Font size
WorksheetsInformation Security and Cryptography MCQs
Total questions: 100
Worksheet time: 51mins
(0.200 Point) The three concepts that form what is often referred to as the CIA triad are ________. These three concepts embody the fundamental security objectives for both data and for information and computing services.
confidentiality, integrity and availability
communication, integrity and authentication
confidentiality, integrity, access control
communication, information and authenticity
(0.200 Point) A loss of ________ is the unauthorized disclosure of information.
authenticity
confidentiality
reliability
integrity
(0.200 Point) Verifying that users are who they say they are and that each input arriving at the system came from a trusted source is ________.
authenticity
credibility
accountability
integrity
(0.200 Point) A __________ is any action that compromises the security of information owned by an organization.
security attack
security service
security alert
security mechanism
(0.200 Point) A __________ takes place when one entity pretends to be a different entity.
replay
masquerade
service denial
passive attack
(0.200 Point) _________ is the protection of transmitted data from passive attacks.
Access control
Data control
Nonrepudiation
Confidentiality
(0.200 Point) A(n) __________ service is one that protects a system to ensure its availability and addresses the security concerns raised by denial-of-service attacks.
replay
availability
masquerade
integrity
(0.200 Point) __________ threats exploit service flaws in computers to inhibit use by legitimate users.
Information access
Reliability
Passive
Service
(0.200 Point) A(n) __________ is a potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm.
threat
attack
risk
attack vector
(0.200 Point) The protection of the information that might be derived from the observation of traffic flows is _________.
connectionless confidentiality
connection confidentiality
traffic-flow confidentiality
selective-field confidentiality
(0.200 Point) Data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery is a(n) __________.
security audit trail
digital signature
encipherment
authentication exchange
(0.200 Point) __________ techniques map plaintext elements (characters, bits) into ciphertext elements.
Transposition
Substitution
Traditional
Symmetric
(0.200 Point) An original intelligible message fed into the algorithm as input is known as __________, while the coded message produced as output is called the __________.
decryption, encryption
plaintext, ciphertext
deciphering, enciphering
cipher, plaintext
(0.200 Point) Restoring the plaintext from the ciphertext is __________.
deciphering
transposition
steganography
encryption
(0.200 Point) A __________ attack involves trying every possible key until an intelligible translation of the ciphertext is obtained.
brute-force
Caesar attack
ciphertext only
chosen plaintext
(0.200 Point) Techniques used for deciphering a message without any knowledge of the enciphering details is __________.
blind deciphering
steganography
cryptanalysis
transposition
(0.200 Point) The __________ takes the ciphertext and the secret key and produces the original plaintext. It is essentially the encryption algorithm run in reverse.
Voronoi algorithm
decryption algorithm
cryptanalysis
diagram algorithm
(0.200 Point) If both sender and receiver use the same key, the system is referred to as:
public-key encryption
two-key
asymmetric
conventional encryption
(0.200 Point) __________ attacks exploit the characteristics of the algorithm to attempt to deduce a specific plaintext or to deduce the key being used.
Brute-force
Cryptanalytic
Block cipher
Transposition
(0.200 Point) The __________ attack is the easiest to defend against because the opponent has the least amount of information to work with.
ciphertext-only
chosen ciphertext
known plaintext
chosen plaintext
(0.200 Point) __________ refer to common two-letter combinations in the English language.
Streaming
Transposition
Diagrams
Polyalphabetic cipher
(0.200 Point) A way to improve on the simple monoalphabetic technique is to use different monoalphabetic substitutions as one proceeds through the plaintext message. The general name for this approach is __________.
rail fence cipher
cryptanalysis
polyalphabetic substitution cipher
polyanalysis cipher
(0.200 Point) A technique referred to as a __________ is a mapping achieved by performing some sort of permutation on the plaintext letters.
transposition cipher
polyalphabetic cipher
Caesar cipher
monoalphabetic cipher
(0.200 Point) The methods of __________ conceal the existence of the message in a graphic image.
