Deck 12: Authentication and Account Management

Question 1

What type of attack involves an attacker stealing a file containing password digests and comparing the digests with digests created by the attacker?

A)offline cracking
B)online cracking
C)hash replay
D)token replay

Answer 1

A

Question 2

What is the center of the weakness of passwords?

A)human memory
B)encryption technology
C)handshake technology
D)human reliability

Answer 2

A

Question 3

​Which hashing algorithm below is used with NTLMv2's Hashed Message Authentication Code?

A)​SHA-1
B)​SHA-256
C)​MD4
D)​MD5

Answer 3

D

Question 4

Geolocation is the identification of the location of a person or object using technology, and can be used as part of an authentication method.​

Question 5

Using a rainbow table to crack a password requires three steps: Creation of the table, comparing the table to known hash values, and decrypting the password.

Question 6

​What type of one-time password (OTP) changes after a set time period?

A)​HMAC-Based one-time password (HOTP)
B)​Period-based one-time password (POTP)
C)​Time-based one-time password (TOTP)
D)​Interval-based one-time password (IOTP)

Question 7

Which type of biometrics is based on the perception, thought process, and understanding of the user?

A)Standard biometrics
B)Reactive biometrics
C)Cognitive biometrics
D)Affective biometrics

Question 8

What type of attack involves using every possible combination of letters, numbers, and characters to create candidate digests that are then matched against those in a stolen digest file?

A)Space division
B)Brute force
C)Known ciphertext
D)Known plaintext

Question 9

Token credentials can be revoked at any time by the user without affecting other token credentials issued to other sites.

Question 10

The use of a single authentication credential that is shared across multiple networks is called:

A)Access management
B)Authorization management
C)Identity management
D)Risk management

Question 11

The use of what item below involves the creation of a large pregenerated data set of candidate digests?

A)Rainbow tables
B)Randomized character list
C)Word list
D)Cascade tables

Question 12

OpenID is an example of a web-based federated identity management (FIM) system.​

Question 13

What can be used to increase the strength of hashed passwords?​

A)​Salt
B)​Key stretching
C)​Double hashing
D)Crypting

Question 14

​Select below the decentralized open-source FIM that does not require specific software to be installed on the desktop:

A)​OAuth
B)​OpenID
C)​Windows Live ID
D)​OpenPass

Question 15

Passwords that are transmitted can be captured by what type of software?

A)application analyzer
B)system analyzer
C)function analyzer
D)protocol analyzer

Question 16

​What federated identity management (FIM) relies on token credentials?

A)​OAuth
B)​OpenID
C)​Windows Live
D)​OpenPass

Question 17

Passwords provide strong protection.

Question 18

A secret combination of letters, numbers, and/or characters that only the user should have knowledge of, is known as a:

A)token
B)password
C)biometric detail
D)challenge

Question 19

The use of one authentication credential to access multiple accounts or applications is referred to as?

A)Individual Sign On
B)Single Sign On
C)Unilateral Sign On
D)Federated Sign On

Question 20

​A list of the available nonkeyboard characters can be seen in Windows by opening what utility?

A)​charmap.exe
B)​charlist.exe
C)​chardump.exe
D)​listchar.exe

Question 21

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
A password hashing algorithm that requires significantly more time than standard hashing algorithms to create the digest.​

Question 22

​A U.S. Department of Defense (DoD) smart card that is used for identification of active-duty and reserve military personnel along with civilian employees and special contractors is called:

A)​Common Access Card (CAC)
B)​Identity Validation Card (IVC)
C)​Credential Validation Card (CVC)
D)​Personal Credential Card (PCC)

Question 23

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
​Five elements that can prove the genuineness of a user: what you know, what you have, what you are, what you do, and where you are.

Question 24

In most systems, a user logging in would be asked to ____________________ herself.
​

Question 25

____________________ is a decentralized open source FIM that does not require specific software to be installed on the desktop.

Question 26

A token ____________________ is a unique random string of characters that is encrypted to protect the token from being used by unauthorized parties.

Question 27

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
​A password attack that slightly alters dictionary words by adding numbers to the end of the password, spelling words backward, slightly misspelling words, or including special characters.

Question 28

The most common type of authentication today is a(n) ____________________.

Question 29

What technology allows users to share resources stored on one site with a second site without forwarding their authentication credentials to the other site?

A)OpenAuth
B)OAuth
C)SAML
D)Kerberos

Question 30

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
​A small device that can be affixed to a keychain with a window display that shows a code to be used for authentication.

Question 31

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
A popular key stretching password hash algorithm​

Question 32

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
​A random string that is used in hash algorithms.

Question 33

A(n) ____________________ attack begins with the attacker creating encrypted versions of common dictionary words, and then comparing them against those in a stolen password file.

Question 34

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
A password attack that creates encrypted versions of common dictionary words and compares them against those in a stolen password file.​

Question 35

What variation of a dictionary attack involves a dictionary attack combined with a brute force attack, and will slightly alter dictionary words by adding numbers to the end of the password, spelling words backward, slightly misspelling words, or including special characters?

A)brute force
B)hash replay
C)network replay
D)hybrid

Question 36

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
A password attack in which every possible combination of letters, numbers, and characters is used to create encrypted passwords that are matched against those in a stolen password file.​

Question 37

What kind of biometrics utilizes a person's unique physical characteristics for authentication, such as fingerprints or unique characteristics of a person's face?

A)Cognitive biometrics
B)Reactive biometrics
C)Standard biometrics
D)Affective biometrics

Question 38

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
Using one authentication credential to access multiple accounts or applications.​

Question 39

Matching
a. Authentication factors
b. Bcrypt
c. Brute force attack
d. Dictionary attack
e. Hybrid attack
f. Key stretching
g. NTLM (New Technology LAN Manager) hash
h. Salt
i. Single sign-on
j. Token
​A hash used by modern Microsoft Windows operating systems for creating password digests.

Question 40

Which term below describes the time it takes for a key to be pressed and then released?

A)Dwell time
B)Lead time
C)Sync time
D)Show time

Question 41

What are the three broad categories on which authentication can be based?

Question 42

Discuss the types of shortcuts that users take to help them recall their passwords.

Question 43

What is the difference between multifactor authentication and single-factor authentication?​

Question 44

What are the three advantages of a rainbow table over other password attacks?

Question 45

List and describe two of the common password setting objects.

Question 46

Describe how rainbow tables work.

Question 47

Why do passwords place a heavy load on human memory?

Question 48

Explain how an attacker can use a resetting attack.

Question 49

Discuss the weaknesses of OpenID.

Question 50

Explain why the LAN Manager (LM) hash is vulnerable.