D430 Fundamentals of Information Security

Correct Answer

D. Secure hash algorithm outputs are easily reverse-engineered

Explanation

Secure Hashing algorithms (such as SHA-256) are designed to be one-way functions, meaning that once data is hashed, it cannot be reversed to reveal the original message. They also produce a fixed-size output regardless of the input size and are designed to avoid collisions (where two different inputs produce the same hash). Therefore, the statement in option D is false. In fact, secure hash functions are designed to be resistant to reverse engineering, making it computationally infeasible to retrieve the original input from the hash.

Why other options are wrong

A. It is a one-way cryptographic function that cannot be reversed

This is true because hashing is a one-way process. Once data is hashed, there is no straightforward way to reverse the process and retrieve the original data.

B. It provides a means for messages to be hashed to a fixed-size value

This is true. Secure hash algorithms output a fixed-size hash, regardless of the size of the input data.

C. Provides strong guarantees for collision avoidance

This is true. Secure hashing algorithms are designed to minimize the possibility of two different inputs producing the same hash output, which is referred to as a collision.

Correct Answer

D. All options listed here

Explanation

Access control is crucial for all types of people within an organization, including employees, customers, and potential offenders. Employees need controlled access to perform their duties, customers require secure access for services, and potential offenders must be restricted from unauthorized actions to maintain security.

Why other options are wrong

A. Employees

While access control is certainly important for employees, it only covers one aspect of the overall access control needs for an organization. Customers and potential offenders also require consideration.

B. Customers

Customers need secure access to services, but focusing on employees alone overlooks the broader scope of access control across different stakeholders.

C. Potential offenders

While restricting access for potential offenders is essential, focusing solely on them without considering employees and customers would ignore the overall security framework necessary to protect all parties involved.

Correct Answer

D. All of the above

Explanation

When evaluating reusable technologies for database security, all of the listed aspects are critical. Data encryption ensures that sensitive information is protected from unauthorized access, privilege management controls who has access to specific resources, and secure connections protect data in transit. Together, these components provide a comprehensive security solution.

Why other options are wrong

A. Data encryption

While data encryption is essential for protecting data, relying solely on encryption does not address other key aspects of database security such as privilege management and securing connections. Encryption should be part of a broader security strategy.

B. Privilege management

Privilege management is important, but it alone is insufficient for overall database security. Without encryption and secure connections, the data remains vulnerable to unauthorized access and attacks during transmission.

C. Secure connections

Secure connections are necessary for protecting data in transit, but they are just one part of the larger security landscape. Effective database security requires a combination of encryption, privilege management, and secure connections to ensure data integrity and confidentiality.

Correct Answer

B. To provide a centralized directory for user authentication and authorization

Explanation

LDAP (Lightweight Directory Access Protocol) is primarily used to provide a centralized directory service for managing user authentication and authorization. It allows organizations to store and query information about users, such as usernames, passwords, and roles, enabling efficient management of access to resources within the network. LDAP is essential for maintaining a secure and organized access control system within an enterprise.

Why other options are wrong

A. To encrypt sensitive data during transmission

This is incorrect because while LDAP can use encryption (such as LDAPS, the secure version of LDAP), its primary function is not to encrypt data but to provide directory services for authentication and authorization.

C. To monitor network traffic for suspicious activity

This is incorrect. Monitoring network traffic for suspicious activity is the role of intrusion detection systems (IDS) or network monitoring tools, not LDAP.

D. To serve as a firewall against unauthorized access

This is incorrect. A firewall is used to control and monitor incoming and outgoing network traffic, preventing unauthorized access. LDAP is not a firewall; it is a directory service for managing user access and credentials.

Correct Answer

A. Transferring the risk of loss to the escrow service.

Explanation

By maintaining decryption keys with an escrow service, the organization is transferring the risk of losing those keys to the escrow service. If the keys are needed in the future, they can be retrieved from the escrow service, reducing the risk of losing access to encrypted data.

Why other options are wrong

B. Increasing the residual risk of keeping data private.

This is incorrect because using an escrow service actually reduces the residual risk of losing keys and data, rather than increasing it. Escrow services are designed to protect against key loss.

C. Mitigating risk with the use of encryption keys.

While encryption keys do mitigate the risk of unauthorized access to data, using an escrow service is about ensuring the availability of keys in case they are lost. It doesn't directly mitigate the risk of keeping data private.

