Test
InfoSec
Este test tiene tipos de pregunta que se abren en el reproductor de siempre.
Preguntas del test (62)
1Cryptography: the process of making and using codes to secure information. Beyond confidentiality concerns, integrity checking, sender/receiver identity authentication, digital signatures involved.
- AVerdadero
- BFalso
2Cryptanalysis: the process of obtaining the plaintext message (decrypt) from a ciphertext (encrypted) message without knowing the keys used to perform the encryption.
- AVerdadero
- BFalso
3cipher - algorithm for transforming plaintext into ciphertext, and vice versa
key - info used in cipher known only to sender and/or receiver- AVerdadero
- BFalso
4Typical Threats Cryptography can help with are:
- AFabrication (Authenticity Attack) – unauthorized assumption of other's identity
- BInterference (Integrity Attack) - inserting bogus message, corrupting messages
- CEavesdropping (Attack on Confidentiality) – unauthorized access to information
- DRepudiation(Attack on Integrity of information) - unauthorized insertion of corrupted data.
5Symmetric cipher:
- AA single key is used for both encryption and decryption
- BBlock cipher: encrypts a block of plaintext at a time (typically 128 bits)
- CStream cipher: encrypts data one bit or one byte at a time
- DDifferent keys are used for encryption and decryption simultaneously.
- ESender and recipient share a common key and must agree on a key before they communicate securely
- FSecurity lies with the key
6Asymmetric Cipher
Different keys are used for encryption and decryption- AVerdadero
- BFalso
7Main Requirements of ciphers
- AConfusion – interceptor cannot predict what will happen to the ciphertext by changing one character in the plaintext. E.g. Substitution cipher: replacing each element of the plaintext with another element.
- BDiffusion – information from single plaintext is distributed over the entire ciphertext. Transposition (or permutation) cipher: rearranging the order of the elements of the plaintext.
- CTransfusion interceptor cannot predict what will happen to the ciphertext by changing one character in the plaintext.
8Earliest known confusion cipher. 3 letter alphabet shift. Caesar cipher. Letters can also be mapped to numbers. a = 0 z = 25. Vulnerable to brute force attacks.
- AVerdadero
- BFalso
9Choose all cipher techniques:
- AMonoalphabetic Substitution cipher: Shuffle the letters and map each plaintext letter to a different random ciphertext letter.
- BPolyalphabetic cipher
- CVigenère cipher: Matrix of 26x26 alphabet letters shifted.
- DBook based cipher: Sherlock Holmes style (page, number, key)
- EAnalytic cipher: analyze components of book and mono alphabetic symbols
- FRow Transposition ciphers: plain text written row by row. Columns are on cipher.
10Cryptanalysis is the study of ciphers, ciphertext, or cryptosystems with a view to finding weaknesses in them that will permit retrieval of the plaintext from the ciphertext, without necessarily knowing the key or the algorithm. Two types: brute force, cryptanalytic attack.
- AVerdadero
- BFalso
11Which of the following are true about Brute force attacks?
- AEvery key to decipher the ciphertext
- BTime needed proportional to size of key space.
- CIf 32 keys, there are 2^32 combinations
- DIf 12 keys, there are 32^2 combinations.
12Which of the following are the most common and least common letters in English?
- AE is most common followed by B, C, R, W. Least common is Z, Y, K.
- BE most common followed by T, R, N, I, A, O, S. Least common Z, J, K, Q, X.
- CAll letters have equal frequency of occurrence.
13Which of the following is NOT true about Hashing function is a "chewing" or "digest" function?
- Aaccepts a variable-length message and is a one-way process
- BKind of like compression. Hash value (message digest) is like fingerprint of original document.
- CVariable Input Size
- DFixed Output Size
- EEfficiency: easy to compute
- FPseudorandomness
- GPurely random
14With regards to hash functions which of the following is true regarding collision resistance?
- AStrong: Difficult to find any M1 != M2 such that hash(M1) == hash(M2)
- BWeak: Given M1, difficult to find M2 such that hash(M1) == hash(M2)
- CStrong collision is birthday paradox: 2160/2 = 280 operations
- DStrong Collision resistance: data hash in a database
- EWeak Collision resistance: password in a database
- FWeak: Given M1, difficult to find M2 such that hash(M1) != hash(M2)
15Hash functions always have some probability of collisions! It's directly related to Birthday Attack.
- AVerdadero
- BFalso
16Steganography: study of techniques to send sensitive info and hide the fact that sensitive info is being sent. E.g invisible ink, acronym, letter, image (least significant bit changed)
- AVerdadero
- BFalso
17Symmetric key: secret key a encrypts and decrypts message.
