1. Question
What are three type of attacks that are preventable through the use of salting? (Choose three.) Select one or more:
- reverse lookup tables
- shoulder surfing
- phishing
- lookup tables
- guessing
- social engineering
- rainbow tables
Explanation:
Salting makes precomputed tables ineffective because of the random string that is used.
2. Question
A user is connecting to an e-commerce server to buy some widgets for a company. The user connects to the site and notices there is no lock in the browser security status bar. The site does prompt for a username and password and the user is able to log in. What is the danger in proceeding with this transaction? Select one:
- The certificate from the site has expired, but is still secure.
- The user is using the wrong browser to perform the transaction.
- Ad blocker software is preventing the security bar from working properly, and thus there is no
- danger with the transaction.
- The site is not using a digital certificate to secure the transaction, with the result that everything is in the clear.
Explanation:
The lock in the browser window ensures a secure connection is being established and is not blocked by browser addons.
3. Question
What is a strength of using a hashing function? Select one:
- It has a variable length output.
- It can take only a fixed length message.
- It is a one-way function and not reversible.
- It is not commonly used in security.
- Two different files can be created that have the same output.
Explanation:
Understanding the properties of a hash function shows its applicability such as one-way function, arbitrary input length, and fixed output.
4. Question
A user downloads an updated driver for a video card from a website. A warning message pops up saying the driver is not approved. What does this piece of software lack? Select one:
- code recognition
- digital signature
- source code
- valid ID
Explanation:
Code signing is a method of verifying code integrity.
- Question
A user is evaluating the security infrastructure of a company and notices that some authentication systems are not using best practices when it comes to storing passwords. The user is able to crack passwords very fast and access sensitive data. The user wants to present a recommendation to the company on the proper implementation of salting to avoid password cracking techniques. What are three best practices in implementing salting? (Choose three.) Select one or more:
- Salts should be short.
- A salt should not be reused.
- Salts are not an effective best practice.
- A salt must be unique.
- A salt should be unique for each password.
- The same salt should be used for each password.
Explanation:
Salting needs to be unique and not reused. Doing the opposite will cause passwords to be cracked easily.
6. Question
What is the step by step process for creating a digital signature? Select one:
- Create a message digest; encrypt the digest with the public key of the sender; and bundle the message, encrypted digest, and public key together to sign the document.
- Create a message digest; encrypt the digest with the private key of the sender; and bundle the message, encrypted digest, and public key together in order to sign the document.
- Create a message; encrypt the message with a MD5 hash; and send the bundle with a public key.
- Create a SHA-1 hash; encrypt the hash with the private key of the sender; and bundle the message, encrypted hash, and public key together to signed document.
Explanation:
In order to create a digital signature, the following steps must be taken:
i. The message and message digest are created.
ii. The digest and private key are encrypted.
ii. The message, encrypted message digest, and public key are bundled to create the signed document.
7. Question
A recent breach at a company was traced to the ability of a hacker to access the corporate database through the company website by using malformed data in the login form. What is the problem with the company website? Select one:
- weak encryption
- poor input validation
- lack of operating system patching
- bad usernames
Explanation:
The ability to pass malformed data through a website is a form of poor input validation.
8. Question
A user is the database administrator for a company. The user has been asked to implement an integrity rule that states every table ‹must have a primary key and that the column or columns chosen to be the primary key must be unique and not null. Which integrity requirement is the user implementing? Select one:
- anomaly integrity
- domain integrity
- entity integrity
- referential integrity
Explanation:
There are three major database integrity requirements: entity, referential, and domain integrity.
9. Question
An investigator finds a USB drive at a crime scene and wants to present it as evidence in court. The investigator takes the USB drive and creates a forensic image of it and takes a hash of both the original USB device and the image that was created. What is the investigator attempting to prove about the USB drive when the evidence is submitted in court? Select one:
- The investigator found a USB drive and was able to make a copy of it.
- The data is all there.
