# Mid-Term Exam Questions — Transcription & Verification

**Source images:** `photo_1_2026-06-25_01-30-26.jpg` through `photo_24_2026-06-25_01-30-26.jpg`  
**Verified against:** `lessons/intro-playlist-concepts.html`, `lessons/crypto-landscape.html`, `reference/glossary.html`, `NOTES.md` (intro playlist topics)

---

## Summary Table

| Q# | Concept tag | User correct? | Verified answer |
|----|-------------|---------------|-----------------|
| 1 | Security roles — data custodian | ✓ | Ensuring access control implementation |
| 2 | Threat types — insider | ✓ | Insider threat |
| 3 | Threat types — technical | ✓ | True |
| 4 | Threat definition | ✓ | A potential danger to an asset |
| 5 | Threat nature | ✓ | False |
| 6 | Asset definition | ✓ | Anything of value to an organization |
| 7 | Human error classification | ✓ | Unintentional threat |
| 8 | CIA — integrity | ✓ | True |
| 9 | Security responsibility | ✓ | False |
| 10 | Shoulder surfing | ✓ | Deliberate human threat |
| 11 | Social engineering classification | ✓ | False |
| 12 | History of computer security | ✓ | The military |
| 13 | Threat vs damage | ✓ | False |
| 14 | Unintentional vs deliberate damage | ✓ | True |
| 15 | InfoSec primary goal | ✓ | Protecting CIA |
| 16 | CIA — integrity | ✓ | Integrity |
| 17 | Security vs usability | ✗ (exam) | Trade-off — see study bank note |
| 18 | Information system definition | ✓ | People + processes + HW + SW + data |
| 19 | Dictionary attack | ✓ | Attempting known words from a predefined list |
| 20 | Deliberate threat | ✓ | Social engineering |
| 21 | Natural threat | ✓ | Earthquake |
| 22 | Non-deliberate human threat | ✓ | Accidental data deletion |
| 23 | CIA triad components | ✓ | Accountability |
| 24 | Security roles — policy enforcement | ✓ | Security officer |

**Score: 23 / 24 correct (95.8%)**

---

## Pattern Analysis

### Question types
| Type | Count | % |
|------|-------|---|
| MCQ | 15 | 62.5% |
| True/False | 9 | 37.5% |

### Concept frequency (tags)
| Concept area | Questions | Q numbers |
|--------------|-----------|-----------|
| Threat classification (natural / technical / human / insider / deliberate) | 10 | 2, 3, 5, 7, 10, 11, 13, 14, 20, 21, 22 |
| CIA triad | 4 | 8, 15, 16, 23 |
| Security roles & governance | 3 | 1, 9, 24 |
| Foundational definitions (asset, threat, info system) | 3 | 4, 6, 18 |
| Attack types (dictionary, social engineering, shoulder surfing) | 3 | 10, 19, 20 |
| Frameworks / models | 1 | 17 |
| History | 1 | 12 |

### Implications for final exam
1. **Threat taxonomy is the dominant topic** — know natural vs technical vs human (deliberate vs unintentional/accidental) vs insider; be able to classify concrete examples (earthquake, power outage, shoulder surfing, social engineering, accidental deletion, disgruntled employee).
2. **CIA triad appears repeatedly** — memorize definitions; know what is *not* CIA (accountability, authenticity, etc.).
3. **Security roles** — data owner (sets/grants access), data custodian (implements/maintains controls), security officer (enforces policies), CISO/CIO context.
4. **True/False traps** — absolute words ("always," "solely," "all threats are deliberate") are usually False; partial-truth statements about damage equivalence (Q14) are True.
5. **Authentication attacks** — dictionary vs brute force distinction (word list vs all combinations).
6. **Final exam likely adds algorithms** — this mid-term is 100% intro concepts; final will probably include DES, RC4, RSA, DH, SHA-1 per course study path (`NOTES.md`).
7. **Weak spot to review:** Q17 — original exam asked for a *named model* for security vs usability; course materials only teach this as a **trade-off** (V2), not McCumber Cube or the other options. Question bank uses a clearer replacement question.

