Free Printable CMU CS 376

1.

The three concepts that form what is often referred to as the CIA triad are . These three concepts embody the fundamental security objectives for both data and for information and computing services

a)

A. confidentiality, integrity and availability

b)

B. communication, integrity and authentication

c)

C.confidentiality, integrity, access control

d)

D.communication, information and authenticity

2.

A loss of is the unauthorized disclosure of information

a)

A. authenticity

b)

B. confidentiality

c)

C. reliability

d)

D. integrity

3.

3. (0.200 Point)

Verifying that users are who they say they are and that each input arriving at the system came from a trusted source is .

a)

A. authenticity

b)

B. credibility

c)

C. accountability

d)

D. integrity

4.

A is any action that compromises the security of information owned by an organization.

a)

A. security attack

b)

B. security service

c)

C. security alert

d)

D. security mechanism

5.

is the protection of transmitted data from passive attacks

a)

A. Access control

b)

B. Data control

c)

C. Nonrepudiation

d)

D. Confidentiality

6.

A(n) service is one that protects a system to ensure its availability and addresses the security concerns raised by denial-of-service attacks.

a)

A. replay

b)

B. availability

c)

C. masquerade

d)

D. integrity

7.

A(n) is a potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm

a)

A. threat

b)

B. attack

c)

A. risk

d)

D. attack vector

8.

The protection of the information that might be derived from the observation of traffic flows is .

a)

A. connectionless confidentiality

b)

B. connection confidentiality

c)

C. traffic-flow confidentiality

d)

D. selective-field confidentiality

9.

Data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery is a(n) .

a)

A. security audit trail

b)

B. digital signature

c)

C. encipherment

d)

D. authentication exchange

10.

techniques map plaintext elements (characters, bits) into ciphertext elements.

a)

A. Transposition

b)

B. Substitution

c)

C. Traditional

d)

D. Symmetric

11.

An original intelligible message fed into the algorithm as input is known as , while the coded message produced as output is called the .

a)

A. decryption, encryption

b)

B. plaintext, ciphertext

c)

C. deciphering, enciphering

d)

D. cipher, plaintext

12.

Restoring the plaintext from the ciphertext is .

a)

A. deciphering

b)

B. transposition

c)

C. steganography

d)

D. encryption

13.

A attack involves trying every possible key until an intelligible translation of the ciphertext is obtained.

a)

A. brute-force

b)

B. Caesar attack

c)

C. ciphertext only

d)

D. chosen plaintext

14.

The takes the ciphertext and the secret key and produces the original plaintext. It is essentially the encryption algorithm run in reverse.

a)

A. Voronoi algorithm

b)

B. decryption algorithm

c)

C. cryptanalysis

d)

D. diagram algorithm

15.

If both sender and receiver use the same key, the system is referred to as:

a)

A. public-key encryption

b)

B. two-key

c)

C. asymmetric

d)

D. conventional encryption

16.

The attack is the easiest to defend against because the opponent has the least amount of information to work with.

a)

A. ciphertext-only

b)

B. chosen ciphertext

c)

C. known plaintext

d)

D. chosen plaintext

17.

The methods of _________conceal the existence of the message in a graphic image.

a)

A. steganography

b)

B. decryptology

c)

C. cryptology

d)

D. cryptograph

18.

A cipher is one that encrypts a digital data stream one bit or one byte at a time.

a)

A. product

b)

B. block

c)

C. key

d)

D. stream

19.

The vast majority of network-based symmetric cryptographic applications make use of ciphers.

a)

A. linear

b)

B. block

c)

C. permutation

d)

D. stream

20.

A cipher is one in which a block of plaintext is treated as a whole and used to produce a ciphertext block of equal length

a)

A.bit

b)

B.product

c)

C.stream

d)

D.block

21.

is when each plaintext element or group of elements is uniquely replaced by a corresponding ciphertext element or group of elements.

a)

A. Substitution

b)

B. Diffusion

c)

C. Streaming

d)

D. Permutation

22.

The criteria used in the design of the focused on the design of the S-boxes and on the P function that takes the output of the S-boxes

a)

A. Avalanche Attack

b)

B. Data Encryption Standard

c)

C. Product Cipher

d)

D. Substitution Key

23.