- AVerdadero
- BFalso
18Stream algorithms
• Operate on the plaintext one bit at a time
• Each bit uses a separate key
• CPU intensive
Block algorithms
• Encrypt and decrypt data in groups of bits,
typically 64 bits in size
• Less overhead- AVerdadero
- BFalso
19DES Decryption: same algorithm and key as encryption, but subkeys are applied in opposite order. 56 bit easy to hack.
2DES: Simplest form of multiple encryption 2 encryption stages and 2 keys.
3DES: 3 encryption stages and 1,2 or 3 keys. Currently not broken.- AVerdadero
- BFalso
20Know the stages of 3 DES according to prof. Answer is "this"

- Athis
21What are the advantages and disadvantages of stream and block ciphers?
- AAdvantages of stream cipher
• Speed of transformation
• Low error propagation
Faster than Block
Disadvantages:
Low diffusion
• Susceptibility to malicious insertions and modifications - BBlock Cipher Advantages:
• High diffusion
• Immunity to insertion of symbols
Disadvantages:
Slowness of encryption
• Error propagation - CStreamCipher Advantages:
• High diffusion
• Immunity to insertion of symbols
Disadvantages:
Slowness of encryption
• Error propagation
- AAdvantages of stream cipher
22Which of the following is true about Assymetric ciphers?
- ADeveloped to solve the problem of Key distribution and Digital signatures (confirm
- BPublic-key: Known by anybody, and can be used to encrypt messages and verify signatures
- CPrivate-key: Known only to recipient, used to decrypt messages and sign (create) signatures
- DPublic key used to substitute decryption function data.
23Confidentiality
Alice wants to send a confidential message to Bob.
• Alice encrypts message with Bob’s public key • Bob’s public key cannot "decrypt" encrypted message
• Alice sends encrypted message to Bob
• Bob decrypts message with Bob's private key- AVerdadero
- BFalso
24Authentication, or digital signature
Alice wants to send a message to Bob in a way that
Bob can be assured that Alice (and no one else) sent it
• Alice encrypts (signs) message with Alice's private key
• Alice sends encrypted/signed message to Bob
• Bob decrypts message with Alice’s public key
• Bob then knows that:
• only Alice could have sent it
• data integrity assured, once encrypted- AVerdadero
- BFalso
25RSA example:
• Select prime numbers p = 7, q = 17
• Calculate the modulus n = p x q = 119
• Calculate N = ø(n) = (p-1) x (q-1) = 6 x 16 = 96
• Select public constant e = 5 such that
• e is relative prime to N=96 and 1 < 5 < 96
• Determine private constant d = 77 such that
• 5 * 77 = 385 = 4 * 96 + 1 = 1 mod 96 and 77 < 96
• Public key: kPUB = {5, 119}
• Private key: kPRIV = {77, 119}- AVerdadero
- BFalso
26Three types of RSA attack:
- ABrute force
- BMathematical attack – factor n into its two primes p, q
• Or find the private exponential d (recall kPRIV={d,n}) when n is known. - CTiming attack
– use measurement of the decryption time to guess values
• Usually works well if private key is kept on a smart card - DTuring attack
27Need to choose suitably large numbers p and q
• Numbers p and q should NOT be too close
• The decryption (private) exponent d should be large
RSA Parameters
• The encryption (public) exponent e should not be too large
• typically e may be the same for all users
• originally values 3 and 5 were suggested
• regarded as too small currently- AVerdadero
- BFalso
28Secure email messages require?
- Aconfidentiality: protection from disclosure
- Bauthentication: of sender of message
- Cmessage integrity: protection from modification
- Dnon-repudiation of origin: protection from denial by sender
- Esmart exchange: exchange between users and consumer
29Pretty Good Privacy (PGP) is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. A confidentiality and authentication service for email/file storage apps.
- AVerdadero
- BFalso
30Assymetric vs Symmetric communication comparison
- AAssymetric: Key exchange over public channel, Scalable for multi-party communication, Long keys (1024+ bits), Slow Implementation (RSA software can encrypt 7.4~21.6 Kb/sec, Fastest RSA hardware can encrypt 1 Mb/sec)
- BSymnetric: Key exchange over public channel, Scalable for multi-party communication, Long keys (1024+ bits), Slow Implementation (RSA software can encrypt 7.4~21.6 Kb/sec, Fastest RSA hardware can encrypt 1 Mb/sec)
- CSymmetric: Key exchange must be done over secure channel, Non-scalable for multi-party communication, Relatively short keys (128+ bits), • AES software ~ 100 times faster than RSA
• AES hardware ~ 1,000 to 10,000 times faster - DAsymmetric: Key exchange must be done over secure channel, Non-scalable for multi-party communication, Relatively short keys (128+ bits), • AES software ~ 100 times faster than RSA
• AES hardware ~ 1,000 to 10,000 times faster
31RSA involves factorization, exponentiation. Encrypt with public key, decrypt with private.
