Chapter 10 Understanding Cryptography and PKI

Question #1: A symmetric encryption algorithm is BEST suited for:

• key-exchange scalability

• protecting large amounts of data

• providing hashing capabilities

• implementing non-repudiation

Answer explanation

Simetrik şifreleme algoritmaları büyük veri kütlelerini korumak için en uygun olanıdır.

Question #2: A security analyst needs to generate a server certificate to be used for 802.1X and secure RDP connections. The analyst is unsure what is required to perform the task and solicits help from a senior colleague. Which of the following is the FIRST step the senior colleague will most likely tell the analyst to perform to accomplish this task?

• Create an OCSP

• Generate a CSR

• Create a CRL

• Generate a .pfx file

Answer explanation

Bu görevi yerine getirmek için, kıdemli bir meslektaşın muhtemelen analiste yapması gereken İLK adımı "CSR (Certificate Signing Request) oluşturmak" olacaktır.

CSR, bir sertifika otoritesine (Certificate Authority) sunulmak üzere sunucu sertifikasının oluşturulması için kullanılan bir istektir. CSR, sunucunun kimlik bilgilerini (örneğin, sunucu adı, kuruluş adı) ve genellikle kullanılacak şifreleme algoritmasını içerir.

Question #3: A security analyst discovers that a company username and password database was posted on an internet forum. The username and passwords are stored in plain text. Which of the following would mitigate the damage done by this type of data exfiltration in the future?

• Create DLP controls that prevent documents from leaving the network

• Implement salting and hashing

• Configure the web content filter to block access to the forum.

• Increase password complexity requirements

Answer explanation

Bu tür veri dışa çıkarılmasının neden olduğu hasarı azaltmak için, B seçeneği olan "tuzlama ve karma kullanmak" en uygun olanıdır.

Question #5: A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multi cloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization's existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would BEST meet the architect's objectives?

• Trusted Platform Module

• laaS

• HSMaaS

• PaaS

• Key Management Service

Answer explanation

Hizmet olarak HSM, şirket içi HSM'ye veya bulut sağlayıcısından KMS'ye bir alternatiftir. Şifreleme anahtarları nerede kullanılırsa kullanılsın, hem anahtar yönetimi için HSM düzeyinde güvenliğe hem de tek bir yönetim ortamının tutarlılığına ihtiyaç duyan kuruluşlar için idealdir. HSM cihazlarına ihtiyaç duymadan HSM dereceli anahtar depolama sağlayan Hizmet Olarak HSM, hızla uygulanır ve verileri, süreçleri ve coğrafi büyümeyi desteklemek için kolayca ölçeklenir.

Question #6: A security assessment determines DES and 3DES are still being used on recently deployed production servers. Which of the following did the assessment identify?

• Unsecure protocols

• Default settings

• Open permissions

• Weak encryption

Answer explanation

Güvenlik değerlendirmesi, DES ve 3DES'in hala yeni kurulan üretim sunucularında kullanıldığını belirlemiştir. Bu tespit, "zayıf şifreleme"yi (weak encryption) ortaya koymaktadır.

DES (Data Encryption Standard) ve 3DES (Triple Data Encryption Standard), eskimiş ve güvenlik açıkları bulunan şifreleme algoritmalarıdır. Bu algoritmaların güvenlik açıkları keşfedildiği için günümüzde güvenli kabul edilmemektedir. Daha güçlü ve modern şifreleme algoritmaları, DES ve 3DES'in yerini almıştır (örneğin, AES).

Question #7: A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events:

To better understand what is going on, the analyst runs a command and receives the following output:

Based on the analyst’s findings, which of the following attacks is being executed?

• Credential harvesting

• Keylogger

• Brute-force

• Spraying

Question #8: Given the following logs: Which of the following BEST describes the type of attack that is occurring?

• Rainbow table

• Dictionary

• Password spraying

• Pass-the-hash

Question #9: A security analyst is reviewing the following attack log output: Which of the following types of attacks does this MOST likely represent?

• Rainbow table

• Brute-force

• Password-spraying

• Dictionary

Question #10: Which of the following algorithms has the SMALLEST key size?

• DES

• Twofish

• RSA

• AES

Answer explanation

DES (56)

Twofish (128,192,256)

RSA (1024, 2048, and 4096)

AES (128, 192, or 256)

Question #11: A security analyst is investigating an incident to determine what an attacker was able to do on a compromised laptop. The analyst reviews the following SIEM log: Which of the following describes the method that was used to compromise the laptop?

• An attacker was able to move laterally from PC1 to PC2 using a pass-the-hash attack

• An attacker was able to bypass application whitelisting by emailing a spreadsheet attachment with an embedded PowerShell in the file

• An attacker was able to install malware to the CAasdf234 folder and use it to gain administrator rights and launch Outlook

• An attacker was able to phish user credentials successfully from an Outlook user profile