¡GoConqr estrena diseño! Cuéntanos qué te parece.

Regístrate gratis

Test

10b Authentification

Yawen Hou 16 preguntas

Hacer el test

Este test tiene tipos de pregunta que se abren en el reproductor de siempre.

Preguntas del test (16)

  1. 1Access only make sense when we can [blank_start]authenticate[blank_end] subjects.
    3 common factors of authentification:
    > something you [blank_start]know[blank_end]: password, pin codes
    > something you [blank_start]own[blank_end]: paper card, smartphone
    > something you are: [blank_start]biometrics[blank_end]
    1. Abiometrics
    2. Bown
    3. Cknow
    4. Dauthenticate
  2. 2C[blank_start]redential[blank_end] [blank_start]stuffing[blank_end]:

    > List of usernames and pwd are published / sold on internet.
    > Hackers try the same credentials on different sites.
    1. Astuffing
    2. Bredential
  3. 3What can you do to store securely your passwords?
    > use [blank_start]password manager[blank_end]
    > need only to remember the [blank_start]master[blank_end] [blank_start]password[blank_end] to decrypt the credentials
    > you can choose a offline (local-file) [blank_start]password manager[blank_end], or an online (cloud) [blank_start]password manager[blank_end], but you need to trust them not to steal your password. The best is to use an [blank_start]open[blank_end] [blank_start]source[blank_end] server that you can host where you want.
    1. Apassword manager
    2. Bpassword manager
    3. Cpassword manager
    4. Dopen
    5. Esource
    6. Fmaster
    7. Gpassword
  4. 4The "something you own" is called a [blank_start]token[blank_end].
    > ex. Bingo cards
    -- prove that user owns the card, but can be easily photocopied
    > [blank_start]One[blank_end]-[blank_start]time[blank_end] [blank_start]password[blank_end] (OTP) [blank_start]token[blank_end]s
    -- OATH standard
    -- password change with time / click    Imagen de la pregunta 4
    1. AOne
    2. Btime
    3. Cpassword
    4. Dtoken
    5. Etoken
  5. 5The "something you own" is called a token.
    > [blank_start]TAN[blank_end] [blank_start]generators[blank_end]
    -- a calculator that generates an [blank_start]number[blank_end] based on [blank_start]input[blank_end] of the user
    -- can be used to [blank_start]sign[blank_end] a [blank_start]transaction[blank_end]
    -- proves the user owns the generator
    -- based on a smart card (bank card)

    > [blank_start]Smartphones[blank_end]
    -- [blank_start]OTP[blank_end] is sent by Sms or generated by App
    -- prove that user owns the phone / sim-card
    1. AOTP
    2. Bsign
    3. Ctransaction
    4. DTAN
    5. Egenerators
    6. FSmartphones
    7. Gnumber
    8. Hinput
  6. 6The "something you own" is called a [blank_start]token[blank_end].
    > a [blank_start]private[blank_end] [blank_start]key[blank_end] in a hardware token
    -- token [blank_start]signs[blank_end] a [blank_start]challenge[blank_end]
    -- proof that user owns [blank_start]token[blank_end]
    -- universal [blank_start]2nd[blank_end] [blank_start]factor[blank_end] standard
    1. A2nd
    2. Bfactor
    3. Ctoken
    4. Dsigns
    5. Echallenge
    6. Fprivate
    7. Gkey
    8. Htoken
  7. 7[blank_start]OATH[blank_end] is a standard for the generation of [blank_start]One[blank_end]-[blank_start]time[blank_end] password tokens.
    [blank_start]Counter[blank_end] based:
    hotp(seed, c) = truncate( hmac-sha1(seed, c))

    [blank_start]Time[blank_end] based:
    totp([blank_start]seed[blank_end], t) = hotp(k, t - t0 / x)
    1. AOATH
    2. BCounter
    3. CTime
    4. Dseed
    5. EOne
    6. Ftime
  8. 8Universal 2nd Factor is a standard usage of private keys.

    Each app generate a [blank_start]key[blank_end] [blank_start]pair[blank_end] and give the server the [blank_start]public[blank_end] key.
    On login, server sends a random [blank_start]challenge[blank_end] to client
    Client signs the [blank_start]challenge[blank_end] + name of the [blank_start]domain[blank_end] of the server + signature [blank_start]counter[blank_end]
    client sends the data and signature to server
    server verifies the [blank_start]signature[blank_end]
    1. Asignature
    2. Bchallenge
    3. Cdomain
    4. Dcounter
    5. Echallenge
    6. Fkey
    7. Gpair
    8. Hpublic
  9. 9Why do 2nd factor need the application to sign the domain + counter of the server as well?

    Domain: To prevent from [blank_start]phishing[blank_end] [blank_start]attacks[blank_end].
    Counter: To prevent [blank_start]cloning[blank_end] of the [blank_start]private[blank_end] [blank_start]key[blank_end]. (Detect not steady increment, aka the hacker increments one time more / less the counter).
    1. Aphishing
    2. Battacks
    3. Ccloning
    4. Dprivate
    5. Ekey
  10. 10[blank_start]FIDO2[blank_end] standardises the use of [blank_start]U2F[blank_end] within the browser with Javascript, called WebAuthn.

    [blank_start]FIDO2[blank_end] also make uses of [blank_start]Client[blank_end] to [blank_start]Authenticator[blank_end] Protocol to access to the signature.

    CTAP: describes how an [blank_start]app[blank_end] can ask an [blank_start]authenticator[blank_end] to generate a [blank_start]signature[blank_end].
    Authenticator: usb token/ smartphone

    The assertions asserts whether the user was:
    - [blank_start]present[blank_end] (clicked the button)
    - [blank_start]verified[blank_end] (had the right pin / fingerprint)
    1. AFIDO2
    2. BU2F
    3. CFIDO2
    4. DClient
    5. EAuthenticator
    6. Fapp
    7. Gauthenticator
    8. Hsignature
    9. Ipresent
    10. Jverified

Información

Descripción
- (10 Access control, Authentication & protocols) Information security Test sobre 10b Authentification, creado por Yawen Hou el 04/06/2019.
Idioma
English
Visitas
0
Valoración
Aún sin valoraciones
Valora este test
Valora este test

Escríbenos

¿Sobre qué es tu mensaje?

¿Qué te parece el nuevo diseño?

¿Te gusta?