D430 Fundamentals of Information Security

Correct Answer

C. The public key can encrypt data, while the private key is used for decryption.

Explanation

In asymmetric cryptography, a public/private key pair is used where the public key encrypts data, and the private key is used to decrypt it. The public key can be freely shared, but the private key must remain confidential. This system ensures secure communication, as only the holder of the private key can decrypt data encrypted with the corresponding public key.

Why other options are wrong

A. The public key is kept secret while the private key is shared openly.

This statement is incorrect because in asymmetric encryption, the public key is openly shared, while the private key must be kept secret. The purpose of the system is to allow others to encrypt data with the public key, which can only be decrypted by the private key.

B. Both keys are identical and serve the same purpose in encryption and decryption.

This is incorrect because the two keys are not identical. In asymmetric encryption, the public key and private key are mathematically related but distinct, and they serve different roles: the public key encrypts, and the private key decrypts.

D. The private key can be used to encrypt data, while the public key is used for decryption.

This statement is incorrect because the private key is used for decryption, not encryption. In the public/private key pair system, the public key is used for encryption, and the private key is used for decryption, ensuring secure data transmission.

Correct Answer

B. PFS ensures that each session key is unique and not derived from the server's private key, protecting past communications.

Explanation

Perfect Forward Secrecy (PFS) is a cryptographic feature that ensures each session generates its own unique key that is not dependent on the server's private key. Even if the server's private key is compromised in the future, past communications remain protected because the session keys are not derived from it. This enhances security by preventing the decryption of past communication sessions.

Why other options are wrong

A. PFS allows for the decryption of past traffic if the server's private key is compromised.

This statement is incorrect because PFS specifically prevents the decryption of past sessions, even if the server's private key is compromised. This is one of the key benefits of using PFS.

C. PFS requires the use of symmetric encryption for all data transmissions.

This statement is incorrect. While symmetric encryption may be used to encrypt the data itself during communication, PFS is primarily concerned with the generation of unique session keys for each session, not the type of encryption used for data transmission.

D. PFS eliminates the need for digital certificates in secure communications.

This statement is incorrect. PFS does not eliminate the need for digital certificates. Certificates are still used to authenticate the server, but PFS ensures that session keys are independently generated and do not rely on long-term private keys.

Correct Answer

D. Secure hash algorithm outputs are easily reverse-engineered

Explanation

Secure Hashing algorithms (such as SHA-256) are designed to be one-way functions, meaning that once data is hashed, it cannot be reversed to reveal the original message. They also produce a fixed-size output regardless of the input size and are designed to avoid collisions (where two different inputs produce the same hash). Therefore, the statement in option D is false. In fact, secure hash functions are designed to be resistant to reverse engineering, making it computationally infeasible to retrieve the original input from the hash.

Why other options are wrong

A. It is a one-way cryptographic function that cannot be reversed

This is true because hashing is a one-way process. Once data is hashed, there is no straightforward way to reverse the process and retrieve the original data.

B. It provides a means for messages to be hashed to a fixed-size value

This is true. Secure hash algorithms output a fixed-size hash, regardless of the size of the input data.

C. Provides strong guarantees for collision avoidance

This is true. Secure hashing algorithms are designed to minimize the possibility of two different inputs producing the same hash output, which is referred to as a collision.

Correct Answer

B. Operational

Explanation

Operational security controls involve the activities and procedures carried out by people to protect the information system. These controls are typically executed on a day-to-day basis by personnel and may include activities such as monitoring, incident response, and user training. The emphasis is on human actions and processes rather than technological solutions.

Why other options are wrong

A. Implementation

Implementation refers to the process of putting a security control into action, including the installation of technologies or systems. It is more focused on the deployment aspect, rather than ongoing human-driven activities that fall under operational controls.

C. Organizational

Organizational controls are policies and procedures set by the management to guide the overall security strategy. While they are critical, they do not focus primarily on people’s actions in daily operational activities like operational controls do.

D. Technical

Technical controls rely on technological systems and solutions, such as encryption, firewalls, and access control systems. They are not based on the actions of people but rather on the automation of security processes.

Correct Answer

A. Have a high degree of confidence that the person taking an action is who they say they are

Explanation

Non-repudiation refers to ensuring that an individual cannot deny having performed an action. This is usually achieved through methods such as authentication and digital signatures, which provide confidence that a person performing an action is indeed who they claim to be. By verifying the identity of users and tracking their actions, the system ensures that they cannot later deny or dispute their involvement in those actions.

Why other options are wrong

B. Have a strong confidence rating by major search engines

This option is unrelated to non-repudiation. The confidence rating by search engines pertains to the visibility and relevance of a website in search results, not to ensuring that actions taken within a system cannot be denied by the users who performed them.