The greater the number of rounds, the it is to perform cryptanalysis.

a)

A. easier

b)

B. less difficult

c)

C. equally difficult

d)

D.harder

24.

The function F provides the element of in a Feistel cipher.

a)

A. clarification

b)

B. alignment

c)

C. confusion

d)

D. stability

25.

Allowing for the maximum number of possible encryption mappings from the plaintext block is referred to by Feistel as the .

a)

A. ideal substitution cipher

b)

B. round function

c)

C. ideal block cipher

d)

D.diffusion cipher

26.

Authentication applied to the entire original IP packet is .

a)

A. security mode

b)

B. cipher mode

c)

C. tunnel mode

d)

D. transport mode

27.

Asymmetric encryption is also known as

a)

A. public-key encryption

b)

B. private-key encryption

c)

C. optimal encryption

d)

D. digital-key encryption

28.

Public-key encryption is also known as ________

a)

A. digital-key encryption

b)

B.asymmetric encryption

c)

C. one-way time exchange encryption

d)

D. optimal-key encryption

29.

Asymmetric encryption can be used for___________

a)

A.both confidentiality and authentication

b)

B. neither confidentiality nor authentication

c)

C. confidentiality

d)

D. authentication

30.

The plaintext is recovered from the ciphertext using the paired key and a___________

a)

A.digital signature

b)

B. recovery encryption

c)

C. decryption algorithm

d)

D. encryption algorithm

31.

The most widely used public-key cryptosystem is .

a)

A. optimal asymmetric encryption

b)

B. asymmetric encryption

c)

C. RSA

d)

D. DES

32.

are two related keys, a public key and a private key that are used to perform complementary operations, such as encryption and decryption or signature generation and signature verification

a)

A. Asymmetric keys

b)

B. Key exchanges

c)

C. Symmetric keys

d)

D. Cipher keys

33.

A is a cryptographic algorithm that uses two related keys, a public key, and a private key. The two keys have the property that deriving the private key from the public key is computationally infeasible.

a)

A.Private Key (Symmetric) Cryptographic Algorithm

b)

B. Key Exchange Cryptographic Algorithm

c)

C. Public Key (Asymmetric) Cryptographic Algorithm

d)

D. RSA Digital Cryptographic Algorithm

34.

The key used in symmetric encryption is referred to as a key.

a)

A. public

b)

B. secret

c)

C. private

d)

D. decryption

35.

The readable message or data that is fed into the algorithm as input is the___________

a)

A. ciphertext

b)

B. exchange

c)

C. plaintext

d)

D. encryption

36.

Two issues to consider with the computation required to use RSA are encryption/decryption and .

a)

A. time complexity

b)

B. trap-door one-way functions

c)

C. key generation

d)

D. asymmetric encryption padding

37.

depend on the running time of the decryption algorithm

a)

A. Mathematical attacks

b)

B. Timing attacks

c)

C. Chosen ciphertext attacks

d)

D. Brute-force attacks

38.

Authentication applied to all of the packet except for the IP header is ___

a)

A. tunnel mode

b)

B. transport mode

c)

C. association mode

d)

D. security mode

39.

Which technology is a primary method that IPsec uses to implement data integrity?

a)

A.MD5

b)

B.AES

c)

C.RSA

d)

D.DH

40.

What are the source and destination addresses used for an encrypted IPsec packet?

a)

A. Original sender and receiver IP addresses

b)

B. Original sender’s and outbound VPN gateway’s addresses

c)

C. Sending and receiving VPN gateways

d)

D. Sending VPN gateway and original destination address in the packet

41.

Which phase is used for private management traffic between the two VPN peers?

a)

A. IPsec

b)

B. IKE Phase 1

c)

C. IKE Phase 2

d)

A. IKE Phase 3

42.

What method is used to allow two VPN peers to establish shared secret keys and to establish those keys over an untrusted network?

a)

A. AES

b)

B. SHA

c)

C. RSA

d)

D. DH

43.

