TU Wien:Foundations of System and Application Security VU (Lindorfer)/Exam 2025-01-23

Single Choice Questions

(2P) IoT

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 CoAP implements the REST architecture and mainly uses TCP.

	True
	False

2 In CoAP the security level "Pre-Shared Key" uses asymmetric keys that are shared in-band.

	True
	False

3 In HbbTV an attacker can inject a malicious URL into the HbbTV URL in the AIT section of the stream and retransmit it.

	True
	False

4 XMPP has no default support for end-to-end encryption.

	True
	False

(2P) MQTT

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 MQTT is a peer-to-peer protocol, so clients communicate with each other directly.

	True
	False

2 MQTT retained messages are stored by the broker and are transmitted to clients connecting.

	True
	False

3 MQTT Will messages are stored by the broker and are transmitted to clients connecting, while retained messages are sent when a client unexpectedly disconnects.

	True
	False

4 MQTT supports password authentication.

	True
	False

(2P) Network Security

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 If an attacker can successfully perform ARP spoofing, it is possible to eavesdrop the connection between two clients.

	True
	False

2 If you want to restrict access to a service running on a server, you block it on the OUTPUT chain of the firewall.

	True
	False

3 You can use the firewall to completely ban clients that performed the wrong requests too often.

	True
	False

4 It is possible to track connections to the TOR network because the IPs of TOR entry nodes are publicly known.

	True
	False

(2P) TLS

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 TLS encrypts the whole HTTP request, including the domain name of the target server.

	True
	False

2 The cipher suites used are negotiated in the TLS handshake.

	True
	False

3 -

	True
	False

4 -

	True
	False

(2P) Firefox

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 It is a reasonable assumption that developers write bug free code.

	True
	False

2 Browser code (Firefox UI) should never have to convert arbitrary strings to code.

	True
	False

3 Browser code (Firefox UI) should never have to load remote JS.

	True
	False

4 The privileged pages of Firefox (about-preferences) use CSP to mitigate code injection.

	True
	False

(2P) Machine Learning

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 Data snooping does not affect the classification performance of unseen data.

	True
	False

2 Data snooping leads to unrealistic metrics in performance evaluation.

	True
	False

3 It is a best practice to train using the whole data set.

	True
	False

4 Data snooping happens when training with test data.

	True
	False