevant to avoiding a significant proportion of common malware infections.

A zero-day vulnerability in cybersecurity is correctly defined as a previously unknown security flaw that is exploited before developers can fix it, referring to a software weakness that attackers discover and actively exploit before the software's developers become aware of its existence, meaning there has been 'zero days' of opportunity for the developer to create and distribute a protective patch. These vulnerabilities are particularly dangerous precisely because no defense or patch exists at the time of initial exploitation, leaving even fully updated, otherwise well-protected systems vulnerable until the flaw is discovered, publicly disclosed, and eventually patched by the software vendor. Zero-day vulnerabilities are highly valued by both malicious attackers and, controversially, by some government intelligence agencies and cybersecurity researchers, sometimes traded or sold for substantial sums on specialized markets given their significant potential value for conducting undetected attacks. Understanding zero-day vulnerabilities highlights an important limitation of purely reactive, patch-based cybersecurity defenses, since these particular threats specifically exploit the inherent gap between vulnerability discovery and eventual remediation.

Multi-factor authentication is correctly generally designed to improve account security by requiring multiple forms of verification, combining something a user knows (like a password) with something they possess (like a phone receiving a verification code) or something inherent to them (like a fingerprint), providing a significantly stronger layer of security than relying on a single authentication factor alone. This additional verification requirement means that even if an attacker successfully steals or guesses a user's password through phishing or a data breach, they would still be unable to access the account without also possessing the additional required authentication factor. Multi-factor authentication has become an increasingly standard security recommendation across banking, email, and social media platforms, reflecting growing recognition that passwords alone provide insufficient protection given the prevalence of data breaches and phishing attacks. Understanding and enabling multi-factor authentication wherever available is considered one of the most effective and widely recommended additional cybersecurity practices for protecting online accounts.

The risk of using outdated or unsupported software is correctly that it may no longer receive security updates, making it vulnerable to known exploits, since software vendors eventually discontinue support for older versions, meaning newly discovered security vulnerabilities in that outdated software will never be patched or fixed, leaving it permanently exposed to attackers who can freely exploit those known, unaddressed weaknesses. This risk is particularly significant for operating systems and widely used applications, since attackers specifically target known vulnerabilities in popular but unsupported software, knowing that a substantial number of users may still be running these vulnerable, unpatched versions. Continuing to use unsupported software also often means missing out on broader security architecture improvements and modern protective features that newer software versions incorporate, compounding the security risk beyond just unpatched specific vulnerabilities. Understanding this risk underscores why cybersecurity best practices consistently emphasize both promptly installing available updates and eventually migrating away from software that has reached its official end-of-support date.

HTTPS in a website's address bar generally indicates to users correctly that the connection to the site is encrypted, offering better security than plain HTTP, meaning any data transmitted between the user's browser and the website's server, such as login credentials or payment information, is protected from interception and reading by unauthorized third parties during transmission. This encryption is achieved through TLS (Transport Layer Security), which establishes a secure, encrypted channel before any actual sensitive data is exchanged between the browser and server. While HTTPS confirms that a connection is encrypted, it's important to understand that it does not guarantee a website is legitimate or trustworthy overall, since scammers can also obtain HTTPS certificates for fraudulent websites, meaning HTTPS should be viewed as one positive security signal among several factors to consider, rather than a complete guarantee of a site's overall trustworthiness. Understanding what HTTPS does and does not indicate is important nuanced practical cybersecurity literacy for safely navigating the internet.

The padlock icon often shown in a browser's address bar is correctly meant to indicate that the connection to the website is secure (HTTPS), providing users with a simple, immediately visible visual cue confirming that data transmitted between their browser and the website is encrypted and protected from interception during transit. This small but important visual indicator has become a widely recognized symbol that many users have learned to look for as a basic safety check before entering sensitive information like passwords or payment details on a website. However, similar to the broader HTTPS indication itself, the padlock icon alone doesn't guarantee a website's overall legitimacy or trustworthiness, since fraudulent websites can also obtain valid HTTPS certificates and display this same padlock icon, meaning users should still exercise broader judgment about a site's overall credibility beyond just checking for this single visual indicator. Understanding both the value and the limitations of the padlock icon is practical, nuanced cybersecurity literacy for safe everyday internet browsing.

If you suspect your computer is infected with malware, the correct recommended action is to run a full antivirus scan and take recommended action, such as removing the threat, allowing dedicated security software to thoroughly examine the system for known malware signatures and suspicious behavioral patterns, then following its guidance to quarantine or remove any confirmed threats it identifies. Continuing to use a potentially infected computer normally without taking any protective action risks further data compromise, spreading the infection to other connected devices or files, or allowing the malware to continue whatever malicious activity it was designed to perform. In more severe or persistent infection cases that a standard antivirus scan cannot fully resolve, seeking assistance from a qualified IT professional, or in extreme cases, backing up essential data and performing a complete operating system reinstall, may become necessary additional steps. Understanding this appropriate scan-and-remediate response is fundamental practical cybersecurity knowledge for responding effectively to a suspected malware infection.

Regular software and OS updating is correctly considered an important security habit because updates often include patches for newly discovered security vulnerabilities, addressing weaknesses that could otherwise be exploited by attackers to gain unauthorized access, install malware, or otherwise compromise a system's security. Software developers and security researchers continuously discover new vulnerabilities in existing software, releasing timely patches to close these gaps before they can be widely exploited, meaning that delaying updates leaves known, documented weaknesses exposed for longer than necessary. Beyond security fixes specifically, updates also frequently address general bugs and stability issues while sometimes introducing new features or performance improvements, providing additional practical benefits beyond just the core security rationale. This is why cybersecurity best practices, taught in basic computer literacy and professional IT training alike, consistently emphasize enabling automatic updates or regularly checking for and promptly installing them manually.