TU Wien:Foundations of System and Application Security VU (Lindorfer)/Exam 2026-01-22

Single Choice Questions

(2P) IoT Protocols

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 CoAP is based on the REST architectural style and mainly utilizes UDP as the underlying transport protocol for lightweight and efficient communication.

	True
	False

2 In CoAP Pre-Shared Key (PSK), asymmetric keys are used for encryption, which are distributed in-band.

	True
	False

3 XMPP does not support end-to-end encryption without extensions.

	True
	False

4 During a DVB injection attack, a malicious actor replaces the HbbTV URL in the Application Information Table (AIT) and remodulates the signal to target the victim TV.

	True
	False

(2P) MQTT

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 Retained messages are stored by the broker and sent to all topics when a new client connects.

	True
	False

2 Will messages are stored by the broker and sent when the client who created the message abruptly disconnects.

	True
	False

3 MQTT uses a peer-to-peer architecture where devices communicate directly.

	True
	False

4 MQTT does not require, but supports, authentication mechanisms using user-names and passwords.

	True
	False

(2P) Networks

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 Eavesdropping on a wired connection can only be achieved with special hardware.

	True
	False

2 Virtual LAN tagging (VLANs) can be used to create separate broadcast domains on the same hardware.

	True
	False

3 Any IPv4 address in the 127.0.0.0/8 range, such as 127.0.0.53, is reserved for loopback communication.

	True
	False

4 f1f1::2::53 is a valid IPv6 address for link-local communication.

	True
	False

(2P) TLS

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 TLS guarantees confidentiality, integrity, and availability (all three aspects of the CIA triad).

	True
	False

2 A program can use its own bundle of root certificates as its trust anchor, instead of relying on the operating system.

	True
	False

3 The cipher suite used for a connection is negotiated between the client and server during the TLS handshake.

	True
	False

4 To validate certificates, a chain of signatures needs to be established to a trust anchor (such as root certificates).

	True
	False

(2P) Malicious Software

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 Malware that self-replicates automatically over the network is called a worm.

	True
	False

2 Malware that aims to encrypt user data is called a rootkit.

	True
	False

3 Domain-generation-algorithms (DGAs) are used by malware to evade domain-based detection and filtering.

	True
	False

4 Honeypots must be placed outside the network firewall and cannot be deployed inside a DMZ or internally.

	True
	False

(2P) Threat Modelling and CVE IDs

Pluspunkt für eine richtige Antwort:
Punkt für eine falsche Antwort:
Ignoriere die Fragen-Koeffizienten:

1 Threat modelling is a process that should be repeated regularly.

	True
	False

2 Defining a scope for threat modelling is a step that can be skipped to directly determine threats.

	True
	False

3 CVE IDs are only assigned by the vendor of the affected software or hardware.

	True
	False

4 Using CVE IDs allows organizations to track vulnerabilities across multiple systems and products efficiently.

	True
	False