CISSP Cram Test Questions: Domain 7 - Security Engineering
The Data Encryption Standard (DES) encryption algorithm has which of the following characteristics?
64 bit blocks with a 64 bit total key length
What key size is used by the Clipper Chip?
80 bits
PGP uses which of the following to encrypt data?
A symmetric encryption algorithm
Readable is to unreadable just as plain text is to _____?
Cipher Text
The Diffie-Hellman algorithm is used for:
Key agreement
What can be defined as an instance of two different keys generating the same ciphertext from the same plaintext?
Key clustering
Brute force attacks against encryption keys have increased in potency because of increased computing power. Which of the following is often considered a good protection against the brute force cryptography attack?
The use of session keys.
Secure Sockets Layer (SSL) uses a Message Authentication Code (MAC) for what purpose?
message integrity.
What is the key size of the International Data Encryption Algorithm (IDEA)?
128 bits
What is the length of an MD5 message digest?
128 bits
What size is an MD5 message digest (hash)?
128 bits
How many rounds are used by DES?
16
The Data Encryption Algorithm performs how many rounds of substitution and permutation?
16
What is the maximum key size for the RC5 algorithm?
2040 bits
What is the maximum allowable key size of the Rijndael encryption algorithm?
256 bits
What is the maximum number of different keys that can be used when encrypting with Triple DES?
3
How many bits is the effective length of the key of the Data Encryption Standard algorithm?
56
What is the effective key size of DES?
56 bits
What can be defined as a value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity?
A digital signature
What is a characteristic of using the Electronic Code Book mode of DES encryption?
A given block of plaintext and a given key will always produce the same ciphertext.
Which of the following can best be defined as a cryptanalysis techniQue in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs?
A known-plaintext attack
What is the RESULT of a hash algorithm being applied to a message?
A message digest
Which of the following binds a subject name to a public key value?
A public key infrastructure
Which of the following statements pertaining to stream ciphers is correct?
A stream cipher generates what is called a keystream.
which of the following example is NOT an asymmetric key algorithms?
Advanced Encryption Standard(AES)
What can be defined as a digital certificate that binds a set of descriptive data items, other than a public key, either directly to a subject name or to the identifier of another certificate that is a public-key certificate?
An attribute certificate
The RSA algorithm is an example of what type of cryptography?
Asymmetric Key.
Which of the following protocols that provide integrity and authentication for IPSec, can also provide nonrepudiation in IPSec?
Authentication Header (AH)
What can be defined as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire?
Authority revocation list
Which type of attack is based on the probability of two different messages using the same hash function producing a common message digest?
Birthday attack
Which of the following was not designed to be a proprietary encryption algorithm?
Blowfish
Which of the following concerning the Rijndael block cipher algorithm is false?
Both block size and key length can be extended to multiples of 64 bits.
Which of the following is NOT true of Secure Sockets Layer (SSL)?
By convention it uses 's-http://' instead of 'http://'.
Which is NOT a suitable method for distributing certificate revocation information?
CA revocation mailing list
What is NOT an authentication method within IKE and IPsec?
CHAP
In a PKI infrastructure where are list of revoked certificates stored?
CRL
Which of the following ciphers is a subset on which the Vigenere polyalphabetic cipher was based on?
Caesar
Who vouches for the binding between the data items in a digital certificate?
Certification authority
This type of attack is generally most applicable to public-key cryptosystems, what type of attack am I?
Chosen-Ciphertext attack
In what type of attack does an attacker try, from several encrypted messages, to figure out the key used in the encryption process?
Ciphertext-only attack
Complete the following sentence. A message can be encrypted, which provides __________
Confidentiality
There are basic goals of Cryptography. Which of the following most benefits from the process of encryption?
Confidentiality
Which of the following is best provided by symmetric cryptography?
Confidentiality
A message can be encrypted and digitally signed, which provides _______________
Confidentiality, Authentication, Non-repudiation, and Integrity.
What is the primary role of cross certification?
Creating trust between different PKIs
What enables users to validate each other's certificate when they are certified under different certification hierarchies?
Cross-certification
Which of the following does NOT concern itself with key management?
Cryptology (CRYPTO)
Which of the following is the most secure form of triple-DES encryption?
DES-EDE3
Which of the following is NOT a true statement regarding the implementaton of the 3DES modes?
DES-EEE1 uses one key
Which of the following is NOT an asymmetric key algorithm?
Data Encryption System (DES)
A code, as is pertains to cryptography:
Deals with linguistic units.
Cryptography does NOT help in:
Detecting fraudulent disclosure.
Which one of the following is a key agreement protocol used to enable two entities to agree and generate a session key (secret key used for one session) over an insecure medium without any prior secrets or communications between the entities? The negotiated key will subsequently be used for message encryption using Symmetric Cryptography.