- An exact copy cannot be made of a device.
- The data in the image is an exact copy and nothing has been altered by the process.
Explanation:
A hash function ensures the integrity of a program, file, or device.
10. Question
Which method tries all possible passwords until a match is found? Select one:
- birthday
- rainbow tables
- brute force
- dictionary
- cloud
- cryptographic
Explanation:
Two common methods of cracking hashes are dictionary and brute force. Given time, the brute force method will always crack a password.
11. Question
A user has created a new program and wants to distribute it to everyone in the company. The user wants to ensure that when the program is downloaded that the program is not changed while in transit. What can the user do to ensure that the program is not changed when downloaded? Select one:
- Distribute the program on a thumb drive.
- Turn off antivirus on all the computers.
- Install the program on individual computers.
- Create a hash of the program file that can be used to verify the integrity of the file after it is downloaded.
- Encrypt the program and require a password after it is downloaded.
Explanation:
Hashing is a method to ensure integrity and ensures that the data is not changed.
12. Question
What is the standard for a public key infrastructure to manage digital certificates? Select one:
- x.503
- x.509
- PKI
- NIST-SP800
Explanation:
The x.509 standard is for a PKI infrastructure and x.500 if for directory structures.
13. Question
What are three NIST-approved digital signature algorithms? (Choose three.) Select one or more:
- MD5
- RSA
- ECDSA
- SHA256
- DSA
- SHA1
Explanation:
NIST chooses approved algorithms based on public key techniques and ECC. The digital signature
algorithms approved are DSA, RSA, and ECDSA.
14. Question
A recent email sent throughout the company stated that there would be a change in security policy. The security officer who was presumed to have sent the message stated the message was not sent from the security office and the company may be a victim of a spoofed email. What could have been added to the message to ensure the message actually came from the person? Select one:
- asymmetric key
- hashing
- digital signature
- non-repudiation
Explanation:
Digital signatures ensures non-repudiation or the ability not to deny that a specific person sent a message.
15. Question
Alice and Bob use the same password to login into the company network. This means both would have the exact same hash for their passwords. What could be implemented to prevent both password hashes from being the same? Select one:
- pseudo-random generator
- RSA
- salting
- peppering
Explanation:
A password is stored as a combination of both a hash and a salt.
16. Question
Identify three situations in which the hashing function can be applied. (Choose three.) Select one or more:
- CHAP
- DES
- PKI
- WPA
- PPoE
- IPsec
Explanation:
Three situations where a hash function could be used are as follows:
• When IPsec is being used
• When routing authentication is enabled
• In challenge responses within protocols such as PPP CHAP
• Within digitally signed contracts and PKI certificates
17. Question
A user has been asked to implement IPsec for inbound external connections. The user plans to use SHA-1 as part of the implementation. The user wants to ensure the integrity and authenticity of the connection. What security tool can the user use? Select one:
- HMAC
- ISAKMP
- SHA256
- MD5
Explanation:
HMAC provides the additional feature of a secret key to ensure integrity and authentication.
18. Question
What is the purpose of CSPRNG? Select one:
- to prevent a computer from being a zombie
- to process hash lookups
- to secure a web site
- to generate salt
Explanation:
Salting prevents someone from using a dictionary attack to guess a password. Cryptographically
Secure Pseudo-Random Number Generator (CSPRNG) is one way (and the best way) to generate salt.
19. Question
A user is instructed by a boss to find a better method to secure passwords in transit. The user has researched several means to do so and has settled on using HMAC. What are the key elements needed to implement HMAC? Select one:
- symmetric key and asymmetric key
- secret key and message digest
- message digest and asymmetric key
- IPsec and checksum
Explanation:
HMAC implementation is a secret key added to a hash.
20. Question
What are three validation criteria used for a validation rule? (Choose three.) Select one or more:
- key
- encryption
- size
- format
- type
- range
Explanation:
Criteria used in a validation rule include format, consistency, range, and check digit.