Deck 3: User Authentication

Question 1

T F 4. Many users choose a password that is too short or too easy to guess.

Answer 1

True

Question 2

Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the ___________.

A) identification step
B) verification step
C) authentication step
D) corroboration step

Answer 2

B

Question 3

User authentication is the fundamental building block and the primaryline of defense.

Answer 3

True

Question 4

In a biometric scheme some physical characteristic of the individual ismapped into a digital representation.

Question 5

User authentication is a procedure that allows communicating parties toverify that the contents of a received message have not been altered and that the source is authentic.

Question 6

Memory cards store and process data.

Question 7

An individual's signature is not unique enough to use in biometricapplications.

Question 8

__________ defines user authentication as "the process of verifying an identity claimed by or for a system entity".

A) RFC 4949
B) RFC 2298
C) RFC 2493
D) RFC 2328

Question 9

A good technique for choosing a password is to use the first letter ofeach word of a phrase.

Question 10

Recognition by fingerprint, retina, and face are examples of __________.

A) face recognition
B) dynamic biometrics
C) static biometrics
D) token authentication

Question 11

The __________ strategy is when users are told the importance of using hard to guess passwords and provided with guidelines for selecting strong passwords.

A) reactive password checking
B) proactive password checking
C) computer-generated password
D) user education

Question 12

A __________ is a password guessing program.

A) password hash
B) password cracker
C) password biometric
D) password salt

Question 13

Depending on the details of the overall authenticationsystem, the registration authority issues some sort of electronic credential to the subscriber.

Question 14

User authentication is the basis for most types of access control and foruser accountability.

Question 15

Keylogging is a form of host attack.

Question 16

Identification is the means of establishing the validity of a claimedidentity provided by a user.

Question 17

Enrollment creates an association between a user and the user'sbiometric characteristics.

Question 18

A smart card contains an entire microprocessor.

Question 19

Identifiers should be assigned carefully because authenticatedidentities are the basis for other security services.

Question 20

Depending on the application, user authentication on a biometricsystem involves either verification or identification.

Question 21

The most common means of human-to-human identification are __________.

A) facial characteristics
B) signatures
C) retinal patterns
D) fingerprints

Question 22

Voice pattern, handwriting characteristics, and typing rhythm are examples of __________ biometrics.

Question 23

An institution that issues debit cards to cardholders and is responsible for the cardholder's account and authorizing transactions is the _________.

A) cardholder
B) auditor
C) issuer
D) processor

Question 24

Authentication protocols used with smart tokens can be classified into three categories: static, dynamic password generator, and ___________.

Question 25

A __________ is directed at the user file at the host where passwords, token passcodes, or biometric templates are stored.

A) eavesdropping attack
B) denial-of-service attack
C) client attack
D) host attack

Question 26

A __________ authentication system attempts to authenticate an individual based on his or her unique physical characteristics.

Question 27

With the __________ policy a user is allowed to select their own password, but the system checks to see if the password is allowable.

Question 28

A __________ attack involves an adversary repeating a previously captured user response.

A) client
B) replay
C) Trojan horse
D) eavesdropping

Question 29

To counter threats to remote user authentication, systems generally rely on some form of ___________ protocol.

A) eavesdropping
B) Trojan horse
C) challenge-response
D) denial-of-service

Question 30

A __________ is when an adversary attempts to achieve user authentication without access to the remote host or to the intervening communications path.

A) client attack
B) eavesdropping attack
C) host attack
D) Trojan horse attack

Question 31

Objects that a user possesses for the purpose of user authentication are called ______

Question 32

__________ allows an issuer to access regional and national networks that connect point of sale devices and bank teller machines worldwide.

A) EFT
B) POS
C) BTM
D) ATF

Question 33

An authentication process consists of the _________ step and the verification step.

Question 34

Each individual who is to be included in the database of authorized users must first be __________ in the system.

A) verified
B) authenticated
C) identified
D) enrolled

Question 35

A __________ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.

A) user education
B) proactive password checking
C) reactive password checking
D) computer-generated password

Question 36

A __________ is a separate file from the user IDs where hashed passwords are kept.

Question 37

__________ systems identify features of the hand, including shape, and lengths and widths of fingers.

A) Signature
B) Hand geometry
C) Fingerprint
D) Palm print

Question 38

The __________ is the pattern formed by veins beneath the retinal surface.

Question 39

A host generated random number is often called a __________.

Question 40

The technique for developing an effective and efficient proactive password checker based on rejecting words on a list is based on the use of a __________ filter.

Question 41

The __________ step is presenting or generating authentication information that corroborates the binding between the entity and the identifier.

Question 42

A __________ is an individual to whom a debit card is issued.

Question 43

In a __________ attack, an application or physical device masquerades as an authentic application or device for the purpose of capturing a user password, passcode, or biometric.

Question 44

A __________ attack attempts to disable a user authentication service by flooding the service with numerous authentication attempts.

Question 45

__________, in the context of passwords, refers to an adversary's attempt to learn the password by observing the user, finding a written copy of the password, or some similar attack that involves the physical proximity of user and adversary.