Diffie_Hellmann
Which of the following is NOT a symmetric key algorithm?
Digital Signature Standard (DSS)
What is used to bind a document to its creation at a particular time?
Digital Timestamp
Which of the following can be best defined as computing techniQues for inseparably embedding unobtrusive marks or labels as bits in digital data and for detecting or extracting the marks later?
Digital watermarking
What attribute is included in a X.509-certificate?
Distinguished name of the subject
Which encryption algorithm is BEST suited for communication with handheld wireless devices?
ECC (Elliptic Curve Cryptosystem)
In which mode of DES, a block of plaintext and a key will always give the same ciphertext?
Electronic Code Book (ECB)
Which of the following modes of DES is MOST Likely used for Database Encryption
Electronic Code Book(ECB)
Which of the following is true about digital certificate?
Electronic credential proving that the person the certificate was issued to is who they claim to be
Which type of algorithm is considered to have the highest strength per bit of key length of any of the asymmetric algorithms?
Elliptic Curve Cryptography (ECC)
Which of the following is true about link encryption?
Encrypted messages are only decrypted by the final node.
Which of the following services is NOT provided by the digital signature standard (DSS)?
Encryption
Which of the following would best describe a Concealment cipher?
Every X number of words within a text, is a part of the real message.
What is this cryptographic operation called?
Exclusive-OR
FIPS-140 is a standard for the security of which of the following?
Hardware and software cryptographic modules
You've decided to authenticate the source who initiated a particular transfer while ensuring integrity of the data being transferred. You can do this by:
Having the sender encrypt the hash with his private key.
What kind of Encryption technology does SSL utilize?
Hybrid (both Symmetric and Asymmetric)
Which of the following algorithms is used today for encryption in PGP?
IDEA
Which of the following protocols offers native encryption?
IPSEC, SSH, SSL, TLS
Which of the following are suitable protocols for securing VPN connections at the lower layers of the OSI model?
IPsec and L2TP
Which of the following statements pertaining to link encryption is false?
Information stays encrypted from one end of its journey to the other.
Which of the following is not a DES mode of operation?
Input feedback
A one-way hash provides which of the following?
Integrity
What are the three most important functions that Digital Signatures perform?
Integrity, Authentication and Nonrepudiation
What is the name of the protocol use to set up and manage Security Associations (SA) for IP Security (IPSec)?
Internet Key Exchange (IKE)
Which of the following elements is NOT included in a Public Key Infrastructure (PKI)?
Internet Key Exchange (IKE)
Which of the following is defined as an Internet, IPsec, key-establishment protocol, partly based on OAKLEY, that is intended for putting in place authenticated keying material for use with ISAKMP and for other security associations?
Internet Key exchange (IKE)
Which of the following is an Internet IPsec protocol to negotiate, establish, modify, and delete security associations, and to exchange key generation and authentication data, independent of the details of any specific key generation techniQue, key establishment protocol, encryption algorithm, or authentication mechanism?
Internet Security Association and Key Management Protocol (ISAKMP)
Which of the following is NOT a property of a one-way hash function?
It converts a message of a fixed length into a message digest of arbitrary length.
Compared to RSA, which of the following is true of Elliptic Curve Cryptography(ECC)?
It is believed to require shorter keys for equivalent security.
Which of the following is not a property of the Rijndael block cipher algorithm?
It operates on 64-bit plaintext blocks and uses a 128 bit key.
The primary purpose for using one-way hashing of user passwords within a password file is which of the following?
It prevents an unauthorized person from reading the password.
What is NOT true about a one-way hashing function?
It provides authentication of the message
Which of the following statements is true about data encryption as a method of protecting data?
It requires careful key management
What is the main problem of the renewal of a root CA certificate?
It requires the authentic distribution of the new root CA certificate to all PKI participants
The Diffie-Hellman algorithm is primarily used to provide which of the following?
Key Agreement
The Clipper Chip utilizes which concept in public key cryptography?
Key Escrow
Which of the following can best be defined as a key recovery techniQue for storing knowledge of a cryptographic key by encrypting it with another key and ensuring that that only certain third parties can perform the decryption operation to retrieve the stored key?
Key encapsulation
Which of the following is less likely to be used today in creating a Virtual Private Network?
L2F
What level of assurance for a digital certificate verifies a user's name, address, social security number, and other information against a credit bureau database?
Level 2/Class 2
What algorithm was DES derived from?
Lucifer.
Which key agreement scheme uses implicit signatures ?
MQV
Which of the following is NOT a property of the Rijndael block cipher algorithm?
Maximum key size is 512 bits
Which of the following was developed in order to protect against fraud in electronic fund transfers (EFT) by ensuring the message comes from its claimed originator and that it has not been altered in transmission?
Message Authentication Code (MAC)
Which of the following BEST describes a function relying on a shared secret key that is used along with a hashing algorithm to verify the integrity of the communication content as well as the sender?