steganography
decryptology
cryptology
cryptograph
DES exhibits the classic ________ block cipher structure, which consists of a number of identical rounds of processing. (0.200 Point)
Feistel
SAC
Shannon
Rendell
A sequence of plaintext elements is replaced by a ________ of that sequence which means that no elements are added, deleted or replaced in the sequence, but rather the order in which the elements appear in the sequence is changed. (0.200 Point)
permutation
diffusion
stream
substitution
A ________ cipher is one that encrypts a digital data stream one bit or one byte at a time. (0.200 Point)
product
block
key
stream
The vast majority of network-based symmetric cryptographic applications make use of ________ ciphers. (0.200 Point)
linear
block
permutation
stream
A ________ cipher is one in which a block of plaintext is treated as a whole and used to produce a ciphertext block of equal length. (0.200 Point)
bit
product
stream
block
__________ is when each plaintext element or group of elements is uniquely replaced by a corresponding ciphertext element or group of elements. (0.200 Point)
Substitution
Diffusion
Streaming
Permutation
Key sizes of ________ or less are now considered to be inadequate. (0.200 Point)
128 bits
32 bits
16 bits
64 bits
Feistel proposed that we can approximate the ideal block cipher by utilizing the concept of a ________ cipher, which is the execution of two or more simple ciphers in sequence in such a way that the final result or product is cryptographically stronger than any of the component ciphers. (0.200 Point)
linear
permutation
differential
product
The criteria used in the design of the ________ focused on the design of the S-boxes and on the P function that takes the output of the S-boxes. (0.200 Point)
Avalanche Attack
Data Encryption Standard
Product Cipher
Substitution Key
The greater the number of rounds, the ________ it is to perform cryptanalysis. (0.200 Point)
easier
less difficult
equally difficult
harder
The function F provides the element of ________ in a Feistel cipher. (0.200 Point)
clarification
alignment
confusion
stability
One of the most intense areas of research in the field of symmetric block ciphers is ________ design. (0.200 Point)
S-box
F-box
E-box
D-box
Mister and Adams proposed that all linear combinations of S-box columns should be ________, which are a special class of Boolean functions that are highly nonlinear according to certain mathematical criteria. (0.200 Point)
horizontal functions
angular functions
bent functions
vertical functions
The Nyberg approach that is more or less a manual approach with only simple mathematics to support it is ________. (0.200 Point)
human-made
random
math-made
random with testing
Allowing for the maximum number of possible encryption mappings from the plaintext block is referred to by Feistel as the ________. (0.200 Point)
ideal substitution cipher
round function
ideal block cipher
diffusion cipher
Authentication applied to the entire original IP packet is ________. (0.200 Point)
security mode
cipher mode
tunnel mode
transport mode
Asymmetric encryption is also known as ________. (0.200 Point)
public-key encryption
private-key encryption
optimal encryption
digital-key encryption
Public-key encryption is also known as ________. (0.200 Point)
digital-key encryption
asymmetric encryption
one-way time exchange encryption
optimal-key encryption
Asymmetric encryption can be used for ________. (0.200 Point)
both confidentiality and authentication
neither confidentiality nor authentication
confidentiality
authentication
The plaintext is recovered from the ciphertext using the paired key and a ________. (0.200 Point)
digital signature
recovery encryption
decryption algorithm
encryption algorithm
The most widely used public-key cryptosystem is ________. (0.200 Point)
optimal asymmetric encryption
asymmetric encryption
RSA
DES
Public-key algorithms are based on ________. (0.200 Point)
permutation
mathematical functions
substitution
symmetry
__________ are two related keys, a public key and a private key that are used to perform complementary operations, such as encryption and decryption or signature generation and signature verification. (0.200 Point)
Asymmetric keys
Key exchanges
Symmetric keys
Cipher keys
The ________ indicates that the subscriber identified in the certificate has sole control and access to the private key. (0.200 Point)
OAEP
Public Key Certificate
Digital Signature
PKI
(0.200 Point) A __________ is a cryptographic algorithm that uses two related keys, a public key, and a private key. The two keys have the property that deriving the private key from the public key is computationally infeasible.
Private Key (Symmetric) Cryptographic Algorithm
Key Exchange Cryptographic Algorithm
Public Key (Asymmetric) Cryptographic Algorithm
RSA Digital Cryptographic Algorithm
(0.200 Point) A public-key encryption scheme has __________ ingredients.
six
four
eight
two
(0.200 Point) The key used in symmetric encryption is referred to as a __________ key.
public
secret
private
decryption
(0.200 Point) The readable message or data that is fed into the algorithm as input is the __________.
ciphertext
exchange
plaintext
encryption
(0.200 Point) Two issues to consider with the computation required to use RSA are encryption/decryption and __________.
time complexity
trap-door one-way functions
key generation
asymmetric encryption padding
(0.200 Point) __________ depend on the running time of the decryption algorithm.