---

## Q1 — Security roles (data custodian)

**Type:** MCQ  
**Question:** A data custodian is primarily responsible for:  
**Options:**
- A) Creating security policies
- B) Ensuring access control implementation
- C) Assigning user roles
- D) Granting final access approval

**User selected:** Ensuring access control implementation  
**Verified correct answer:** Ensuring access control implementation  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V7 — Security Roles)  
**Notes:** Data owner sets access rules and approves access; custodian stores/maintains data and implements technical controls including access control enforcement.

---

## Q2 — Threat types (insider)

**Type:** MCQ  
**Question:** A disgruntled employee leaking data is:  
**Options:**
- A) Natural disaster
- B) Accidental threat
- C) Insider threat

**User selected:** Insider threat  
**Verified correct answer:** Insider threat  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Threats)  
**Notes:** Deliberate action by someone with authorized internal access = insider threat.

---

## Q3 — Threat types (technical)

**Type:** True/False  
**Question:** A power outage is a form of technical threat.  
**Options:**
- True
- False

**User selected:** True  
**Verified correct answer:** True  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (threat taxonomy); standard Stallings intro classification  
**Notes:** Power/infrastructure failures are classified as technical/environmental threats (not human, not natural disaster). Affects availability.

---

## Q4 — Threat definition

**Type:** MCQ  
**Question:** A threat is:  
**Options:**
- A) Always a virus
- B) A potential danger to an asset
- C) A policy
- D) An antivirus tool

**User selected:** A potential danger to an asset  
**Verified correct answer:** A potential danger to an asset  
**User was:** ✓ Correct  
**Source:** [glossary.html](../../reference/glossary.html) — Threat  
**Notes:** Threat = any source of danger; not limited to malware. Distinct from vulnerability (weakness) and policy (control).

---

## Q5 — Threat nature

**Type:** True/False  
**Question:** All threats are deliberate and malicious.  
**Options:**
- True
- False

**User selected:** False  
**Verified correct answer:** False  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — human error, natural threats)  
**Notes:** Threats include natural disasters, accidental human error, and technical failures — not all are deliberate.

---

## Q6 — Asset definition

**Type:** MCQ  
**Question:** An asset in information security refers to:  
**Options:**
- A) Financial investments
- B) Tangible equipment
- C) Anything of value to an organization
- D) All of the above

**User selected:** Anything of value to an organization  
**Verified correct answer:** Anything of value to an organization  
**User was:** ✓ Correct  
**Source:** [glossary.html](../../reference/glossary.html) — Asset; [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html)  
**Notes:** Canonical definition: anything of value to protect (data, systems, hardware, people). Options A and B are examples/subsets; C is the textbook definition.

---

## Q7 — Human error classification

**Type:** MCQ  
**Question:** Human error is classified as a  
**Options:**
- A) Natural threat
- B) Deliberate threat
- C) Unintentional threat

**User selected:** Unintentional threat  
**Verified correct answer:** Unintentional threat  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Human error)  
**Notes:** Human error = unintentional/accidental human threat; employees are cited as a major threat to sensitive data.

---

## Q8 — CIA (integrity)

**Type:** True/False  
**Question:** Integrity means data is accurate and unaltered.  
**Options:**
- True
- False

**User selected:** True  
**Verified correct answer:** True  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) — Integrity  
**Notes:** Integrity = no unauthorized modification; data remains accurate and trustworthy.

---

## Q9 — Security responsibility

**Type:** True/False  
**Question:** Security is solely the responsibility of the IT department.  
**Options:**
- True
- False

**User selected:** False  
**Verified correct answer:** False  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V7 — security as art + science + social science; top-down approach)  
**Notes:** Security is organization-wide; management-driven top-down approach succeeds; not IT-only.

