Deck 15: User Authentication Protocols

Question 1

The security of the Kerberos server should not automatically be assumed but must be guarded carefully by taking precautions such as placing the server in a locked room.

Answer 1

True

Question 2

________ is a procedure that allows communicating parties to verify that the contents of a received message have not been altered and that the source is authentic.

A)Identification
B)Message authentication
C)Verification
D)User authentication

Answer 2

B

Question 3

Any timestamp based procedure must allow for a window of time sufficiently large enough to accommodate network delays yet sufficiently small to minimize the opportunity for attack.

Answer 3

True

Question 4

User authentication is the means by which a user provides a claimed identity to the system.

Question 5

A common item of authentication information associated with a user is a ___________ .

A)nonce
B)timestamp
C)ticket
D)password

Question 6

There are a variety of problems including dealing with false positives and false negatives,user acceptance,cost,and convenience with respect to biometric authenticators.

Question 7

The __________ approach is unsuitable for a connectionless type of application because it requires the overhead of a handshake before any connectionless transmission,effectively negating the chief characteristic of a connectionless transaction.

A)timestamp
B)backward reply
C)challenge-response
D)replay

Question 8

The operating system cannot enforce access-control policies based on user identity.

Question 9

__________ is an authentication service designed for use in a distributed environment.

A)Kerberos
B)PCBC
C)Toklas
D)X.509

Question 10

An e-mail message should be encrypted such that the mail handling system is not in possession of the decryption key.

Question 11

Kerberos provides a trusted third party authentication service that enables clients and servers to establish authenticated communication.

Question 12

Identity federation is in essence an extension of identity management to multiple security domains.

Question 13

For network based user authentication the most important methods involve cryptographic keys and something the individual possesses,such as a smart card.

Question 14

Because there are no potential delays in the e-mail process timestamps are extremely useful.

Question 15

Examples of dynamic biometrics include recognition by fingerprint, retina,and face.

Question 16

The overall scheme of Kerberos is that of a trusted third party authentication service that uses a protocol based on a proposal by __________ .

A)Needham and Schroeder
B)Kehn
C)Denning
D)Gong

Question 17

It is the ticket that proves the client's identity.

Question 18

Once the server verifies that the user ID in the ticket is the same as the unecrypted user ID in the message it considers the user authenticated and grants the requested service.

Question 19

Identity providers may also assign attributes to users,such as roles,access permissions,and employee information.

Question 20

User authentication is the basis for most types of access control and for user accountability.

Question 21

____________ is a centralized,automated approach to provide enterprise wide access to resources by employees and other authorized individuals.

Question 22

There are four general means of authenticating a user's identity.They are: something the individual knows,something the individual possesses,something the individual is,and something the individual __________ .

Question 23

The principal underlying standard for federated identity is the __________ which defines the exchange of security information between online business partners.

A)OSAIS
B)SAML
C)RBAC
D)SFIL

Question 24

A Kerberos __________ is a set of managed nodes that share the same Kerberos database.

A)realm
B)TGS
C)network
D)principal

Question 25

__________ in Greek mythology is a three headed dog with a serpent's tail that guards the entrance of Hades.

Question 26

The first published report on Kerberos listed the following requirements: secure,reliable,scalable and __________ .

Question 27

__________ is an extension of identity management to multiple security domains such as autonomous internal business units,external business partners and other third party applications and services with the goal of sharing digital identities so that a user can be authenticated a single time and then access applications and resources across multiple domains.

A)Identity federation
B)Kerberos
C)Attribute service
D)Data security management

Question 28

Presenting an identifier to the security system is the __________ step.

A)authentication
B)verification
C)identification
D)clarification

Question 29

Examples of something the individual possesses would include cryptographic keys,electronic keycards,smart cards,and physical keys.This type of authenticator is referred to as a __________ .

Question 30

The __________ is unsuitable for a connectionless type of application because it requires the overhead of a handshake before any connectionless transmission effectively negating the chief characteristic of a connectionless transaction.

A)timestamp approach
B)challenge-response approach
C)simple replay approach
D)one-way authentication approach

Question 31

An authentication process consists of two steps: identification step and __________ step.

Question 32

_________ protocols enable communicating parties to satisfy themselves mutually about each other's identity and to exchange session keys.

Question 33

A __________ attack is where an opponent intercepts a message from the sender and replays it later when the timestamp in the message becomes current at the recipient's site.

Question 34

Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the ___________ step.

A)identification
B)verification
C)clarification
D)authentication

Question 35

Kerberos relies exclusively on __________ .

A)symmetric encryption
B)asymmetric encryption
C)private key encryption
D)public key encryption

Question 36

The _________ is responsible for generating keys to be used for a short time over a connection between two parties and for distributing those keys using the master keys to protect the distribution.

Question 37

A centralized,automated approach to provide enterprise-wide access to resources by employees and other authorized individuals with a focus of defining an identity for each user,associating attributes with the identity,and enforcing a means by which a user can verify identity is __________ .

A)enterprise management
B)identity management
C)federated identity management
D)realm management

Question 38

In an unprotected network environment any client can apply to any server for service.The obvious security risk of this is __________ .

A)certification
B)authentication
C)impersonation
D)authorization

Question 39

To convince the server that a user is authentic,the authentication server creates a _________ that contains the user's ID and network address and the server's ID and sends it back to the client so they can continue the request for service.

Question 40

A service to solve the problem of minimizing the number of times that a user has to enter a password and the risk of an eavesdropper capturing the password and using it is known as the __________ .

A)authentication server
B)ticket granting server
C)Kerberos mutual authentication
D)PCBC mode

Question 41

Intended to provide an integrity check as part of the encryption operation,encryption in Kerberos Version 4 makes use of a nonstandard mode of DES known as ____________.It has been demonstrated that this mode is vulnerable to an attack involving the interchange of ciphertext blocks.

Question 42

__________ is an authentication service developed as part of Project Athena at MIT.

Question 43

A concept dealing with the use of a common identity management scheme across multiple enterprises and numerous applications and refers to the agreements,standards,and technologies that enable the portability of identities,identity attributes,and entitlements across multiple enterprises and numerous applications and supporting many thousands,even millions,of users is _________ .

Question 44

The ticket granting ticket is encrypted with a secret key known only to the AS and the __________ .

Question 45

A solution,which eliminates the burden of each server having to confirm the identities of clients who request service,is to use an __________ that knows the passwords of all users and stores these in a centralized database and shares a unique secret key with each server.