What are the two main methods for authenticating a peer as the last step of IKE Phase 1? (Choose all that apply).

a)

RSA signatures, using digital certificates to exchange public keys

b)

A. PSK (pre-shared key)

c)

A. DH Group 2

d)

TCP three-way handshake

44.

A customer has asked for its wireless equipment to be managed as securely as possible. Which three management protocols will provide encrypted access to the equipment? (Choose three)

a)

A. Secure Shell

b)

B. HTTPS

c)

C.. SNMPv3

d)

D.Telnet

e)

E. SNMPv2c

F.HTTP

45.

A customer has completed the installation of an 802.11ac greenfield deployment at their corporate headquarters. They would like to leverage 802.11ac enhanced speeds on the trusted employee WLAN. In order to configure the employee WLAN, what Layer 2 security policies are valid?

a)

A. WPA2 (TKIP)

b)

B. WPA(AES)

c)

C. OPEN

d)

A. WEP

46.

An engineer wants to set up guest wireless that requires users to log in via a splash page prior to accessing the network. Which authentication method should be configured?

a)

A. LDAP

b)

B. RADIUS

c)

C. local authentication

d)

A. WebAuth

e)

A. PSK

47.

An engineer would like to setup secure authentication for a wireless network that will utilize single sign-on. Which two authentication methods can be used to accomplish this? (Choose two.)

a)

A. LDAP

b)

B. RADIUS

c)

C. Local authentication

d)

A. WEP

e)

A. PSK

48.

While undergoing a security audit, a network administrator is told to set up the WLANs with at least 128-bit encryption but also keeping the 802.11n speeds. What WLAN configuration would meet the requirements?

a)

A. Static WEP

b)

B. WPA-TKIP

c)

C. WPA2-AES

d)

D. CKIP

49.

What Cisco Catalyst switch feature can be used to define ports as trusted for DHCP server connections?

a)

DHCP snooping

b)

port security

c)

802.1x

d)

A. private VLANs

50.

Which statement about named ACLs (Access Control Lists) is true?

a)

They support standard and extended ACLs

b)

They are used to filter usernames and passwords for Telnet and SSH

c)

They are used to filter Layer 7 traffic.

d)

They support standard ACLs only.

e)

They are used to rate limit traffic destined to targeted networks

51.

Which identification number is valid for an extended ACL?

a)

1

b)

64

c)

100

d)

299

e)

1099

52.

Refer to the exhibit. While you troubleshoot a connectivity issue to a PC behind R1, you enter the 12 show access-lists command to generate this output. Which reason for the problem is most likely

true?

a)

The permit all ACL entry on R1 is inactive

b)

The ACL of R1 is misconfigured.

c)

A deny all ACL entry is currently active on R1

d)

An implicit deny is causing R1 to block network traffic

53.

When you are troubleshooting an ACL issue on a router, which command can help you to verify which interfaces are affected by the ACL?

a)

A. show ip access-lists

b)

A. show access-lists

c)

show interface

d)

show IP interface

e)

list ip interface

54.

A network administrator is configuring ACLs on a Cisco router, to allow traffic from hosts on networks 192.168.146.0, 192.168.147.0, 192.168.148.0, and 192.168.149.0 only. Which two

ACL statements, when combined, are the best for accomplishing this task? (Choose two.)

a)

A.access-list 10 permit ip 192.168.146.0 0.0.1.255

b)

B. access-list 10 permit ip 192.168.147.0 0.0.255.255

c)

C. access-list 10 permit ip 192.168.148.0 0.0.1.255

d)

D. access-list 10 permit ip 192.168.149.0 0.0.255.255

e)

E . access-list 10 permit ip 192.168.146.0 0.0.0.255

F. access-list 10 permit ip 192.168.146.0 255.255.255.0

55.

In which solution is a router ACL used?

a)

filtering packets that are passing through a router

b)

A. to change the default administrative distance of a route in the route table

c)

protecting a server from unauthorized access

d)

A. controlling path selection, based on the route metric

56.

Which IPsec security protocol should be used when confidentiality is required?

a)

MD5

b)

PSK

c)

AH

d)

ESP

57.