C. Provide a lot of logging to ensure that a system's data are accurate

While logging is important for security and auditing, it is not the key requirement for non-repudiation. Non-repudiation focuses on ensuring that actions can be traced back to their origin and that users cannot deny their actions, which is more concerned with identity verification and proof, not just accurate logging.

D. Ensure that all users' activities can be traced back to their identity, preventing them from denying their actions

While this statement is related to non-repudiation, it is broader than option A. Non-repudiation specifically focuses on actions being irrefutably attributed to the user, which directly ties to authentication, identity verification, and digital signatures. The other options, although related, focus on peripheral aspects of non-repudiation like logging and identity traceability.

Correct Answer

A. Technical control

Explanation

An Intrusion Detection System (IDS) is classified as a technical control because it is a system-based security measure used to detect unauthorized access or suspicious activities within a network. Technical controls involve the use of technology to protect information systems and can include firewalls, encryption, and IDS systems like the one described. These controls are typically automated and operate in real-time to monitor, detect, and respond to security threats.

Why other options are wrong

B. Administrative control

Administrative controls involve policies, procedures, and guidelines that manage and regulate the security of an organization's systems. While important, an IDS is not a policy or procedure; it is a technological tool designed to detect potential security incidents, which classifies it as a technical control rather than an administrative one.

C. Physical control

Physical controls are related to the protection of physical assets, such as locks, fences, or access control systems for securing physical locations. An IDS is not a physical security measure but a technical one, designed to monitor network traffic and detect security incidents in real-time.

D. Operational control

Operational controls refer to security measures implemented through daily operations and management, such as user training, incident response procedures, and regular audits. While IDS can support operational controls by identifying potential threats, it is primarily classified as a technical control because it uses technology to detect and alert on suspicious network activity.

Correct Answer

A. Kerberos authentication

Explanation

Kerberos is a network authentication protocol that uses a Key Distribution Center (KDC) to provide secure authentication between users and services. The KDC consists of two main components: the Authentication Server (AS) and the Ticket-Granting Server (TGS). The user initially authenticates with the AS, which then issues a ticket that can be used to request additional service tickets from the TGS. These tickets prove the user's identity to other services on the network, ensuring secure communication.

Why other options are wrong

B. NTLM authentication

NTLM (NT LAN Manager) is an older authentication protocol used in Windows environments but does not rely on a KDC, nor does it use tickets like Kerberos. NTLM uses a challenge-response mechanism for authentication, without the concept of ticket-granting or a two-part KDC system.

C. Security accounts manager (SAM)

SAM is a database on Windows systems used to store local user accounts and their hashed passwords. It does not involve a KDC or ticketing system for authentication, so it is not related to the Kerberos protocol.

D. LM authentication

LM (LAN Manager) authentication is an outdated protocol used in earlier Windows environments and also does not use a KDC or ticket system. LM is considered insecure and has been replaced by NTLM and Kerberos in modern systems.

Correct Answer

B. Implement a data loss prevention (DLP) solution

Explanation

After a data breach, a Data Loss Prevention (DLP) solution can help prevent further leakage of sensitive data by monitoring and controlling data transfers across the network. DLP tools can detect and prevent unauthorized access, sharing, or transmission of sensitive data, ensuring that further breaches do not occur. It helps protect the organization's data by enforcing policies that block potentially harmful actions.

Why other options are wrong

A. Increase the number of user accounts with administrative privileges

This option is incorrect because increasing administrative privileges for more users could actually exacerbate the risk of further breaches. Giving more users administrative access increases the potential for insiders to inadvertently or maliciously expose sensitive data. Minimizing administrative privileges is typically a more effective security measure.

C. Disable all network access for all employees

This is not a viable long-term solution. While temporarily disabling access might limit the damage, it is an extreme and disruptive measure that would halt normal business operations. It is better to focus on targeted interventions like patching vulnerabilities and monitoring data traffic rather than disrupting the entire network.

D. Remove all firewalls from the network

Removing firewalls is a dangerous and ill-advised action. Firewalls serve as a critical line of defense by filtering incoming and outgoing traffic, blocking unauthorized access, and protecting the network from external threats. Disabling firewalls would make the network more vulnerable to further attacks, especially after a breach has already occurred.

Correct Answer

A. Principle of least privilege

Explanation

The Principle of Least Privilege dictates that users, programs, and systems should only be given the minimum privileges necessary to perform their tasks. This minimizes the potential damage in case of an attack or error, and helps in securing systems from unauthorized actions.

Why other options are wrong

B. Principle of process scheduling

This refers to the management of processes by an operating system, and it is not related to the principle of limiting privileges to the minimum necessary for task performance.

C. None of the mentioned

This is incorrect because the Principle of Least Privilege is indeed mentioned as option A.

D. Principle of operating system

This is a vague term and does not specifically refer to the concept of limiting user privileges or actions, which is what the Principle of Least Privilege addresses.