NEW
Font size
WorksheetsSEC+ Ch.10 Review Test
Total questions: 15
Worksheet time: 8mins
GCGA, a software development company, occasionally updates its software with major updates and minor patches. Administrators load these updates to the company web site along with a hash associated with each update. Which of the following BEST describes the purpose of the hash?
Availability of updates and patches
Integrity of updates and patches
Confidentiality of updates and patches
Integrity of the application
Users in your organization sign their emails with digital signatures.
Which of the following provides integrity for these digital signatures?
Hashing
Encryption
Non-repudiation
Private key
While reviewing logs on a web server hosted by your organization, you notice multiple logon failures to an FTP account, but they’re only happening about once every 30 minutes. You also see that the same password is being tried against the SSH account right after the FTP account logon failure. What BEST describes what is happening?
Brute force attack
Dictionary attack
Plaintext attack
Spraying attack
An online application requires users to log on with their email address and a password. The application encrypts the passwords in a hashed format. Which of the following can be added to decrease the likelihood that attackers can discover these passwords?
Rainbow tables
Salt
Digital signatures
Input validation
What is the primary difference between a block cipher and a stream cipher?
A stream cipher encrypts data 1 bit or 1 byte at a time.
A block cipher encrypts data 1 bit or 1 byte at a time.
Stream ciphers are used for symmetric encryption, but block ciphersare used for asymmetric encryption.
Block ciphers are used for symmetric encryption, but stream ciphersare used for asymmetric encryption.
A developer is creating an application that will encrypt and decrypt data on mobile devices. These devices don’t have a lot of processing power. Which of the following cryptographic methods has the LEAST overhead and can provide encryption for these mobile devices?
Elliptic curve cryptography
Perfect forward secrecy
Salting
Digital signatures
You are configuring a web server that will be used by salespeople via the Internet. Data transferred to and from the server needs to be encrypted, so you are tasked with requesting a certificate for the server. Which of the following would you MOST likely use to request the certificate?
CA
CRL
CSR
OCSP
Users within an organization frequently access public web servers using HTTPS. Management wants to ensure that users can verify that certificates are valid even if the public CAs are temporarily unavailable. Which of the following should be implemented to meet this need?
OCSP
CRL
Private CA
CSR
Your organization hosts an internal web site used only by employees. The web site uses a certificate issued by a private CA and the network downloads a CRL from the CA once a week. However, after a recent compromise, security administrators want to use a real-time alternative to the CRL. Which of the following will BEST meet this need?
SAN
CSR
RA
OCSP
An organization hosts several web servers in a web farm used for ecommerce. Due to recent attacks, management is concerned that attackers might try to redirect web site traffic, allowing the attackers to impersonate their e-commerce site. Which of the following methods will address this issue?
Stapling
Perfect forward secrecy
Pinning
Key stretching
Management has mandated the use of digital signatures by all personnel within your organization. Which of the following use cases does this support?
Supporting confidentiality
Supporting availability
Supporting obfuscation
Supporting non-repudiation
A DLP system detected confidential data being sent out via email from Bart’s account. However, he denied sending the email. Management wants to implement a method that would prevent Bart from denying accountability in the future. Which of the following are they trying to enforce?
Confidentiality
Encryption
Access control
Non-repudiation
Your organization recently updated the security policy and mandated that emails sent by all upper-level executives include a digital signature.
Which security goal does this policy address?
Confidentiality
Hashing
Obfuscation
Authentication
You are tasked with getting prices for certificates. You need to find a source that will provide a certificate that can be used for multiple domains that have different names. Which of the following certificates is the BEST choice?
SAN
Domain validation
Extended validation
Wildcard
Your organization recently lost access to some decryption keys, resulting in the loss of some encrypted data. The chief information officer (CIO) mandated the creation of a key escrow. Which of the following cryptographic keys are MOST likely to be stored in key escrow?
Public
Private
Ephemeral
Session