D. Accepting the risk of using encryption technology.

This is incorrect because maintaining keys with an escrow service is about managing risk, not accepting it. The goal is to ensure that decryption keys are available when needed, rather than simply accepting the inherent risks of encryption.

Correct Answer

A. Only the owner

Explanation

In public key cryptography, the private key is only known to the owner of the key pair. It is used to decrypt messages that were encrypted with the corresponding public key or to generate digital signatures. The private key must remain confidential to maintain security. The public key, on the other hand, is shared openly.

Why other options are wrong

B. Only the recipient

This is incorrect because the private key belongs to the owner (the person or entity who generated the key pair). The recipient of an encrypted message uses the public key to encrypt the message and uses their own private key to decrypt it if they are the intended recipient.

C. Everyone

This is incorrect because only the owner of the private key knows it. Public key cryptography relies on the principle of keeping the private key secret, ensuring the integrity and security of encrypted communications.

D. No one

This is incorrect because the private key is known to the owner, not to "no one." It is essential for the owner to be able to access the private key to decrypt messages or create digital signatures.

Correct Answer

B. Corrective and detective

Explanation

In this scenario, the IDS is detecting a potential threat (detective function) and then responding by isolating the affected system (corrective function). The detective function refers to the system's ability to identify and alert on potential security issues, while the corrective function involves taking actions to mitigate the impact or prevent further damage, such as isolating the system from the network.

Why other options are wrong

A. Preventive and detective

This option is incorrect because preventive measures involve taking action to prevent an attack from occurring in the first place, such as blocking access or filtering traffic. In this case, the IDS is detecting a threat (detective), not preventing it, and taking corrective action after the detection.

C. Preventive and corrective

This option is incorrect because preventive measures are not being implemented. Preventive measures would involve blocking the threat before it occurs, while in this case, the IDS detects and alerts after the potential threat is identified, and corrective action is taken after detection.

D. Operational and technical

This option is incorrect because the terms "operational" and "technical" are not directly related to the functional categories of security control actions. The correct classification would be preventive, detective, or corrective actions.

Correct Answer

C. A user sends a digitally signed email to the entire finance department about an upcoming meeting.

Explanation

Non-repudiation ensures that the sender of a message cannot deny having sent it. In this case, the user sending a digitally signed email provides proof of the origin of the message, as digital signatures can be traced back to the sender’s private key. This prevents the sender from later denying they were the author of the email, as the digital signature serves as irrefutable evidence of their involvement in sending the message.

Why other options are wrong

A. A user logs into a domain workstation and accesses network file shares for another department.

This scenario does not demonstrate non-repudiation because simply logging into a workstation and accessing files does not ensure proof of action or prevent the user from later denying their access. Non-repudiation requires a form of verification, such as digital signatures or logs that conclusively link the user to specific actions, which is not provided in this case.

B. A user remotely logs into the mail server with another user's credentials.

While this scenario is a violation of security protocols, it does not involve non-repudiation. The act of using someone else’s credentials can be traced, but it doesn’t prove non-repudiation since the real user could later deny their involvement, and the unauthorized user could escape identification without proper logging or auditing mechanisms.

D. A user accesses the workstation registry to make unauthorized changes to enable functionality within an application.

This action demonstrates unauthorized activity but does not provide any form of non-repudiation. Non-repudiation requires clear proof that the user performed a specific action, such as digital signatures or logging mechanisms that can’t be easily denied by the user, which is not implied in this scenario.

Correct Answer

A. Technical control

Explanation

An Intrusion Detection System (IDS) is classified as a technical control because it is a system-based security measure used to detect unauthorized access or suspicious activities within a network. Technical controls involve the use of technology to protect information systems and can include firewalls, encryption, and IDS systems like the one described. These controls are typically automated and operate in real-time to monitor, detect, and respond to security threats.

Why other options are wrong

B. Administrative control

Administrative controls involve policies, procedures, and guidelines that manage and regulate the security of an organization's systems. While important, an IDS is not a policy or procedure; it is a technological tool designed to detect potential security incidents, which classifies it as a technical control rather than an administrative one.

C. Physical control

Physical controls are related to the protection of physical assets, such as locks, fences, or access control systems for securing physical locations. An IDS is not a physical security measure but a technical one, designed to monitor network traffic and detect security incidents in real-time.

D. Operational control

Operational controls refer to security measures implemented through daily operations and management, such as user training, incident response procedures, and regular audits. While IDS can support operational controls by identifying potential threats, it is primarily classified as a technical control because it uses technology to detect and alert on suspicious network activity.