Deck 19: Security Threats and Solutions in Cryptography and Access Control

Question 1

Security threats can originate from ________.

A) malicious users
B) malicious software
C) outside the system via a network connection
D) all of the above

Answer 1

D

Question 2

A substitution cipher ________.

A) changes the order of the letters in the message
B) changes a message such that every occurrence of a particular letter is replaced by a different letter
C) uses a secret key to encrypt the bits of a message.
D) none of the above

Answer 2

B

Question 3

Cryptography is important because it ________.

A) protects system components from malicious users
B) encodes and decodes messages so that it can be interpreted only by the intended recipients
C) restricts the capabilities of untrusted users of a system
D) protects a network from intruders

Answer 3

B

Question 4

Which of the following is not a problem with secret-key cryptography?

A) It requires a large amount of processing time and complexity to implement.
B) Two parties must find a secure way to exchange the key.
C) A sender needs a different key for each receiver.
D) If the key is intercepted, a third party could pose as either host in the communication.

Question 5

A key distribution center is ________.

A) the component that actually performs the encryption and decryption
B) a central authority that shares a different key with each user
C) an organization that develops and supports security algorithms
D) a system that transfers keys between hosts

Question 6

Public-key cryptography is symmetric in that ________.

A) it decrypts messages using the same key it uses to encrypt
B) both the sender and the receiver use the same key
C) it employs two inversely related keys
D) either host can create a key and both hosts can use it

Question 7

Which of the following is not true of PGP?

A) It is a public-key encryption system that encrypts e-mail and files.
B) It can provide digital signatures.
C) It is based on a "web of trust."
D) It authenticates all users of PGP to all other users.

Question 8

A user can be identified by ________.

A) user knowledge, such as passwords, PINs and lock combinations
B) ownership of an item, such as badges, keys and smart cards
C) a unique characteristic such as a fingerprint
D) all of the above

Question 9

Attempting all possible passwords in attempt to guess the correct one is known as________.

A) scripting
B) dictionary attacking
C) brute-force cracking
D) trial and error

Question 10

Which of the following is not an effective way to increase the security of a password against cracking?

A) Encouraging users not to write down their passwords.
B) Using password salting.
C) Limiting the number of failed attempts to access a user's account.
D) Encouraging users to change their passwords often.

Question 11

A biometric is a(n) ________.

A) unique personal characteristic
B) a program that validates a user's identification.
C) an encrypted password.
D) a card containing a microprocessor used to perform authenticiation.

Question 12

Which of the following is not true of a smart card?

A) It often is designed to resemble a credit card.
B) It requires physical contact between the user and the card.
C) It can store private keys or digital certificates.
D) It can store credit card numbers or contact information.

Question 13

How is authentication in Kerberos handled?

A) With a key distribution center (KDC).
B) With a two-factor authentication service.
C) With an authentication server and a ticket granting service (TGS).
D) all of the above

Question 14

According to the text, approximately how many attacks on corporate networks are internal?

A) 0%
B) 25%
C) 50%
D) 75%

Question 15

Authentication server scripts more secure than workstation login scripts because ________.

A) a single login allows a user access to multiple applications
B) user passwords are encrypted to hide them from other users
C) passwords are maintained in only one (typically secure) location
D) none of the above

Question 16

________ is the most advanced single sign-on system.

A) A workstation login script
B) An authentication server script
C) Token-based authentication
D) none of the above

Question 17

Access rights define how various ________ can access various ________.

A) subjects, objects
B) processes, resources
C) users, software
D) all of the above

Question 18

________ is not a common access right.

A) Remove
B) Read
C) Write
D) Execute

Question 19

A security model defines ________.

A) privileges
B) resource types
C) subjects
D) both a and c

Question 20

The primary appeal of a role-based access control model is that ________.

A) it allows users to belong to multiple roles
B) it assigns relationships between subjects and objects that are not limited to classes such as owners and groups
C) administrators only need to define specifics roles and assign users to those roles rather than defining specific privileges for each user
D) none of the above

Question 21

Each cell in an access control matrix represents ________.

A) whether a resource can be accessed by any user
B) the actions that a subject can perform on an object
C) whether a user belongs to a particular group
D) whether a group has access to a resource

Question 22

Which of the following is not true of a capability?

A) A capability can be created or discarded at will by the holder of the capability.
B) It is often implemented as a unique object identifier.
C) It is a pointer or token that grants privileges to the subject that possesses it.
D) Systems that employ capabilities can suffer from the lost object problem.

Question 23

How does a cryptanalytic attack typically work?

A) It uses brute force to decrypt a message.
B) It uses a public key to determine information about the private key.
C) It exploits weak statistical trends between the key and the ciphertext to gain knowledge about the key.
D) It overloads the receiver so that legitimate messages cannot be received.

