Quiz
Security slides 3 & 4
This quiz has question types that open in the usual player.
Questions in this quiz (55)
1Cryptography: the process of making and using codes to secure information. Beyond confidentiality concerns, integrity checking, sender/receiver identity authentication, digital signatures involved.
- ATrue
- BFalse
2Cryptanalysis: the process of obtaining the plaintext message (decrypt) from a ciphertext (encrypted) message without knowing the keys used to perform the encryption.
- ATrue
- BFalse
3cipher - algorithm for transforming plaintext into ciphertext, and vice versa
key - info used in cipher known only to sender and/or receiver- ATrue
- BFalse
4Typical Threats Cryptography can help with are: (3)
- AFabrication (Authenticity Attack) – unauthorized assumption of other's identity
- BInterference (Integrity Attack) - inserting bogus message, corrupting messages
- CEavesdropping (Attack on Confidentiality) – unauthorized access to information
- DRepudiation(Attack on Integrity of information) - unauthorized insertion of corrupted data.
5Symmetric cipher: (4)
- AA single key is used for both encryption and decryption
- BBlock cipher: encrypts a block of plaintext at a time (typically 128 bits)
- CStream cipher: encrypts data one bit or one byte at a time
- DDifferent keys are used for encryption and decryption simultaneously.
- ESender and recipient share a common key and must agree on a key before they communicate securely
- FSecurity lies with the key
6Asymmetric Cipher
Different keys are used for encryption and decryption- ATrue
- BFalse
7Main Requirements of ciphers
- AConfusion – interceptor cannot predict what will happen to the ciphertext by changing one character
- BDiffusion – information from single plaintext is distributed over the entire ciphertext.
- CTransfusion interceptor cannot predict what will happen to the ciphertext by changing one character
8Earliest known confusion cipher. 3 letter alphabet shift. Caesar cipher. Letters can also be mapped to numbers. a = 0 z = 25. Vulnerable to brute force attacks.
- ATrue
- BFalse
9Which one are cipher techniques? (5)
- AMonoalphabetic Substitution cipher: Shuffle the letters and map each plaintext letter to a different random ciphertext letter.
- BPolyalphabetic cipher
- CVigenère cipher: Matrix of 26x26 alphabet letters shifted.
- DBook based cipher: Sherlock Holmes style (page, number, key)
- EAnalytic cipher: analyze components of book and mono alphabetic symbols
- FRow Transposition ciphers: plain text written row by row. Columns are on cipher.
10Cryptanalysis is the study of ciphers, ciphertext, or cryptosystems with a view to finding weaknesses in them that will permit retrieval of the plaintext from the ciphertext, without necessarily knowing the key or the algorithm. Two types: brute force, cryptanalytic attack.
- ATrue
- BFalse
11Which of the following are true about Brute force attacks? (3)
- AEvery key to decipher the ciphertext
- BTime needed proportional to size of key space.
- CIf 32 keys, there are 2^32 combinations
- DIf 12 keys, there are 32^2 combinations.
12Which of the following are the most common and least common letters in English?
- AE is most common followed by B, C, R, W. Least common is Z, Y, K.
- BE most common followed by T, R, N, I, A, O, S. Least common Z, J, K, Q, X.
- CAll letters have equal frequency of occurrence.
13Which of the following is NOT true about Hashing function is a "chewing" or "digest" function?
- Aaccepts a variable-length message and is a one-way process
- BKind of like compression. Hash value (message digest) is like fingerprint of original document.
- CVariable Input Size
- DFixed Output Size
- EEfficiency: easy to compute
- FPseudorandomness
- GPurely random
14With regards to hash functions which of the following is true regarding collision resistance? (5)
- AStrong: Difficult to find any M1 != M2 such that hash(M1) == hash(M2)
- BWeak: Given M1, difficult to find M2 such that hash(M1) == hash(M2)
- CStrong collision is birthday paradox: 2160/2 = 280 operations
- DStrong Collision resistance: data hash in a database
- EWeak Collision resistance: password in a database
15Hash functions always have some probability of collisions! It's directly related to Birthday Attack.
- ATrue
- BFalse
16Steganography: study of techniques to send sensitive info and hide the fact that sensitive info is being sent. E.g invisible ink, acronym, letter, image (least significant bit changed)
- ATrue
- BFalse
17Symmetric key: secret key a encrypts and decrypts message.
- ATrue
- BFalse
18Stream algorithms
• Operate on the plaintext one bit at a time
• Each bit uses a separate key
• CPU intensive
• Block algorithms
• Encrypt and decrypt data in groups of bits,
typically 64 bits in size
• Less overhead- ATrue
- BFalse
19DES Decryption: same algorithm and key as encryption, but subkeys are applied in opposite order. 56 bit easy to hack.