Message Authentication Code - MAC
The eQuation used to calculate the total number of symmetric keys (K) needed for a group of users (N) to communicate securely with each other is given by which of the following?
N(N 1)/ 2
What is NOT true with pre shared key authentication within IKE / IPsec protocol?
Needs a Public Key Infrastructure (PKI) to work
What does the directive of the European Union on Electronic Signatures deal with?
Non repudiation
You find that a threat was sent from one user to the other in a digitally signed email. The sender of the threat says he didn't send the email in Question. What concept of PKI - Public Key Infrastructure will implicate the sender?
Non-repudiation
Virus scanning and content inspection of SMIME encrypted e-mail without doing any further processing is:
Not possible
Which of the following is defined as a key establishment protocol based on the Diffie-Hellman algorithm proposed for IPsec but superseded by IKE?
OAKLEY
Which type of encryption is considered to be unbreakable if the stream is truly random and is as large as the plaintext and never reused in whole or part?
One Time Pad (OTP)
What uses a key of the same length as the message where each bit or character from the plaintext is encrypted by a modular addition?
One-time pad
Which of the following encryption methods is known to be unbreakable?
One-time pads.
What is the name of a one way transformation of a string of characters into a usually shorter fixed-length value or key that represents the original string? Such a transformation cannot be reversed?
One-way hash
Which of the following choices is a valid Public Key Cryptography Standard (PKCS) addressing RSA?
PKCS#1
Which of the following statements pertaining to PPTP (Point-to-Point Tunneling Protocol) is incorrect?
PPTP is derived from L2TP.
While using IPsec, the ESP and AH protocols both provides integrity services. However when using AH, some special attention needs to be paid if one of the peers uses NAT for address translation service. Which of the items below would affects the use of AH and it´s Integrity Check Value (ICV) the most?
Packet Header Source or Destination address
In which phase of Internet Key Exchange (IKE) protocol is peer authentication performed?
Phase 1
Which of the following statements pertaining to block ciphers is incorrect?
Plain text is encrypted with a public key and decrypted with a private key.
Which of the following is best at defeating frequency analysis?
Polyalphabetic cipher
Complete the blanks. When using PKI, I digitally sign a message using my ______ key. The recipient verifies my signature using my ______ key.
Private / Public
What type of key would you find within a browser's list of trusted root CA?
Public key
What kind of encryption is realized in the S/MIME-standard?
Public key based, hybrid encryption scheme
What kind of certificate is used to validate a user identity?
Public key certificate
Which of the following algorithms does NOT provide hashing?
RC4
Which of the following algorithms is a stream cipher?
RC4
Which of the following is not a one-way hashing algorithm?
RC4
Which of the following is not an example of a block cipher?
RC4
Which of the following is a symmetric encryption algorithm?
RC5
What is the name for a substitution cipher that shifts the alphabet by 13 places?
ROT13 cipher
A public key algorithm that does both encryption and digital signature is which of the following?
RSA
Which of the following ASYMMETRIC encryption algorithms is based on the difficulty of FACTORING LARGE NUMBERS?
RSA
Which of the following encryption algorithms does not deal with discrete logarithms?
RSA
Which of the following service is not provided by a public key infrastructure (PKI)?
Reliability
What algorithm has been selected as the AES algorithm, replacing the DES algorithm?
Rijndael
Which of the following identifies the encryption algorithm selected by NIST for the new Advanced Encryption Standard?
Rijndael
Which protocol makes USE of an electronic wallet on a customer's PC and sends encrypted credit card information to merchant's Web server, which digitally signs it and sends it on to its processing bank?
SET (Secure Electronic Transaction)
which of the following is a Hashing Algorithm?
SHA
Which of the following is not an encryption algorithm?
SHA-1
Which of the following should be used as a replacement for Telnet for secure remote login over an insecure network?
SSH
Which of the following protocols would BEST mitigate threats of sniffing attacks on web application traffic?
SSL or TLS
The DES algorithm is an example of what type of cryptography?
Secret Key
Kerberos depends upon what encryption method?
Secret Key cryptography.
Which of the following is a cryptographic protocol and infrastructure developed to send encrypted credit card numbers over the Internet?
Secure Electronic Transaction (SET)
Which of the following keys has the SHORTEST lifespan?
Session key
Which of the following is NOT a known type of Message Authentication Code (MAC)?
Signature-based MAC (SMAC)
Which of the following can best be defined as a key distribution protocol that uses hybrid encryption to convey session keys. This protocol establishes a long-term key once, and then reQuires no prior communication in order to establish or exchange keys on a session-by-session basis?
Simple Key-management for Internet Protocols (SKIP)
Which of the following is not a disadvantage of symmetric cryptography when compared with Asymmetric Ciphers?