Question 24

Trojan horse viruses are difficult to detect because ________.

A) they hide within the system until a certain time or condition is met
B) they allow a malicious user access to the system
C) they do not require any user action to be activated
D) they appear to be legitimate programs

Question 25

A resident virus is a virus that ________.

A) infects a system and spreads over a network to other systems.
B) infects the boot sector of a computer's hard disk.
C) enters a system hidden within a legitimate application.
D) that operates until the computer is powered down.

Question 26

A distributed denial-of-service attack is ________.

A) an attack in which requests are sent from multiple sources to overload a system.
B) an attack on a distributed system that overloads its network communications.
C) a means to counteract the security provided by a firewall.
D) none of the above

Question 27

A common software exploitation is a ________.

A) buffer overflow attack
B) denial-of-service attack
C) cryptanalytic attack
D) brute-force attack

Question 28

Which of the following is not true of system penetration?

A) Every system penetration is potentially dangerous.
B) It is a successful breach of a system's security.
C) It leads to denial of service.
D) Many attacks rely on a successful system penetration.

Question 29

Which of the following is a limitation of packet-filtering firewalls?

A) They do not protect against brute-force attacks.
B) They consider only the source of data packets, not the attached data.
C) It does not police inbound traffic, only outbound traffic.
D) They are not scalable to large businesses.

Question 30

Host-based intrusion detection is especially useful for detecting ________.

A) brute-force attacks
B) cryptanalytic attacks
C) denial-of-service attacks
D) Trojan horse attacks

Question 31

The first step in a static analysis for intrusion detection is ________.

A) building a model of an application's expected behavior
B) monitoring an application's system calls
C) identifying vulnerabilities in an application
D) developing a security plan

Question 32

A limitation of signature-scanning virus detection is that ________.

A) variants and polymorphic viruses can slip through undetected
B) it can introduce false positives and false negatives
C) virus lists can become prohibitively large as viruses proliferate
D) all of the above

Question 33

How is heuristic scanning similar to signature-scanning?

A) It is susceptible to false reporting.
B) It can detect viruses that have not yet been identified.
C) It searches for common virus behavior.
D) all of the above

Question 34

Which of the following is important for addressing security flaws?

A) Developing and releasing patches for flaws.
B) Discovering previously undetected flaws.
C) Communicating with users.
D) all of the above

Question 35

________ is not required for secure transactions.

A) Authorization
B) Authentication
C) Digital signatures
D) Privacy

Question 36

What is the nonrepudiation issue for secure transactions?

A) How do you ensure that the information you transmit has not been compromised?
B) How do you ensure that the information you transmit has not been captured?
C) How do you prove that a message was sent or received?
D) How do the sender and receiver verify their identities?

Question 37

________ is the most common key-agreement protocol.

A) Secret key
B) Digital envelope
C) Session key
D) Triple DES

Question 38

Digital signatures are designed to address ________.

A) privacy
B) authorization
C) authentication
D) nonrepudiation

Question 39

A certificate authority is a(n) ________.

A) repository for digital certificates.
B) digital document that identifies a user.
C) organization that sets policies for obtaining digital certificates.
D) trusted third party that issues a digital certificate.

Question 40

Digital certificates are created with an expiration date ________.

A) So that if the certificate is compromised it can be cancelled.
B) To force users to refresh their certificate regularly.
C) So that if a certificate is issued incorrectly, it will eventually expire.
D) none of the above

Question 41

The Secure Sockets Layer does not ________.

A) require client authentication
B) secure communication between two computers on the Internet
C) determine whether packets have been maliciously altered during transmission.
D) implement public-key cryptography using the RSA algorithm

Question 42

What is IP spoofing?

A) A denial-of-service attack that uses a single IP address.
B) Simulating the IP address of an authorized user to gain access to a system.
C) A means of filtering packets by testing their source IP address.
D) A secure means of transmitting data over the Internet.

Question 43

Which of the following is a problem for implementing wireless security?

A) Unstable connections can cause a secure connection to fail, requiring it to be reinitiated.
B) Low bandwidth and processing power limit the ability to implement complex security mechanisms.
C) Accessing transmitted data does not require physically tapping into a wire.
D) all of the above

Question 44

Which of the following statements about proprietary software security implementations is false?

A) Developers are sometimes unwilling to disclose security flaws.
B) They are not always interoperable with other security programs.
C) They use security by obscurity.
D) They cannot be, in general, as secure as open-source software security implementations.

Question 45

A shadow password file is a(n) ________.

A) imitation password file used by the system to trick malicious users
B) false password file that is placed on a system by a malicious user
C) password file that is accessible only by users with root privileges
D) deleted password file that is still stored in memory