2DES: Simplest form of multiple encryption 2 encryption stages and 2 keys.
3DES: 3 encryption stages and 1,2 or 3 keys. Currently not broken.- ATrue
- BFalse
20Know the stages of 3 DES according to prof. type: this
- Athis
21What are the advantages and disadvantages of stream and block ciphers? (2)
- AAdvantages of stream cipher
• Speed of transformation
• Low error propagation
Faster than Block
Disadvantages:
Low diffusion
• Susceptibility to malicious insertions and modifications - BBlock Cipher Advantages:
• High diffusion
• Immunity to insertion of symbols
Disadvantages:
Slowness of encryption
• Error propagation
- AAdvantages of stream cipher
22Which of the following is true about Assymetric ciphers? (3)
- ADeveloped to solve the problem of Key distribution and Digital signatures (confirm
- BPublic-key: Known by anybody, and can be used to encrypt messages and verify signatures
- CPrivate-key: Known only to recipient, used to decrypt messages and sign (create) signatures
- DPublic key used to substitute decryption function data.
23RSA example:
• Select prime numbers p = 7, q = 17
• Calculate the modulus n = p x q = 119
• Calculate N = ø(n) = (p-1) x (q-1) = 6 x 16 = 96
• Select public constant e = 5 such that
• e is relative prime to N=96 and 1 < 5 < 96
• Determine private constant d = 77 such that
• 5 * 77 = 385 = 4 * 96 + 1 = 1 mod 96 and 77 < 96
• Public key: kPUB = {5, 119}
• Private key: kPRIV = {77, 119}- ATrue
- BFalse
24Three types of RSA attack:
- ABrute force
- BMathematical attack
- CTiming attack
- DTuring attack
25Need to choose suitably large numbers p and q (prime #s)
• Numbers p and q should NOT be too close
• The decryption (private) exponent d should be large
RSA Parameters
• The encryption (public) exponent e should not be too large
• typically e may be the same for all users
• originally values 3 and 5 were suggested
• regarded as too small currently- ATrue
- BFalse
26Secure email messages require? (4)
- Aconfidentiality: protection from disclosure
- Bauthentication: of sender of message
- Cmessage integrity: protection from modification
- Dnon-repudiation of origin: protection from denial by sender
- Esmart exchange: exchange between users and consumer
27Pretty Good Privacy (PGP) is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. A confidentiality and authentication service for email/file storage apps.
- ATrue
- BFalse
28Assymetric vs Symmetric communication comparison (2)
- AAssymetric: Key exchange over public channel, Scalable for multi-party communication
- BSymnetric: Key exchange over public channel, Scalable for multi-party communication
- CSymmetric: Key exchange must be done over secure channel, Non-scalable for multi-party communication
- DAsymmetric: Key exchange must be done over secure channel, Non-scalable for multi-party communication
29RSA involves factorization, exponentiation. Encrypt with public key, decrypt with private.
- ATrue
- BFalse
30Prime number: a natural number greater than 1 that cannot be formed by multiplying two smaller natural numbers.
Examples: 2, 3, 5, 7, 11, 13, 17, 19
Non prime: 4=(2x2), 6 (2x3)- ATrue
- BFalse
31The security of RSA is dependent on the assumption that it’s difficult to compute N = ø(n)
- ATrue
- BFalse
32Name top 3 types of attacks or misuse of technology?
- AMalware infection (1)
- BBeing fraudulently represented as sender of phishing message (2)
- CLaptop/ mobile hardware theft/loss (3)
- DBots/zombies in organization (4)
33Access control is a system which enables an authority to control access to areas and resources in a given physical facility or computer-based information system. SUBJECT: entity that performs an action system. OBJECT: resources
- ATrue
- BFalse
34Name 3 Access Control Types:
- AAdministrative
- BTechnical / Logical
- CPhysical
- DDetective
35Which is not an Access control STRATEGY?
- APreventive
- BDetective
- CCompensating
- DRecovery
- EDeterrent
- FDirective
- GCorrective
- HAssociative
- IAdministrative
36Which is not an access control threat?
- ADenial of service
- BShoulderSurfing/Swiping
- CSniffers
- DSpoofing/Masquerading
- EKeystroke Loggers
- FRainbow tables
- GBrute Force
- HDumpster Diving
- IEmnations
- JRainbow Emnations
37Name the four fundamental functions of access control systems:
- AIdentification: I am a user of the system.
- BAuthentication: I can prove I’m a user of the system.
- CAuthorization: Here’s what I can do with the system.
- DAccountability: You can track and monitor my use of the system.
system logs and database journals, and the auditing of these records. - ETransparency: you know what I use in the system
38A covert channel is a type of attack that creates a capability to transfer information between processes that are not supposed to be allowed to communicate by the computer security policy.