A network administrator needs to configure port security on a switch. Which two statements are true? (Choose two.)

a)

The network administrator can apply port security to dynamic access ports.

b)

The network administrator can apply port security to EtherChannels.

c)

When dynamic MAC address learning is enabled on an interface, the switch can learn new addresses, up to the maximum defined.

d)

The sticky learning feature allows the addition of dynamically learned addresses to the running configuration.

e)

The network administrator can configure static secure or sticky secure MAC addresses in the voice VLAN

58.

On which options are standard access lists based?

a)

A. destination address and wildcard mask

b)

destination address and subnet mask

c)

source address and subnet mask

d)

source address and wildcard mask

59.

Which component of VPN technology ensures that data is unaltered between the sender and recipient?

a)

A. encryption

b)

A. authentication

c)

A. key exchange

d)

A. data integrity

60.

How does using the service password-encryption command on a router provide additional security?

a)

by encrypting all passwords passing through the router

b)

by encrypting passwords in the plain text configuration file

c)

by requiring entry of encrypted passwords for access to the device

d)

by configuring an MD5 encrypted key to be used by routing protocols to validate routing exchanges

e)

by automatically suggesting encrypted passwords for use in configuring the router

61.

When are packets processed by an inbound access list?

a)

before they are routed to an outbound interface

b)

after they are routed to an outbound interface

c)

before and after they are routed to an outbound interface

d)

after they are routed to an outbound interface but before being placed in the outbound queue

62.

The company internetwork is subnetted using 29 bits. Which wildcard mask should be used to configure an extended access list to permit or deny access to an entiresubnetwork?

a)

255.255.255.224

b)

255.255.255.248

c)

0.0.0.224

d)

0.0.0.8

0.0.0.3

e)

0.0.0.7

63.

What are three valid reasons to assign ports to VLANs on a switch? (Choose three.)

a)

A. to make VTP easier to implement

b)

A. to isolate broadcast traffic

c)

A. to increase the size of the collision domain

B. to allow more devices to connect to the network

d)

to logically group hosts according to function

e)

to increase network security

64.

Which protocol should be used to establish a secure terminal connection to a remote network

a)

ARP

b)

SSH

c)

TELNET

d)

WEP

e)

SNMPv1

SNMPv2

65.

What three pieces of information can be used in an extended access list to filter traffic? (Choose three.)

a)

A. protocol

b)

B. VLAN number

c)

C. TCP or UDP port numbers

d)

D. source switch port number

e)

E. source IP address and destination IP address

66.

Which command is necessary to permit SSH or Telnet access to a Cisco switch that is otherwise configured for these vty line protocols?

a)

A. transport output all

b)

B. transport preferred all

c)

C. transport type all

d)

D. transport input all

67.

What features can protect the data plane? (Choose three.)

a)

A. policing

b)

B. ACLs

c)

C. IPS

d)

D. antispoofing

e)

F. DHCP-snooping

68.

Which of the following statements is true regarding a stateless packetfiltering firewall? (Select the best answer.)

a)

A. It can operate at Layer 4 of the OSI model.

b)

B. It is more secure than a stateful packetfiltering firewall.

c)

C. It tracks packets as a part of a stream.

d)

D. It is not susceptible to IP spoofing attacks

69.

Which of the following statements is true of all firewalls? (Select the best answer.)

a)

A. They maintain a state table

b)

B. They hide the source of network connections.

c)

C. They operate at Layer 7 of the OSI model.

d)

D. They are multihomed devices.

70.

Which feature can validate address requests and filter out invalid messages?

a)

A. IP Source Guard

b)

B. port security

c)

C. DHCP snooping

d)

D. dynamic ARP inspection

71.

Select the action that results from executing these commands.

a)

A. A dynamically learned MAC address is saved in the startup-configuration file.

b)

B. A dynamically learned MAC address is saved in the running-configuration file.

c)

C. A dynamically learned MAC address is saved in the VLAN database.

d)

D. Statically configured MAC addresses are saved in the startup-configuration file if frames from that address are received.

e)

E. Statically configured MAC addresses are saved in the running-configuration file if frames from that address are received.

72.