Mathematical attacks
Timing attacks
Chosen ciphertext attacks
Brute-force attacks
(0.200 Point) We define the __________ of an algorithm to be f(n) if, for all n and all inputs of length n the execution of the algorithm takes at most f(n) steps. This is a common measure of the efficiency of an algorithm.
time complexity
one-way function
timing attack
OAEP
(0.200 Point) Authentication applied to all of the packet except for the IP header is __________.
tunnel mode
transport mode
association mode
security mode
(0.200 Point) __________ consists of an encapsulating header and trailer used to provide encryption or combined encryption/authentication. The current specification is RFC 4303.
SPI
ESP
ISA
IPsec
(0.200 Point) The __________ payload allows peers to identify packet flows for processing by IPsec services.
Configuration
Vendor ID
Traffic Selector
Extensible Authentication Protocol
(0.200 Point) Which technology is a primary method that IPsec uses to implement data integrity?
MD5
AES
RSA
DH
(0.200 Point) What are the source and destination addresses used for an encrypted IPsec packet?
Original sender and receiver IP addresses
Original sender’s and outbound VPN gateway’s addresses
Sending and receiving VPN gateways
Sending VPN gateway and original destination address in the packet
(0.200 Point) Which phase is used for private management traffic between the two VPN peers?
IPsec
IKE Phase 1
IKE Phase 2
IKE Phase 3
(0.200 Point) Which of the following are negotiated during IKE Phase 1?
Hashing
DH group
Encryption
Authentication method
All answer is correct
(0.200 Point) What method is used to allow two VPN peers to establish shared secret keys and to establish those keys over an untrusted network?
AES
SHA
RSA
DH
(0.200 Point) What are the two main methods for authenticating a peer as the last step of IKE Phase 1? (Choose all that apply.)
RSA signatures, using digital certificates to exchange public keys
PSK (pre-shared key)
TCP three-way handshake
DH Group 2
(0.200 Point) A customer has asked for its wireless equipment to be managed as securely as possible. Which three management protocols will provide encrypted access to the equipment? (Choose three)
Secure Shell
HTTPS
SNMPv3
SNMPv2c
HTTP
(0.200 Point) A customer has completed the installation of an 802.11ac greenfield deployment at their corporate headquarters. They would like to leverage 802.11ac enhanced speeds on the trusted employee WLAN. In order to configure the employee WLAN, what Layer 2 security policies are valid?
WPA2 (TKIP)
WPA(AES)
OPEN
WEP
(0.200 Point) An engineer wants to set up guest wireless that requires users to log in via a splash page prior to accessing the network. Which authentication method should be configured?
LDAP
RADIUS
local authentication
WebAuth
(0.200 Point) An engineer would like to setup secure authentication for a wireless network that will utilize single sign-on. Which two authentication methods can be used to accomplish this? (Choose two.)
LDAP
RADIUS
Local authentication
WEP
PSK
(0.200 Point) While undergoing a security audit, a network administrator is told to set up the WLANs with at least 128-bit encryption but also keeping the 802.11n speeds. What WLAN configuration would meet the requirements?
WPA-TKIP
Static WEP
CKIP
(0.200 Point) What Cisco Catalyst switch feature can be used to define ports as trusted for DHCP server connections?
port security
802.1x
private VLANs
(0.200 Point) Which statement about named ACLs (Access Control Lists) is true?
They support standard and extended ACLs.
They are used to filter usernames and passwords for Telnet and SSH.
They are used to filter Layer 7 traffic.
They support standard ACLs only.
They are used to rate limit traffic destined to targeted networks.
(0.200 Point) Which identification number is valid for an extended ACL?
99
100
299
64
Refer to the exhibit output of the command on R1: "R1# show access-lists" "Extended IP access list 175" "10 deny tcp any any time-range nonworkhours (active)" "20 permit tcp any any time-range nonworkhours (inactive)" Which reason for a connectivity problem to a PC behind R1 is most likely true?
The permit all ACL entry on R1 is inactive.
The ACL of R1 is misconfigured.
A deny all ACL entry is currently active on R1.
An implicit deny is causing R1 to block network traffic.
When troubleshooting an ACL issue on a router, which command helps you verify which interfaces are affected by the ACL?
show ip access-lists
show access-lists
show interface
show ip interface
A network administrator is configuring ACLs on a Cisco router to allow traffic from hosts on networks 192.168.146.0, 192.168.147.0, 192.168.148.0, and 192.168.149.0 only. Which two ACL statements, when combined, are best for accomplishing this task? Choose two.
access-list 10 permit ip 192.168.146.0 0.0.1.255
access-list 10 permit ip 192.168.147.0 0.0.255.255
access-list 10 permit ip 192.168.148.0 0.0.1.255
access-list 10 permit ip 192.168.149.0 0.0.255.255
In which solution is a router ACL used?
filtering packets that are passing through a router
to change the default administrative distance of a route in the route table
protecting a server from unauthorized access
controlling path selection, based on the route metric
Which IPsec security protocol should be used when confidentiality is required?