• Storage channels (embedding of data in TCP header) - stenography
• Timing channels (transfer information using time delays).- ATrue
- BFalse
39Bell-LaPadula confidentiality model
– State machine reference model
– Uses “no read up, no write down” principle- ATrue
- BFalse
40• Biba integrity model
– Designed to prevent corruption of higher integrity entities – Based on “no write up, no read down” principle- ATrue
- BFalse
41Firewall types:
- APacket-Filtering Firewalls (IP source/ destination, header information of packets)
3 types: static, dynamic, state packet inspection (track network connection with table).
Allows HTTP, FTP, TCP, protocol - BApplication layer proxy
- CMAC (MediaAccessControl) layer firewalls, sublayer of network’s data link layer, host computer identity,
- DHybrids
- APacket-Filtering Firewalls (IP source/ destination, header information of packets)
42 Screened subnet architecture (with DMZ)
– Is the dominant architecture used today- ATrue
- BFalse
43Best practices for firewalls
• All traffic from the trusted network is allowed out.
• Firewall device is never directly accessed from public
network.
• Simple Mail Transport Protocol (SMTP) data are allowed to pass through firewall.
• Internet Control Message Protocol (ICMP) data are denied.
• Telnet access to internal servers should be blocked.
• When Web services are offered outside the firewall, HTTP traffic should be blocked from reaching internal networks.
• All data that are not verifiably authentic should be denied.- ATrue
- BFalse
44Know this
- Athis
- Bnot this
45Content filters are: software program hardware/software appliance that allows administrators to restrict content that comes into or leaves a network. (3)
- Aset of scripts or programs restricting user access to certain networking protocols/Internet locations
- BPrimary purpose to restrict internal access to external material
- CMost common content filters restrict users from accessing non-business Web sites or deny incoming spam
- DPrimary purpose to restrict external access to internal material
46Select what is true regarding remote access: (2)
- AUnsecured, dial-up connection points represent a substantial exposure to attack.
- BRADIUS, Diameter, and TACACS are Systems that authenticate user credentials for those
trying to access an organization’s network via dial-up - CSecured, dial-up connection points represent a substantial exposure to attack.
47Select all that apply regarding RADIUS configuration
- ARemote worker dials NAS and submits username and password
- BNAS passes username and password to RADIUS server
- CRADIUS server approves or rejects request and provides access authorization
- DNAS provides access to authorized remote worker
48Keberos login
User logs into client machine (c)
Client machine encrypts password to create client key (Kc)
Client machine sends clear request to Kerberos Authentication Server (AS)
Kerberos AS returns ticket consisting of:
– Client/TGS session key for future communications between client and TGS [Kc,TGS], encrypted with the client's key
– Ticket granting ticket (TGT). The TGT contains the client name, client address, ticket valid times, and the client/TGS session key, all encrypted in the TGS' private key- ATrue
- BFalse
49What is true about VPN? (2)
- Aallows the user to turn Internet into a private network
- Bmust accomplish encapsulation, encryption of incoming and outgoing data. AND authentication of user and computer
- CAccess control is a process by which systems determine if and how to admit a user into a trusted area of the organization.
50Access control is a process by which systems determine if and how to admit a user into a trusted area of the organization.
• All access control approaches rely on identification, authentication, authorization, and accountability.- ATrue
- BFalse
51The three common architectural implementations of firewalls are:
- Asingle bastion hosts
- Bscreened hosts
- Ccreened subnets.
- Ddouble bastion hosts
52How is an application layer proxy firewall different from a packet-filtering firewall?
A packet-filtering firewall only allows “a particular packet with a particular source, destination, and port address to enter”.
An application layer firewall is sometimes called a proxy server because it “runs special software that acts as a proxy for a service request”- ATrue
- BFalse
53How is static filtering different from dynamic filtering of packets? Which is common in network routers?
Static filtering works with rules that are already designated or “developed and installed with the firewall” and only a person can change it- ATrue
- BFalse
54What is stateful inspection? How is state information maintained during a network connection or transaction?
Stateful inspection keeps track of each network connection between internal and external system using a state table.
A state table track the context and state of each packet in the conversation by recording which station sent the packet and when it was dent- ATrue
- BFalse
55What is the relationship between a TCP and UDP packet? Will any specific transaction usually involve both types of packets?
A TCP Packet sends information, and reports back to the sender on progress to assure that information has been sent and received.
UDP on the other hand is designed more for speed after establishing a connection and is used to strive for the fastest data retrieval rate as possible, but for this type of packet, it’s less important that it reports back.- ATrue
- BFalse
Information
- Description
- Computer Science Quiz on Security slides 3 & 4 , created by Duncan Levings on 04/11/2018.
- Author
- Duncan Levings
- Language
- English
- Views
- 4
- Tags
- Rating
- No ratings yet Rate this quiz