For Teachers · Back to the Module · Print with your browser's Print command.

F1 Teacher Answer Key: Security Basics

Teacher Answer Key (about 15 minutes, Foundations level)

Name: ______________________ Class: __________ Date: __________

Learning Objectives

• [ ] Explain confidentiality, integrity and availability with server examples.
• [ ] Distinguish an asset, a threat, a vulnerability and a risk.
• [ ] Apply least privilege and defence in depth to a Linux web server.

Key Terms

Write each definition in your own words.

• CIA Triad: Confidentiality, integrity and availability: the three properties information security protects.
• Asset: Anything of value that needs protection, such as data, a service, a system or a reputation.
• Threat: Anything that could cause harm to an asset, such as an attacker or a failure.
• Vulnerability: A weakness that a threat could use to cause harm.
• Risk: The combination of how likely harm is and how serious it would be.
• Least Privilege: Giving every account and process only the access it needs, nothing more.
• Defence in Depth: Using several independent layers of protection so that one failure does not lead to compromise.
• Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --lab vulnerable --out f1
2. Open f1/report.html. For three findings, write which CIA property each one threatens.
3. For NET-DB-001, list the layers that should have stopped the database being reachable.

Self-Check Questions

1. A backup file containing customer records is downloadable from the website. Which property is mainly affected?

• [ ] a) Availability
• [x] b) Confidentiality
• [ ] c) Integrity
• [ ] d) None, because it is only a backup
• Answer: b. Anyone can read data they are not authorised to read, so confidentiality is broken. A backup holds the same real data as the live system.

1. Which statement best describes a vulnerability?

• [ ] a) A person who attacks systems
• [x] b) A weakness that a threat can use
• [ ] c) The money lost in an incident
• [ ] d) The chance that an incident happens
• Answer: b. A vulnerability is the weakness. The attacker is the threat, the loss is the impact, and likelihood combined with impact is risk.

1. Binding MySQL to 127.0.0.1 even though a firewall exists is an example of:

• [x] a) Defence in depth
• [ ] b) Security through obscurity
• [ ] c) Availability testing
• [ ] d) Risk acceptance
• Answer: a. A second, independent layer protects the service if the firewall fails. Layering protections so one failure is not fatal is defence in depth.

1. A flood of half-open connections stops a web site answering real users. Which property is affected?

• [ ] a) Confidentiality
• [ ] b) Integrity
• [x] c) Availability
• [ ] d) Authorisation
• Answer: c. Nothing is read or changed, but legitimate users cannot reach the service. That is a loss of availability.

1. Why does a vulnerability assessment not, by itself, measure risk to your organisation?

• [ ] a) Because scanners cannot find vulnerabilities
• [x] b) Because likelihood and impact depend on your environment
• [ ] c) Because risk only applies to networks, not servers
• [ ] d) Because the CVSS base score already includes your business impact
• Answer: b. Risk combines likelihood and impact. Both depend on your environment, which a tool cannot see. The CVSS base score describes the vulnerability in general, not your business.

1. A web application's account can read every database on the server, but it needs only one. Which principle is broken?

• [ ] a) Defence in depth
• [x] b) Least privilege
• [ ] c) Availability
• [ ] d) Security through obscurity
• Answer: b. Least privilege means every account gets only the access it needs. Access to the other databases is extra harm waiting for a compromise.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-12 Rev. 1, An Introduction to Information Security: https://csrc.nist.gov/pubs/sp/800/12/r1/final
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments: https://csrc.nist.gov/pubs/sp/800/30/r1/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.