MD5
PSK
AH
ESP
A network administrator needs to configure port security on a switch. Which two statements are true? Choose two.
The network administrator can apply port security to dynamic access ports.
The network administrator can apply port security to EtherChannels.
When dynamic MAC address learning is enabled on an interface, the switch can learn new addresses, up to the maximum defined.
The sticky learning feature allows the addition of dynamically learned addresses to the running configuration.
On which options are standard access lists based?
destination address and wildcard mask
destination address and subnet mask
source address and subnet mask
source address and wildcard mask
Which component of VPN technology ensures that data is unaltered between the sender and recipient?
encryption
authentication
key exchange
data integrity
How does using the service password-encryption command on a router provide additional security?
by encrypting all passwords passing through the router
by encrypting passwords in the plain text configuration file
by requiring entry of encrypted passwords for access to the device
by configuring an MD5 encrypted key to be used by routing protocols to validate routing exchanges
When are packets processed by an inbound access list?
before they are routed to an outbound interface
after they are routed to an outbound interface
before and after they are routed to an outbound interface
after they are routed to an outbound interface but before being placed in the outbound queue
The company internetwork is subnetted using 29 bits. Which wildcard mask should be used to configure an extended access list to permit or deny access to an entire subnetwork?
255.255.255.224
255.255.255.248
0.0.0.224
0.0.0.8
0.0.0.7
What are three valid reasons to assign ports to VLANs on a switch? Choose three.
to isolate broadcast traffic
to allow more devices to connect to the network
to logically group hosts according to function
to increase network security
Which protocol should be used to establish a secure terminal connection to a remote network device?
SSH
Telnet
WEP
SNMPv1
SNMPv2
What three pieces of information can be used in an extended access list to filter traffic? Choose three.
protocol
TCP or UDP port numbers
source IP address and destination IP address
source MAC address and destination MAC address
source switch port number
Which command is necessary to permit SSH or Telnet access to a Cisco switch that is otherwise configured for these vty line protocols?
transport output all
transport preferred all
transport type all
transport input all
What features can protect the data plane? Choose three.
policing
ACLs
IPS
DHCP-snooping
QoS
Which statement is true regarding a stateless packetfiltering firewall? Select the best answer.
It can operate at Layer 4 of the OSI model.
It is more secure than a stateful packetfiltering firewall.
It tracks packets as a part of a stream.
It is not susceptible to IP spoofing attacks.
Which of the following statements is true of all firewalls? Select the best answer.
They maintain a state table.
They hide the source of network connections.
They operate at Layer 7 of the OSI model.
They are multihomed devices.
Which feature can validate address requests and filter out invalid messages?
port security
IP Source Guard
dynamic ARP inspection
A network administrator needs to configure port security on a switch. Which two statements are true? (Choose two)
The network administrator can apply port security to dynamic access ports.
The network administrator can apply port security to EtherChannels.
When dynamic MAC address learning is enabled on an interface, the switch can learn new addresses, up to the maximum defined.
The sticky learning feature allows the addition of dynamically learned addresses to the running configuration.
What are three reasons that an organization with multiple branch offices and roaming users might implement a Cisco VPN solution instead of point-to-point WAN links? (Choose three.)
reduced cost
broadband incompatibility
increased security
scalability
reduced latency
Which feature can you use to monitor traffic on a switch by replicating it to another port or ports on the same switch?
copy run start
traceroute
the ICMP Echo IP SLA
SPAN
Which keywords can be substituted for access list wildcards while configuring access lists? (Choose two.)
all
any
host
range
subnet
Which IEEE mechanism is responsible for the authentication of devices when they attempt to connect to a local network?
802.1x
802.11
802.2x
802.3x
Where does a switch maintain DHCP snooping information ?
in the MAC address table
in the CAM table
in the DHCP binding database
in the VLAN database
Which command can you enter in a network switch configuration so that learned mac addresses are saved in configuration as they connect?
Switch(confg-if)#Switch port-security
Switch(confg-if)#Switch port-security Mac-address sticky
Switch(confg-if)#Switch port-security maximum 10
Switch(confg-if)#Switch mode access
Which two security appliances will you use in a network? (Choose two.)
ATM
IDS
IOS
IPS
SDM
Which one of the following follows best practices for a secure password?
ABC123!
SlE3peR1#
tough-passfraze
InterEstIng-PaSsWoRd