A network administrator needs to configure port security on a switch. Which two statements are true? (Choose two)

a)

A. The network administrator can apply port security to dynamic access ports.

b)

B. The network administrator can apply port security to EtherChannels.

c)

C. When dynamic MAC address learning is enabled on an interface, the switch can learn new addresses, up to the maximum defined.

d)

D. The sticky learning feature allows the addition of dynamically learned addresses to the running 17 configuration.

e)

E. The network administrator can configure static secure or sticky secure MAC addresses in the voice VLAN.

73.

What are three reasons that an organization with multiple branch offices and roaming users might implement a Cisco VPN solution instead of point-to-point WAN links? (Choose three.)

a)

A. reduced cost

b)

B. better throughput

c)

C. broadband incompatibility

d)

D. increased security

e)

E. scalability

74.

Which feature can you use to monitor traffic on a switch by replicating it to another port or ports on the same switch?

a)

A. copy run start

b)

B. traceroute

c)

C. the ICMP Echo IP SLA

d)

D. SPAN

75.

Which keywords can be substituted for access list wildcards while configuring access lists? (Choose two.)

a)

A. all

b)

B. any

c)

C. host

d)

D. range

e)

E. subnet

76.

Which IEEE mechanism is responsible for the authentication of devices when they attempt to connect to a local network?

a)

A. 802.1x

b)

B. 802.11

c)

C. 802.2x

d)

D. 802.3x

77.

Where does a switch maintain DHCP snooping information ?

a)

A. in the MAC address table

b)

B. in the CAM table

c)

C. in the DHCP binding database

d)

D. in the VLAN database

78.

Which command can you enter in a network switch configuration so that learned mac addresses are saved in configuration as they connect?

a)

A. Switch(confg-if)#Switch port-security

b)

B. Switch(confg-if)#Switch port-security Mac-address sticky

c)

C. Switch(confg-if)#Switch port-security maximum 10

d)

D. Switch(confg-if)#Switch mode access

79.

Which one of the following follows best practices for a secure password?

a)

A. ABC123!

b)

B. SlE3peR1#

c)

C. tough-passfraze

d)

D. InterEstIng-PaSsWoRd

80.

(a) encryption is a form of cryptosystem in which encryption and decryption are performed using the same key

81.

The two types of attack on an encryption algorithm are cryptanalysis based on properties of the encryption algorithm, and _______-_______which involves trying all possible keys.

(a)

82.

One of the simplest and besr-known polyalphabetic ciphers is (a) cipher. In this scheme, the set of related monoalphabetic substitution rules consists of the 26 Caesar ciphers with shifts of 0 through 25. Each cipher is denoted by a key letter which is the ciphertext letter that substitutes for the plaintext letter a.

83.

A ___________cipher processes the input one block of elements at a time producing an output block for each input block whereas a ____________cipher processes the input elements continuously producing output one element at a time.

(a)

84.

The earliest known and simplest use of a substitution cipher was called the (a) cipher and involved replacing each letter of the alphabet with the letter standing three places further down the alphabet.

85.

The best known multiple letter encryption cipher is the (a) which treats diagrams in the plaintext as single units and translates these units into ciphertext diagrams.

86.

A (a) is an encryption/decryption scheme in which a block of plaintext is treated as a whole and used to produce a ciphertext block of equal length

87.

The most widely used encryption scheme is based on the (a) adopted in 1977 by the National Bureau of Standards as Federal Information Processing Standard 46.

88.

(a) encryption is a form of cryptosystem in which encryption and decryption are performed using a public key and a private key.

89.

Asymmetric encryption transforms plaintext into (a) using one of two keys and an encryption algorithm.

90.

The difficulty of attacking (a) is based on the difficulty of finding the prime factors of a composite number.

91.

Public-key cryptography is asymmetric, involving the use of two separate keys, in contrast to (a) encryption, which uses only one key.

92.

"The sender ‘signs’ a message with its private key. Signing is achieved by a cryptographic algorithm applied to the message or to a small block of data that is a function of the message," is a description of a (a) .

CMU CS 376

Total questions: 92

Worksheet time: 55mins

3. (0.200 Point)

Similar Resources on Wayground