Computer Science MCQs – Page 84 (Q831-840)

Regularly backing up important data to a separate, secure location is correctly the practice that best helps protect against data loss from ransomware attacks, since ransomware works by encrypting a victim's files and demanding payment for their release, meaning a victim with recent, unaffected backups can simply restore their data from that backup rather than being forced to consider paying the attacker's ransom demand, which offers no guarantee that files will actually be recovered even after payment. Effective ransomware protection through backups requires that backup copies be kept genuinely separate and disconnected from the primary system, since ransomware can sometimes spread to and encrypt connected backup drives or cloud storage if they remain continuously accessible from the infected system. Security experts recommend maintaining multiple backup copies following practices like the '3-2-1 rule,' with at least one backup kept offline or otherwise isolated specifically to ensure it remains protected even if the primary system becomes fully compromised by ransomware. Understanding backups as the single most effective ransomware countermeasure underscores why this fundamental data protection practice remains consistently emphasized across virtually all cybersecurity guidance.

The primary purpose of access control in computer security is correctly to restrict system or data access to authorized users only, ensuring that individuals can only view, modify, or interact with specific resources, files, or systems that they have been explicitly granted permission to access, based on their role, identity, or specific authorization level. This fundamental security principle helps prevent both external attackers and unauthorized internal users from accessing sensitive information or critical systems beyond their legitimate need or authorization, significantly reducing the potential damage from a compromised account or malicious insider. Access control mechanisms include various techniques like user authentication (verifying identity), authorization (determining what an authenticated user is permitted to do), and the principle of least privilege (granting only the minimum access necessary for a given role). Understanding access control as this fundamental restriction-based security principle is foundational to grasping how organizations protect sensitive data and systems from both external and internal unauthorized access.

Organizations might conduct security awareness training for employees correctly to educate employees on recognizing and avoiding common security threats like phishing, recognizing that human error and lack of awareness remain among the most significant cybersecurity vulnerabilities within any organization, since even the most sophisticated technical security measures can be circumvented if an employee is successfully tricked by a social engineering attack or phishing attempt. This training typically covers practical topics like identifying suspicious emails, using strong and unique passwords, safely handling sensitive data, and understanding proper procedures for reporting suspected security incidents. Regular, ongoing security awareness training has become an increasingly standard organizational practice, reflecting growing recognition that cybersecurity is not solely a technical IT department responsibility but requires informed, vigilant participation from every employee across an organization. Understanding the value of security awareness training highlights the important human dimension of cybersecurity, complementing purely technical defensive measures like firewalls and antivirus software.

A security patch is correctly defined as a software update specifically designed to fix a security vulnerability, representing a targeted code modification released by a software developer to close a specific identified weakness that could otherwise be exploited by attackers to compromise a system's security. Unlike broader feature updates that might add new functionality or improve performance, security patches are specifically focused on remediating known security flaws, often released with high priority given the potential risk these vulnerabilities pose if left unaddressed. Promptly applying security patches as soon as they become available is considered one of the single most effective and fundamental cybersecurity practices, since delaying patch application leaves known, exploitable vulnerabilities exposed for longer than necessary, giving attackers a wider window of opportunity. Understanding security patches as this targeted, vulnerability-specific type of software update helps clarify why prompt, regular patching is consistently emphasized as essential cybersecurity hygiene across both personal and organizational computing.

Many organizations enforce password expiration policies, requiring periodic password changes, correctly to reduce the risk from compromised passwords by limiting how long they remain valid, based on the reasoning that if a password is ever stolen or compromised without the organization's knowledge, requiring periodic changes limits the window of time during which an attacker could exploit that stolen credential before it automatically becomes invalid. This policy reflects a defense-in-depth approach to password security, acknowledging that despite other protective measures, some password compromises may go undetected for a period of time, and periodic forced changes provide an additional layer of protection against this possibility. It's worth noting that cybersecurity best practices around password expiration have evolved somewhat in recent years, with some experts now arguing that overly frequent forced changes can actually encourage weaker password choices as users struggle to remember new complex passwords repeatedly, suggesting that strong unique passwords combined with breach monitoring may sometimes be preferable to rigid expiration schedules alone. Understanding the underlying rationale, and the evolving debate, around password expiration policies provides useful context for this common but sometimes contested organizational security practice.