---

## Q10 — Shoulder surfing

**Type:** MCQ  
**Question:** Shoulder surfing is an example of:  
**Options:**
- A) Natural threat
- B) Deliberate human threat
- C) Accidental threat

**User selected:** Deliberate human threat  
**Verified correct answer:** Deliberate human threat  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Shoulder surfing)  
**Notes:** Deliberately spying on screen/keyboard to capture passwords = deliberate human threat.

---

## Q11 — Social engineering classification

**Type:** True/False  
**Question:** Social engineering is a natural threat.  
**Options:**
- True
- False

**User selected:** False  
**Verified correct answer:** False  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Threats)  
**Notes:** Social engineering is a deliberate human threat, not natural.

---

## Q12 — History of computer security

**Type:** MCQ  
**Question:** The origin of computer security started with  
**Options:**
- A) Banking sector
- B) The military
- C) Retail companies
- D) Universities

**User selected:** The military  
**Verified correct answer:** The military  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V1 — evolved from physical computer security / mainframes); [NOTES.md](../../NOTES.md)  
**Notes:** Computer security origins trace to military/government need to protect classified systems (MULTICS, ARPANET era).

---

## Q13 — Threat vs damage

**Type:** True/False  
**Question:** Threats always lead to actual damage.  
**Options:**
- True
- False

**User selected:** False  
**Verified correct answer:** False  
**User was:** ✓ Correct  
**Source:** [glossary.html](../../reference/glossary.html) — Threat  
**Notes:** A threat is a *potential* danger; it may never materialize if controls mitigate it.

---

## Q14 — Unintentional vs deliberate damage

**Type:** True/False  
**Question:** Unintentional human threats can be as damaging as deliberate ones.  
**Options:**
- True
- False

**User selected:** True  
**Verified correct answer:** True  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Human error)  
**Notes:** Human error/accidents can cause severe data loss comparable to deliberate attacks.

---

## Q15 — InfoSec primary goal

**Type:** MCQ  
**Question:** What is the primary goal of information security?  
**Options:**
- A) Making information private
- B) Preventing hardware theft
- C) Protecting information confidentiality, integrity, and availability
- D) Promoting software sales

**User selected:** Protecting information confidentiality, integrity, and availability  
**Verified correct answer:** Protecting information confidentiality, integrity, and availability  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html); [crypto-landscape.html](../../lessons/crypto-landscape.html) — CIA  
**Notes:** CIA triad is the core goal framework; privacy alone is only confidentiality.

---

## Q16 — CIA (integrity)

**Type:** MCQ  
**Question:** Which concept best describes the assurance that information is trustworthy and accurate?  
**Options:**
- A) Availability
- B) Confidentiality
- C) Integrity
- D) Accountability

**User selected:** Integrity  
**Verified correct answer:** Integrity  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) — Integrity  
**Notes:** Integrity = data has not been improperly altered; trustworthy and accurate.

---

## Q17 — Security vs usability

**Type:** MCQ  
**Question (original exam):** Which model represents a balance between security and ease of use?  
**Options:**
- A) Bell-LaPadula
- B) Parkerian Hexad
- C) McCumber Cube
- D) Open System Interconnection

**User selected:** McCumber Cube  
**Verified correct answer (original exam):** *None of the four options match course materials.*  
**User was:** ✗ Incorrect  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V2 — Security vs usability)

**What to study instead:** The course defines **security vs usability** as a **trade-off** — stronger security (e.g. complex passwords) often makes systems harder for users. McCumber Cube maps CIA to data states and controls; it is not the usability-balance model.

**Question bank replacement:** *"The relationship between security and ease of use is best described as a trade-off — stronger security can make systems harder for users."* (correct answer in [question-bank.html](../../question-bank.html))

---

## Q18 — Information system definition

**Type:** MCQ  
**Question:** Which of the following best defines an "information system" in the context of Information Security?  
**Options:**
- A) A collection of internet services
- B) A set of hardware and software components
- C) An organized combination of people, processes, hardware, software, and data
- D) A single software application

**User selected:** An organized combination of people, processes, hardware, software, and data  
**Verified correct answer:** An organized combination of people, processes, hardware, software, and data  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V4 — Information system)  
**Notes:** Information system = hardware, software, data, people, procedures (processes).

