Security+ Study Guide-10 Understanding Cryptography and PKI

GCGA, a software development company, occasionally updates its software with major updates and minor patches. Administrators load these updates to the company web site along with the has associated with each update.

Which of the following BEST describes the purpose of the hash?

• Availability of updates and patches

• Integrity of updates and patches

• Confidentiality of updates and patches

• Integrity of the applicaiton

Answer explanation

The hash provides integrity for the updates and patches so that users can verify they have not been modified.

Installing updates and patches increases the availability of the application.

Confidentiality is provided by encryption.

The hashes are for the updates and patches, so they do not provide integrity for the application.

Users in your organization sign their emails with digital signatures. Which of the following provides integrity for these digital signatures?

• Hashing

• Encryption

• Non-repudiation

• Private key

Answer explanation

Hashing provides integrity for digital signatures and other data.

A digital signature is a hash of the message encrypted with the sender’s private key, but the encryption doesn’t provide integrity.

The digital signature provides non-repudiation, but non-repudiation does not provide integrity.

The private key and public key are both needed, but the private key does not provide integrity.

While reviewing logs on a web server hosted by your organization, you notice multiple logon failures to an FTP account, but they're only happening about once every 30 minutes. You also see that the same password is being tried against the SSH account right after the FTP account logon failure.

What BEST describes what is happening?

• Brute force attack

• Dictionary attack

• Plaintext attack

• Spraying attack

Answer explanation

This indicates a password spraying attack. It loops through a list of accounts, guessing a password for one account at a time, and then guessing the same password for a different account. In this scenario, the attack may be guessing passwords for the other servers before it returns to the web server.

A brute force attempts to guess all possible characters combinations for a password, and a dictionary attack uses a dictionary of words trying to discover the correct password.

A spraying attack could use either a brute force method or a dictionary method when guessing the password; however, these methods do not look through a list of user accounts.

In a plaintext attack (also called a known plaintext attack), an attacker has samples of known plaintext and can use these samples to decrypt ciphertext that includes this plaintext.

An online application requires users to log on with their email address and a password. The application encrypts the passwords in a hashed format.

Which of the following can be added to decrease the likelihood that attackers can discover these passwords?

• Rainbow tables

• Salt

• Digital signatures

• Input validation

Answer explanation

A password salt is additional random characters added to a password before hashing the password, and it decreases the success of password attacks.

Rainbow tables are used by attackers and contain precomputed hashes, and salting is intended to specifically thwart rainbow table attacks.

A digital signature provides authentication, non-repudiation, and integrity, but it doesn’t protect passwords.

Input validation techniques verify data is valid before using it, and they are unrelated to protecting hashed passwords.

What is the primary difference between a block cypher and a stream cypher?

• A stream cipher encrypts data 1 bit or byte at a time.

• A block cipher encrypts data 1 bit or byte at a time.

• Stream ciphers are used for symmetric encryption.

• Block ciphers are used for symmetric encryption, but stream ciphers are used for asymmetric encryption

Answer explanation

A stream cipher encrypts data a single bit or a single byte at a time and is more efficient when the size of the data is unknown, such as streaming audio or video.

A block cipher encrypts data in specific-sized blocks, such as 64-bit blocks or 128-bit blocks.

Both are used with symmetric encryption algorithms.

A developer is creating an application that will encrypt and decrypt data on mobile devices. These devices don't have a lot of processing power.

Which of the following cryptographic methods las the LEAST overhead and can provide encryption for these mobile devices?

• Elliptic curve cryptography

• Perfect forward secrecy

• Salting

• Digital signatures

Answer explanation

Elliptic curve cryptography (ECC) has minimal overhead and is often used with mobile devices for encryption.

Perfect forward secrecy refers to session keys and provides assurances that session keys will not be compromised even if a private key is later compromised.

Salting adds random characters to a password before hashing it to thwart rainbow table attacks.

Digital signatures provide integrity, authentication, and non-repudiation, but not encryption.

You are configuring a web server that will be used by salespeople via the Internet. Data transferred to an from the server needs to be encrypted, so you are asked with requesting a certificate for the server.

Which of the following would you MOST likely use to request the certificate?

• CA

• CRL

• CSR

• OCSP

Answer explanation

You would request a certificate with a certificate signing request (CSR). It uses a specific format to request a certificate. You submit the CSR to a certificate authority (CA), but the request needs to be in the CSR format.

A certificate revocation list (CRL) is a list of revoked certificates.

The Online Certificate Status Protocol (OCSP) is an alternate method of validating certificates and indicates if a certificate is good, revoked, or unknown.

Users within an organization frequently access public web servers using HTTPS. Management wants to ensure that users can verify that certificates are valid even if the public CAs are temporarily unavailable.

Which of the following should be implemented to meet this need?

• OCSP

• CRL

• Private CA

• CSR

Answer explanation

A certificate revocation list (CRL) can meet this need because CRLs are cached. If the public certificate authority (CA) is not reachable due to any type of connection outage or CA outage, the cached CRL can be used if the cache time has not expired.

The Online Certificate Status Protocol (OCSP) works in real time where the client queries the CA with the serial number of the certificate. If the CA is unreachable, the certificate cannot be validated.

A private CA is used within an organization and cannot validate certificates from a public CA. You request a certificate with the certificate signing request (CSR), but the CSR doesn't validate an issued certificate.

Your organization hosts an internal web site used only by employees. The web site uses a certificate issued by a private CA and the network downloads a CRL from the CA once a week. However, after a recent compromise, security administrators want to use a real-time alternative to the CRL.

Which of the following will BEST meet this need?

• SAN

• CSR

• RA

• OCSP

Answer explanation

The Online Certificate Status Protocol (OCSP) provides real-time responses to validate certificates issued by a certificate authority (CA).

A certificate revocation list (CRL) includes a list of revoked certificates, but if it is only downloaded once a week, it can quickly be out of date.

None of the other answers validates certificates.

In the context of certificates, a subject alternative name (SAN) certificate is used for multiple domains that have different names but are owned by the same organization.

A certificate signing request (CSR) is used to request a certificate. A registration authority (RA) accepts CSRs for a CA.

An organization hosts several web servers in a web farm used for e-commerce. Due to recent attacks, management is concerned that attackers might try to redirect web site traffic, allowing the attackers to impersonate their e-commerce site.

Which of the following methods will address this issue?

• Stapling

• Perfect forward secrecy

• Pinning

• Key stretching

Answer explanation

Public key pinning provides clients with a list of public key hashes that clients can use to detect web site impersonation attempts.

Stapling reduces Online Certificate Status Protocol (OCSP) traffic by appending a timestamped, digitally signed OCSP response to a certificate.

Perfect forward secrecy ensures that the compromise of one session key does not compromise other session keys used in the past.

Key stretching techniques add additional bits (salts) to passwords, making them harder to crack.