- AVerdadero
- BFalso
32Prime number: a natural number greater than 1 that cannot be formed by multiplying two smaller natural numbers.
Examples: 2, 3, 5, 7, 11, 13, 17, 19
Non prime: 4=(2x2), 6 (2x3)- AVerdadero
- BFalso
33RSA algorithm example:
• Select prime numbers p = 7, q = 17
• Calculate the modulus n = p x q = 119
• Calculate N = ø(n) = (p-1) x (q-1) = 6 x 16 = 96
• Select public constant e = 5 such that
• e is relative prime to N=96 and 1 < 5 < 96
• Determine private constant d = 77 such that
• 5 * 77 = 385 = 4 * 96 + 1 = 1 mod 96 and 77 < 96
• Public key: kPUB = {5, 119}
• Private key: kPRIV = {77, 119}- AVerdadero
- BFalso
34The security of RSA is dependent on the assumption that it’s difficult to compute N = ø(n)
- AVerdadero
- BFalso
353 types of RSA attacks:
- ABrute Force
- BMathematical attack – factor n into its two primes p, q
• Or find the private exponential d (recall kPRIV={d,n}) when n is known. - CTiming attack – use measurement of the decryption time to guess values
• Usually works well if private key is kept on a smart card - DCompound number attack.
36Name top 3 types of attacks or misuse of technology?
- AMalware infection (1)
- BBeing fraudulently represented as sender of phishing message (2)
- CLaptop/ mobile hardware theft/loss (3)
- DBots/zombies in organization (3)
37The Inability/unwillingness to follow established policy is the most severe threat to information protection from internal sources
- AVerdadero
- BFalso
38Unauthorized information collection/data sniffing is the most severe threat to information protection from external source
- AVerdadero
- BFalso
39Access control is a system which enables an authority to control access to areas and resources in a given physical facility or computer-based information system. SUBJECT: entity that performs an action system. OBJECT: resources
- AVerdadero
- BFalso
40Name 3 Access Control Types:
- AAdministrative
- BTechnical / Logical
- CPhysical
- DDetective
41Which is not an Access control STRATEGY?
- APreventive
- BDetective
- CCompensating
- DRecovery
- EDeterrent
- FDirective
- GCorrective
- HAssociative
- IAdministrative
42Which is not an access control threat?
- ADenial of service
- BShoulderSurfing/Swiping
- CSniffers
- DSpoofing/Masquerading
- EKeystroke Loggers
- FRainbow tables
- GBrute Force
- HDumpster Diving
- IEmnations
- JRainbow Emnations
43Name the four fundamental functions of access control systems:
- AIdentification: I am a user of the system.
- BAuthentication: I can prove I’m a user of the system.
- CAuthorization: Here’s what I can do with the system.
- DAccountability: You can track and monitor my use of the system.
system logs and database journals, and the auditing of these records. - ETransparency: you know what I use in the system
44A covert channel is a type of attack that creates a capability to transfer information between processes that are not supposed to be allowed to communicate by the computer security policy.
• Storage channels (embedding of data in TCP header) - stenography
• Timing channels (transfer information using time delays).- AVerdadero
- BFalso
45Bell-LaPadula confidentiality model
– State machine reference model
– Uses “no read up, no write down” principle
Simple security (read property): low can't read high, high can read low
Write property: high can't send messages too low level object. Low can send message to create high lev object.- AVerdadero
- BFalso
46• Biba integrity model
– Designed to prevent corruption of higher integrity entities – Based on “no write up, no read down” principle
Priests cannot read prayers written by Monks. Monks are prohibited from writing in a priest's sermon books.- AVerdadero
- BFalso
47Firewall: In information security, a combination of hardware and software that filters or prevents specific information from moving between the outside (untrusted) network and the inside (trusted) network.
- AVerdadero
- BFalso
48Firewall types:
- APacket-Filtering Firewalls (IP source/ destination, header information of packets)
3 types: static, dynamic, state packet inspection (track network connection with table).