Speed
What principle focuses on the uniqueness of separate objects that must be joined together to perform a task? It is sometimes referred to as "what each must bring" and joined together when getting access or decrypting a file. Each of which does not reveal the other?
Split knowledge
What can be defined as secret communications where the very existence of the message is hidden?
Steganography
Which of the following terms can be described as the process to conceal data into another file or media in a practice known as security through obscurity?
Steganography
Which of the following is more suitable for a hardware implementation?
Stream ciphers
Which of the following type of cryptography is used when both parties use the same key to communicate securely with each other?
Symmetric Key Cryptography
Which answer BEST describes a secure cryptoprocessor that can be used to store cryptographic keys, passwords or certificates in a component located on the motherboard of a computer?
TPM - Trusted Platform Module
What is the primary role of smartcards in a PKI?
Tamper resistant, mobile storage and application of private keys of the users
What is the difference between the OCSP (Online Certificate Status Protocol) and a Certificate Revocation List (CRL)?
The OCSP (Online Certificate Status Protocol) provides real-time certificate checks and a Certificate Revocation List (CRL) has a delay in the updates.
Which of the following statements pertaining to Secure Sockets Layer (SSL) is false?
The SSL protocol's primary use is to authenticate the client to the server using public key cryptography and digital certificates.
In a SSL session between a client and a server, who is responsible for generating the master secret that will be used as a seed to generate the symmetric keys that will be used during the session?
The client's browser
Which of the following statements pertaining to message digests is incorrect?
The message digest should be calculated using at least 128 bytes of the file.
Public Key Infrastructure (PKI) uses asymmetric key encryption between parties. The originator encrypts information using the intended recipient's "public" key in order to get confidentiality of the data being sent. The recipients use their own "private" key to decrypt the information. The "Infrastructure" of this methodology ensures that:
The recipient's identity can be positively verified by the sender.
Which of the following offers confidentiality to an e-mail message?
The sender encrypting it with the receiver's public key.
Suppose that you are the COMSEC - Communications Security custodian for a large, multinational corporation. Susie, from Finance approaches you in the break room saying that she lost her smart ID Card that she uses to digitally sign and encrypt emails in the PKI. What happens to the certificates contained on the smart card after the security officer takes appropriate action?
They are added to the CRL
In a Public Key Infrastructure, how are public keys published?
Through digital certificates.
Which of the following can best define the "revocation request grace period"?
Time period between the arrival of a revocation request and the publication of the revocation information
Which of the following protects Kerberos against replay attacks?
Time stamps
In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term?
Top Level CA
What would you call a microchip installed on the motherboard of modern computers and is dedicated to carrying out security functions that involve the storage and processing of symmetric and asymmetric keys, hashes, and digital certificates.
Trusted Platform Module (TPM)
The RSA Algorithm uses which mathematical concept as the basis of its encryption?
Two large prime numbers
Where parties do not have a shared secret and large quantities of sensitive information must be passed, the most efficient means of transferring information is to use Hybrid Encryption Methods. What does this mean?
Use of public key encryption to secure a secret key, and message encryption using the secret key.
Cryptography does not concern itself with which of the following choices?
Validation
Which of the following would best describe certificate path validation?
Verification of the validity of all certificates of the certificate chain to the root certificate
Which of the following offers security to wireless communications?
WTLS
Which of the following statements pertaining to key management is incorrect?
When not using the full keyspace, the key should be extremely random.
Public key infrastructure(PKI) consists of programs, data formats, procedures, communication protocols, security policies, and public key cryptographic mechanisms working in a comprehensive manner to enable a wide range of dispersed people to communicate in a secure and predictable fashion. This infrastructure is based upon which of the following Standard?
X.509
Which of the following standards concerns digital certificates?
X.509
The Secure Hash Algorithm (SHA-1) creates:
a fixed length message digest from a variable length input message
Which of the following DoD Model layer provides non-repudiation services?
application layer.
In a known plaintext attack, the cryptanalyst has knowledge of which of the following?
both the plaintext and the associated ciphertext of several messages
The computations involved in selecting keys and in enciphering data are complex, and are not practical for manual use. However, using mathematical properties of modular arithmetic and a method known as "_________________," RSA is Quite feasible for computer use.
computing in Galois fields
Which of the following issues is not addressed by digital signatures?
denial-of-service
Complete the following sentence. A digital signature is a ____
hash value that has been encrypted with the senders private key
Which of the following cryptographic attacks describes when the attacker has a copy of the plaintext and the corresponding ciphertext?
known plaintext
What is the role of IKE within the IPsec protocol?
peer authentication and key exchange
There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI). When we compare them side by side, Kerberos tickets correspond most closely to which of the following?
public-key certificates
A X.509 public key certificate with the key usage attribute "non repudiation" can be used for which of the following?
verifying signed messages