The 'least privilege' principle in security correctly means granting users only the minimum access necessary to perform their job, ensuring that individuals and systems are given the smallest possible set of permissions required to complete their specific, legitimate tasks, rather than broadly granting extensive access that exceeds what is actually needed for their role. This principle significantly reduces an organization's overall security risk, since limiting each user's access scope also limits the potential damage that could result if that particular account were ever compromised by an attacker, whether through a stolen password, malware infection, or social engineering attack. Implementing least privilege requires organizations to carefully define and regularly review appropriate access levels for different roles, avoiding the common but risky practice of granting broad administrative access by default for convenience. Understanding least privilege as this careful, minimal-access security principle is foundational to modern organizational cybersecurity practice, helping contain the potential impact of any single compromised account or credential.

Public sharing of personal information on social media is correctly considered a security risk because it can be used by attackers for social engineering or identity theft, since details like a person's birthdate, hometown, family members' names, or daily routine, seemingly innocent when shared individually, can be pieced together by attackers to answer security questions, craft convincing phishing messages, or otherwise impersonate the victim more credibly. Attackers routinely research potential targets' publicly available social media profiles before launching targeted phishing or social engineering attacks, using genuine personal details to make their fraudulent communications appear far more legitimate and trustworthy than a generic, impersonal scam attempt. This risk underscores the importance of reviewing and adjusting social media privacy settings, being thoughtful about what personal information is shared publicly, and remaining skeptical of unsolicited communications that reference seemingly personal details that could have been gathered from public social media profiles. Understanding this connection between social media oversharing and increased vulnerability to social engineering is practical, increasingly important digital literacy given how central social media has become to modern daily life.

The benefit of using a password manager is correctly that it helps generate and securely store strong, unique passwords for different accounts, addressing the common practical challenge of needing to create and remember dozens of complex, distinct passwords across numerous different online accounts, a task that becomes essentially impossible for most people to manage reliably through memory alone. Password managers typically encrypt and securely store a user's various account passwords behind a single strong master password, while also often including built-in tools to generate genuinely random, highly secure passwords for new accounts, eliminating the temptation to reuse weaker, more memorable passwords across multiple services. By making strong, unique passwords for every account practically manageable, password managers directly address one of the most significant and common cybersecurity vulnerabilities, password reuse, that would otherwise leave users disproportionately vulnerable if any single account's password were ever compromised in a data breach. Understanding password managers as this practical solution to the password complexity challenge is valuable, actionable cybersecurity literacy relevant to significantly improving one's overall personal account security.

Basic cybersecurity knowledge is correctly considered important in general computer literacy exams like PPSC because government and office employees regularly handle sensitive data and systems requiring security awareness, meaning that even non-technical administrative and clerical roles routinely involve access to confidential citizen records, financial information, or internal government systems that could cause significant harm if compromised through a preventable security lapse like falling for a phishing email or using weak passwords. As government services and record-keeping increasingly move toward digital systems, every employee, not just dedicated IT specialists, plays a role in maintaining the overall security posture of their organization through informed, security-conscious daily behavior. This is why exams like PPSC test practical cybersecurity concepts like recognizing phishing attempts, understanding strong password practices, and knowing basic safe computing habits, reflecting the genuine, widespread relevance of this knowledge across virtually all modern administrative and government roles. Understanding why this seemingly technical knowledge is broadly tested underscores how deeply cybersecurity awareness has become integrated into basic professional competency expectations across public sector employment.

The overall goal of practicing good digital hygiene, including regular updates, strong passwords, and caution with links, is correctly to reduce the risk of security incidents and protect personal and organizational data, representing a collection of consistent, proactive habits that collectively minimize vulnerability to the many different types of cyber threats individuals and organizations regularly face. Just as physical hygiene practices like handwashing reduce the risk of illness through consistent, small preventive habits rather than any single dramatic intervention, digital hygiene practices work cumulatively, with each individual habit reducing risk incrementally rather than any single measure providing complete, absolute protection on its own. This layered, habit-based approach to cybersecurity reflects the practical reality that perfect security is essentially unattainable, making consistent risk-reduction through good everyday practices the most realistic and effective overall strategy for both individuals and organizations. Understanding digital hygiene as this cumulative, habit-based risk-reduction approach helps contextualize why cybersecurity guidance consistently emphasizes multiple different practices working together rather than relying on any single protective measure alone.