Security+ Domain 1

Which of the following statements about honeyfiles are true? (Select two.)

• Honeyfiles work with network intrusion detection systems (NIDs) and can help prevent false positives.

• Honeyfiles can only be created by system administrators.

• Honeyfiles are designed to provide real data to the attacker.

• Honeyfiles are named in a way that makes them attractive to hackers, enticing them to open or execute them.

• Honeyfiles are used to block all types of malicious traffic.

Which kind of access control technology allows more than just the identity of an individual to be transmitted wirelessly to either allow or deny access?

• Smart card

• Keypad locks

• Proximity card

• Biometric locks

Which of the following are control categories? (Select three.)

• Preventative

• Operational

• Managerial

You are a system administrator at a software company. You have been tasked with verifying the integrity of a large software update file that has been downloaded from the internet. The software provider has provided a SHA256 hash of the file for verification purposes. You decide to use the Get-FileHash command in PowerShell to calculate the hash of the downloaded file. Which of the following scenarios best demonstrates the correct use of the Get-FileHash command for this purpose?

• You use the Get-FileHash command to calculate the hash of the downloaded file and send it to the software provider for verification.

• You use the Get-FileHash command to calculate the hash of the downloaded file and compare it with the hash provided by the software provider. If the hashes match, you assume the file has not been tampered with.

• You use the Get-FileHash command to calculate the hash of the downloaded file and compare it with the hash of another file downloaded from the internet. If the hashes match, you assume the file has not been tampered with.

• You use the Get-FileHash command to calculate the hash of the downloaded file and compare it with the hash of the original file on your system. If the hashes match, you assume the file has not been tampered with.

Which of the following is the term for the process of validating a subject's identity?

• Authorization

• Authentication

• Auditing

• Identification

Which of the following is a message authentication code that allows a user to verify that a file or message is legitimate?

• MD5

• SHA

• RIPEMD

• HMAC

A newly launched online store wants to secure transactions between the store and customers. The store must guarantee the authenticity of transactions, provide confidentiality, and ensure that only authorized recipients can access the purchase details.

Which cryptographic technique would best meet these requirements?

• Hybrid encryption

• Hashing techniques

• Symmetric encryption

• Asymmetric encryption

You are a security analyst at a large corporation. The corporation is implementing a new system that requires secure logon credential exchange between different departments. The corporation decides to use a cryptographic hashing algorithm for this purpose. Which of the following scenarios best demonstrates the correct use of hashing for secure logon credential exchange?

• Each department sends their password to the other departments. The receiving department calculates a hash of the received password and compares it with the hash of the sending department's password they have on file. If the hashes match, the receiving department assumes the sending department has authenticated itself.

• Each department shares their passwords with each other, calculates the hash of their own password, and if the hashes match, they assume they have authenticated each other.

• Each department calculates a hash of their password and sends the actual password along with the hash to the other departments. The receiving department then verifies the password by comparing it with the hash.

• Each department calculates a hash of their password and sends it to the other departments. The receiving department compares this hash with the hash of the sending department's password they have on file. If the hashes match, the receiving department assumes the sending department has authenticated itself.

Your computer system is a participant in an asymmetric cryptography system. You've created a message to send to another user. Before transmission, you hash the message and encrypt the hash using your private key. You then attach this encrypted hash to your message as a digital signature before sending it to the other user. In this example, which protection does the hashing activity provide?

• Confidentiality

• Availability

• Non-repudiation

• Integrity