Module 2 ITN 262 QUIZ chapter 6
Bob lives at home during the summer. His little brother, Tom, is fascinated by computers and with everything his big brother does. Tom loves to watch Bob log in to his summer job's remote site and do things. Tom often goes into Bob's room and looks through his things. Given this, which authentication technique—by itself—resists the risk of Tom masquerading as Bob?
A memorized, hard-to-guess password
Which of the following most effectively resists a trial-and-error guessing attack? All sizes are in terms of decimal digits.
A passive authentication token with a 9-digit base secret
We need to create a three-factor authentication system. The system already requires the user's fingerprint and memorized password. Which of the following can we add to implement three separate factors?
A procedure that requires the user's cell phone
We need to create a three-factor authentication system. The system already uses a USB device that is unlocked with the user's fingerprint. Which of the following can we add to implement three separate factors?
A process that requires the user's cell phone
What does authentication do?
Associates an individual with an identity
Kevin wants to attack Bob's computing resources. He is motivated at the "stealth" level. Which of the following attacks might Bob face? Select all that apply.
Borrow Bob's one-time password token Search for written copies of Bob's passwords
We are trying to protect a household computer. We have implemented password-based authentication to protect sensitive data. Which levels of attacker motivation can this authentication typically protect against in this situation? Select all that apply.
No motivation Scant motivation Stealth motivation
There are three types of tokens; which of the following is not a correct type?
Offensive tokens
The phrases below describe types of tokens. Match the type of token with its description.
One-time password token: Transmits different credentials based on an internal clock or counter Passive token: Transmits the same credential every time Challenge-response token: Transmits credentials that vary according to an unpredictable challenge from the computer
In a password system, the total number of possible passwords is called the:
Search space
Are base secrets the same as credentials?
Some base secrets are also credentials, while others are not.
The phrases below describe types of authentication factors. Match the type of authentication factor with its description.
Something you are : Biometric measurement Something you know: Memorized information like a password Something you have: An object containing a base secret, like the magnetic stripe on a cash card
True or False? Biometrics and tokens are a good choice for a household environment.
False
True or False? Biometrics are a favored form of authentication, as they are immune to sniffing attacks.
False
True or False? Biometrics have a fault tolerance of 0.
False
True or False? Entropy refers to the strength of a password system.
False
True or False? Offline attacks are easily detected.
False
True or False? Passive tokens are favored, as they are immune to sniffing attacks.
False
True or False? SHA-1024 is the latest hash algorithm.
False
True or False? True randomness is easily achieved with the random function of an application like Excel.
False
True or False? Two factor authentication is using two passwords
False
True or False? USB tokens are weak because if the public key becomes lost or stolen, the private key can be derived from it.
False
True or False? When selecting a password, random collections of letters contain far less entropy than written words.
False
True or False? When you are biased in selecting a password, you choose your password from the entire search space.
False
True or False? Your fingerprint is a "something you have" factor.
False
Biometric scanners are often connected by ________; this poses a security risk, as sniffed credentials can be fed down this line.
Tokens
Section 6.1.2 describes doorknob-rattling attacks. This is most similar to which of the following attacks?
Trial and error
True or False? A strong threat is willing to spend money, but not willing to leave evidence.
True
True or False? Authentication associates an individual with an identity.
True
In a password system, increasing the work factor results in which of the following? Select all that apply.
Increases the size of the character set from which users choose passwords Increases the length of the password
True or False? Credit reports are a treasured target among identity thieves.
True
True or False? Dictionary attacks differ from trial and error attacks because dictionary attacks focus on likely passwords.
True
True or False? Keyloggers can be hardware or software based.
True
True or False? Low-hanging fruit refers to the easiest targets in an attack.
True
True or False? Never choose a password with a strong personal association.
True
True or False? The one-way hash is a cryptographic function.
True
True or False? When an attacker is attacking a password system, the average attack space estimates the number of guesses required before success is likely.
True
True or False? When the fault tolerance goes up, so do the false positives.
True
True or False? Average attack space measures the time until success is certain.
false
An extreme threat is _________ motivated and is _________ to leave evidence.
highly, willing
The average attack space estimates the number of guesses required before success is ________.
likely
The following are fundamental strategies for authenticating people on computer systems, except:
something you make.
An authentication system that requires the user to provide two different passwords and a fingerprint scan is an example of:
two-factor authentication.
An attack that blocks access to a system by other users is called:
denial of service.
Which of the following authentication techniques are vulnerable to sniffing attacks that replay the sniffed credential? Select all that apply.
Biometric readers Passwords Passive tokens
Here is a list of features of various authentication tokens. Indicate all that are true for one-time password tokens.
The authentication credential and the base secret are always identical. Some tokens use a built-in counter to generate nonces. Some tokens use a built-in clock to generate nonces.