<\/p>\n
A. OR A. 56<\/strong> A. Simple Security Property – a subject at a given security level may not read an object at a higher security level. A. IDEA – International Data Encryption Algorithm. (Cracked in 2011) Keyword: ‘Symmetric’<\/p>\n A. TCSEC (The Trusted Computer System Evaluation Criteria aka Orange Book) American A. The function must work on a fixed length input. (Requires a fixed length output!)<\/strong> https:\/\/en.wikipedia.org\/wiki\/Cryptographic_hash_function<\/a><\/p>\n A. 10 A. Security through obscurity – The presumption that “nobody will ever find it”. <\/p>\n (Chapter 10, pg 423)<\/p>\n A. Mantrap – a small space with two sets of interlocking doors, such that the first set of doors must close before the second set opens.<\/strong> <\/p>\n C10, p406<\/p>\n A. Place only in areas monitored by security guards.<\/strong> <\/p>\n A. Simple Security Property – A subject at a given security level may not read an object at a higher security level. (No read up) Key: Integrity Principle writing to a higher clearance level.<\/p>\n <\/p>\n 1. Time of check A. A method used to pass information over a path not normally used for communication Answers<\/p>\n 1 – C <\/p>\n A. 1 In the Fair Cryptosystems approach to key escrow, the secret keys used in communications are divided into two or more pieces, each of which is given to an independent third party.<\/p>\n <\/p>\n
\nB. AND
\nC. XOR<\/strong>
\nD. NOR<\/p>\n<\/h4>\n
26. How many bits of keying material does the Data Encryption Standard (DES) use for encrypting information?<\/h4>\n
\nB. 64
\nC. 128
\nD. 256<\/p>\n\n
<\/h4>\n
27. In the figure shown here, Harry’s request to write to the data file is blocked.\u00a0 Harry has a Secret security clearance, and the data file has a Confidential classification.\u00a0 What principle of the Bell-LaPadula model blocked hist request?<\/h4>\n
\nB. Simple Integrity Property – Biba: a subject at one level of integrity is not permitted to read an object of lower integrity.
\nC. *-Security Property – a subject at a given security level may not write to any object at a lower security level.<\/strong>
\nD. Discretionary Security Property – Uses an Access Matrix (therefore, discretionary)<\/p>\n\n
<\/h4>\n
28. Florian and Tobias would like to begin communicating using a symmetric cryptosystem, but they have no prearranged secrey and are not able to meet in person to exchange keys.\u00a0 What algorithm can they use to securely exchange the secret key?<\/h4>\n
\nB. Diffie-Hellman – A system of creating a shared key without reveling your key<\/strong>
\nC. RSA – Rivest\u2013Shamir\u2013Adleman- One key to encrypt, another to decrypt.
\nD. MD5 – (Message Digest 5)Hashing system for file integrity.<\/p>\n<\/h4>\n
29. Under the Common Criteria, what element describes the security requirements for a product?<\/h4>\n
\nB. ITSEC (Information Technology Security Evaluation Criteria) European structured set of criteria for evaluating computer security within products and systems.
\nC. PP (Protection Profile) A PP allows security requirements to be expressed using a template in an implementation-independent way, and is thus reusable.
\nD. ST (Security Target) contains a set of security requirements that can be stated explicitly. An ST includes detailed product-specific information. It can be viewed as a refinement of the PP, and forms the agreed-upon basis for evaluation.<\/strong><\/p>\n<\/h4>\n
30. Which one of the following is not one of the basic requirements for a cryptographic hash function?<\/h4>\n
\nB. The function must be relatively easy to compute for any input.
\nC. The function must be one way. (Difficult to find the input based on the output)
\nD. The Function must be collision free. (Difficult to define two inputs that produce the same output.)<\/p>\n<\/h4>\n
31. How many possible keys exist for a cipher that uses a key containing 5 bits?<\/h4>\n
\nB. 16
\nC. 32 25<\/sup> = 32<\/strong>
\nD. 64<\/p>\n<\/h4>\n
32. What cryptographic principle stands behind the idea that cryptographic algorithms should be open to public inspection?<\/h4>\n
\nB. Kerckhoffs’ principle – A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.<\/strong>
\nC. Defense in depth – (aka Castle Approach<\/b>) is a concept in which multiple layers of security controls (defense) are placed throughout a system.
\nH. Heisenburg principle – You cannot have complete security and privacy at the same time.\u00a0 If we allow our employees to encrypt their email, we cannot ensure that no confidential information is communicated to untrusted parties at the same time.\u00a0 If you ‘peek’ at the emails to ensure security, you’ve lost privacy.<\/p>\n33. Referring to the figure shown here, what is the name of the security control indicated by the arrow?<\/h4>\n
\nB. Turnstyle – a post with arms pivoted on the top set in a passageway so that persons can pass through only on foot one by one<\/span><\/span><\/span>.
\nC. Intrusion Prevention System – A network security\/threat prevention technology that examines network traffic flows to detect and prevent vulnerability exploits.
\nD. Portal – a set of two interlocking doors where the first set of doors opens before the second set, causing the user to be contained in an enclosed area temporarily. The user must provide valid authorization to pass through the first set of doors into the portal, and may be required to provide secondary authorization credentials (often biometric) to pass through the second set of doors<\/p>\n34. Which one of the following does not describe a standard physical security requirement for wiring closets?<\/h4>\n
\nB. Do not store flammable items in the closet. True
\nC. Use sensors on doors to log entries. True
\nD. Perform regular inspections of the closet. True<\/p>\n35. In the figure shown here, Sally is blocked from writing to the data file by the Biba integrity model.\u00a0 Sally has a Secret security clearance and the file is classified Top Secret.\u00a0 What principle is preventing her from writing to the file?<\/h4>\n
\nB. Simple Integrity Property – A subject at one level of integrity is not permitted to read an object of lower integrity. (No read down)
\nC. *-Security Property – A subject at a given security level may not write to any object at a lower security level. (No write down)
\nD. *-Integrity Property – A subject at a given level of integrity must not write to data at a higher level of integrity (no write up)<\/strong><\/p>\n36. Match each of these following numbered architecture security concepts with the appropriate lettered description:<\/h4>\n
\n2. Covert channel
\n3. Time of use
\n4. Maintenance hooks
\n5. Parameter checking
\n6. Race condition<\/p>\n
\nB. The exploitation of the difference between time of check and time of use.
\nC. The time at which the subject checks whether an object is available
\nD. The time at which a subject can access an object
\nE. An access method known only to the developer of the system.
\nF. A method that can help prevent buffer overflow attacks<\/p>\n
\n2 – A
\n3 – D
\n4 – E
\n5 – F
\n6 – B<\/p>\n37. What is the minimum number of independent parties necessary to implement the Fair Cryptosystems approach to key escrow?<\/h4>\n
\nB. 2<\/strong>
\nC. 3
\nD. 4<\/p>\n38. In what state does a processor’s scheduler place a process when it is prepared to execute but the CPU is not currently available?<\/h4>\n
![\"\"](\"http:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/software-instruction-states.png\")
<\/a><\/p>\n![\"\"](\"http:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Screenshot-from-2020-03-21-13-29-37.png\")
<\/a><\/p>\n