Allows HTTP, FTP, TCP, protocol - BApplication layer proxy
- CMAC (MediaAccessControl) layer firewalls, sublayer of network’s data link layer, host computer identity,
- DHybrids
- APacket-Filtering Firewalls (IP source/ destination, header information of packets)
49 Screened subnet architecture (with DMZ)
– Is the dominant architecture used today- AVerdadero
- BFalso
50Best practices for firewalls
• All traffic from the trusted network is allowed out.
• Firewall device is never directly accessed from public
network.
• Simple Mail Transport Protocol (SMTP) data are allowed to pass through firewall.
• Internet Control Message Protocol (ICMP) data are denied.
• Telnet access to internal servers should be blocked.
• When Web services are offered outside the firewall, HTTP traffic should be blocked from reaching internal networks.
• All data that are not verifiably authentic should be denied.- AVerdadero
- BFalso
51Know this

- Athis
- Bnot this
52Content filters are: software program hardware/software appliance that allows administrators to restrict content that comes into or leaves a network. Choose all that apply
- Aset of scripts or programs restricting user access to certain networking protocols/Internet locations
- BPrimary purpose to restrict internal access to external material
- CMost common content filters restrict users from accessing non-business Web sites or deny incoming spam
- DPrimary purpose to restrict external access to internal material
53Select what is true regarding remote access:
- AUnsecured, dial-up connection points represent a substantial exposure to attack.
- BRADIUS, Diameter, and TACACS are Systems that authenticate user credentials for those
trying to access an organization’s network via dial-up - CSecured, dial-up connection points represent a substantial exposure to attack.
54Select all that apply regarding RADIUS configuration
- ARemote worker dials NAS and submits username and password
- BNAS passes username and password to RADIUS server
- CRADIUS server approves or rejects request and provides access authorization
- DNAS provides access to authorized remote worker
55Keberos login
User logs into client machine (c)
Client machine encrypts password to create client key (Kc)
Client machine sends clear request to Kerberos Authentication Server (AS)
Kerberos AS returns ticket consisting of:
– Client/TGS session key for future communications between client and TGS [Kc,TGS], encrypted with the client's key
– Ticket granting ticket (TGT). The TGT contains the client name, client address, ticket valid times, and the client/TGS session key, all encrypted in the TGS' private key- AVerdadero
- BFalso
56What is true about VPN?
- Aallows the user to turn Internet into a private network
- Bmust accomplish encapsulation, encryption of incoming and outgoing data. AND authentication of user and computer
- CAccess control is a process by which systems determine if and how to admit a user into a trusted area of the organization.
• All access control approaches rely on identification, authentication, authorization, and accountability.
57Access control is a process by which systems determine if and how to admit a user into a trusted area of the organization.
• All access control approaches rely on identification, authentication, authorization, and accountability.- AVerdadero
- BFalso
58The three common architectural implementations of firewalls are:
- Asingle bastion hosts
- Bscreened hosts
- Ccreened subnets.
- Ddouble bastion hosts
59What is the relationship between a TCP and UDP packet? Will any specific transaction usuallyinvolve both types of packets?
- AA TCP Packet sends information, and reports back to the sender on progress to assure that information has been sent and received. UDP on the other hand is designed more for speed after establishing a connection and is used to strive for the fastest data retrieval rate as possible, but for this type of packet, it’s less important that it reports back. I don’t believe there will be specific transactions that involve both types of packets. But TCP is better for assuring that data is being received completely, but UDP focuses on assuring data is retrieved as quickly as possible.
- BN/a
60How is an application layer proxy firewall different from a packet-filtering firewall?
A packet-filtering firewall only allows “a particular packet with a particular source, destination, and port address to enter”. An application layer firewall is sometimes called a proxy server because it “runs special software that acts as a proxy for a service request” It is more to deal with outgoing connections and making connections within the DMZ zone of an organization- AVerdadero
- BFalso
61How is static filtering different from dynamic filtering of packets? Which is common in network routers?
Static filtering works with rules that are already designated or “developed and installed with the firewall” and only a person can change it- AVerdadero
- BFalso
62What is stateful inspection? How is state information maintained during a network connection or transaction? Stateful inspection keeps track of each network connection between internal and external system using a state table. A state table track the context and state of each packet in the conversation by recording which station sent the packet and when it was dent
- AVerdadero
- BFalso
Información
- Descripción
- Test sobre InfoSec, creado por Upma Sharma el 31/10/2018.
- Autor
- Upma Sharma
- Idioma
- English
- Visitas
- 14
- Valoración
- Aún sin valoraciones Valora este test