---

## Q19 — Dictionary attack

**Type:** MCQ  
**Question:** Which of the following best describes a dictionary attack?  
**Options:**
- A) Using random numbers to guess passwords
- B) Stealing credentials via spyware
- C) Attempting known words from a predefined list
- D) Encrypting user files and demanding ransom

**User selected:** Attempting known words from a predefined list  
**Verified correct answer:** Attempting known words from a predefined list  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V2 — Dictionary attack)  
**Notes:** Dictionary attack tries common/leaked passwords from a word list; contrast with brute force (all combinations).

---

## Q20 — Deliberate threat

**Type:** MCQ  
**Question:** Which of the following is a deliberate threat?  
**Options:**
- A) Fire
- B) Software bug
- C) Social engineering

**User selected:** Social engineering  
**Verified correct answer:** Social engineering  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Threats)  
**Notes:** Fire can be natural/accidental; software bug is technical/unintentional; social engineering is deliberate human manipulation.

---

## Q21 — Natural threat

**Type:** MCQ  
**Question:** Which of the following is a natural threat?  
**Options:**
- A) Malware
- B) Earthquake
- C) Insider attack
- D) Hacker

**User selected:** Earthquake  
**Verified correct answer:** Earthquake  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (Threat taxonomy)  
**Notes:** Natural = acts of nature (earthquake, flood, fire from natural causes). Others are human-origin.

---

## Q22 — Non-deliberate human threat

**Type:** MCQ  
**Question:** Which of the following is a non-deliberate human threat?  
**Options:**
- A) Insider sabotage
- B) Malware
- C) Accidental data deletion
- D) Social engineering

**User selected:** Accidental data deletion  
**Verified correct answer:** Accidental data deletion  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V8–V9 — Human error)  
**Notes:** Accidental deletion = unintentional human threat. Sabotage and social engineering are deliberate; malware is typically deliberate human-created.

---

## Q23 — CIA triad components

**Type:** MCQ  
**Question:** Which of the following is not one of the C.I.A. triad components?  
**Options:**
- A) Accountability
- B) Confidentiality
- C) Integrity
- D) Availability

**User selected:** Accountability  
**Verified correct answer:** Accountability  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html); [glossary.html](../../reference/glossary.html) — CIA  
**Notes:** CIA = Confidentiality, Integrity, Availability only. Accountability is a separate security property.

---

## Q24 — Security roles (policy enforcement)

**Type:** MCQ  
**Question:** Which role is typically responsible for enforcing security policies in an organization?  
**Options:**
- A) Security auditor
- B) Security analyst
- C) Security officer
- D) System user

**User selected:** Security officer  
**Verified correct answer:** Security officer  
**User was:** ✓ Correct  
**Source:** [intro-playlist-concepts.html](../../lessons/intro-playlist-concepts.html) (V7 — Security Roles); [NOTES.md](../../NOTES.md)  
**Notes:** Security officer enforces policies day-to-day; auditor reviews compliance; analyst monitors/threat-hunts; user follows policies.

---

## Concept tags (full list)

1. Security roles — data custodian  
2. Threat types — insider  
3. Threat types — technical  
4. Threat definition  
5. Threat nature  
6. Asset definition  
7. Human error classification  
8. CIA — integrity  
9. Security responsibility  
10. Shoulder surfing  
11. Social engineering classification  
12. History of computer security  
13. Threat vs damage  
14. Unintentional vs deliberate damage  
15. InfoSec primary goal  
16. CIA — integrity  
17. Security vs usability model  
18. Information system definition  
19. Dictionary attack  
20. Deliberate threat  
21. Natural threat  
22. Non-deliberate human threat  
23. CIA triad components  
24. Security roles — policy enforcement  

**Unique concept areas:** Security roles, Threat taxonomy/classification, CIA triad, Foundational definitions, Attack types, Frameworks/models, History