CCNA Cybersecurity Operations (Version 1.1) – CyberOps Chapter 9 Exam Answers 2019
What is the focus of cryptanalysis?
- hiding secret codes
- developing secret codes
- breaking encrypted codes
- implementing encrypted codes
Cryptology is the science of making and breaking secret codes. There are two separate disciplines in cryptology, cryptography and cryptanalysis. Cryptography is the development and use of codes. Cryptanalysis is the breaking of those secret (encrypted) codes.
The following message was encrypted using a Caesar cipher with a key of 2:
fghgpf vjg ecuvng
What is the plaintext message?
- defend the region
- invade the castle
- defend the castle
- invade the region
The Caesar cipher was a simple substitution cipher. In this example, if the key is 2, the letter d was moved two spaces to the right, resulting in an encoded message that used the letter f in place of the letter d. The letter g would be the substitute for the letter e, and so on. So, the resulting plaintext is f=d, g=e, h=f, g=e, p=n, f=d, v=t, j=h, g=e, e=c, c=a, u=s, v=t, n=l, g=e.
A company is developing a security policy for secure communication. In the exchange of critical messages between a headquarters office and a branch office, a hash value should only be recalculated with a predetermined code, thus ensuring the validity of data source. Which aspect of secure communications is addressed?
- data integrity
- data confidentiality
- origin authentication
Secure communications consists of four elements:Data confidentiality – guarantees that only authorized users can read the message
Data integrity – guarantees that the message was not altered
Origin authentication – guarantees that the message is not a forgery and does actually come from whom it states
Data nonrepudiation – guarantees that the sender cannot repudiate, or refute, the validity of a message sent
When implementing keys for authentication, if an old key length with 4 bits is increased to 8 bits, which statement describes the new key space?
- The key space is increased by 3 times.
- The key space is increased by 8 times.
- The key space is increased by 15 times.
- The key space is increased by 16 times.
A key length with 4 bits will provide a key space of 2^4=16 keys. The new key length with 8 bits can provide a key space of 2^8=256 keys. The key space with 256 keys is 15 times larger than a key space with 16 keys.
Which statement is a feature of HMAC?
- HMAC is based on the RSA hash function.
- HMAC uses a secret key that is only known to the sender and defeats man-in-the-middle attacks.
- HMAC uses a secret key as input to the hash function, adding authentication to integrity assurance.
- HMAC uses protocols such as SSL or TLS to provide session layer confidentiality.
A keyed-hash message authentication code (HMAC or KHMAC) is a type of message authentication code (MAC). HMACs use an additional secret key as input to the hash function, adding authentication to data integrity assurance.
What are two properties of a cryptographic hash function? (Choose two.)
- Complex inputs will produce complex hashes.
- Hash functions can be duplicated for authentication purposes.
- The output is a fixed length.
- The input for a particular hash algorithm has to have a fixed size.
- The hash function is one way and irreversible.
A cryptographic hash function should have the following properties:The input can be any length.
The output has a fixed length.
The hash value is relatively easy to compute for any given input.
The hash is one way and not reversible.
The hash is collision free, meaning that two different input values will result in different hash values
A security specialist is tasked to ensure that files transmitted between the headquarters office and the branch office are not altered during transmission. Which two algorithms can be used to achieve this task? (Choose two.)
The task to verify that messages are not altered during transmission is to ensure data integrity, which can be implemented using hash function. HMAC can be used for ensuring origin authentication. AES and 3DES are encryption algorithms.
A company is developing a security policy to ensure that OSPF routing updates are authenticated with a key. What can be used to achieve the task?
The task to ensure that routing updates are authenticated is data origin authentication, which can be implemented using HMAC. HMAC is MD5 or SHA-1 plus a secret key. AES and 3DES are two encryption algorithms. MD5 and SHA-1 can be used to ensure data integrity, but not authentication.
Which statement describes the Software-Optimized Encryption Algorithm (SEAL)?
- SEAL is a stream cipher.
- It uses a 112-bit encryption key.
- It is an example of an asymmetric algorithm.
- It requires more CPU resources than software-based AES does.
SEAL is a stream cipher that uses a 160-bit encryption key. It is a symmetric encryption algorithm that has a lower impact on the CPU resources compared to other software-based algorithms, such as software-based DES, 3DES, and AES.
Which encryption algorithm is an asymmetric algorithm?
DH is an asymmetric algorithm. AES, 3DES, and SEAL are all symmetric algorithms.
Which algorithm is used to automatically generate a shared secret for two systems to use in establishing an IPsec VPN?
The Diffie-Helman (DH) algorithm is the basis of most modern automatic key exchange methods. It is a mathematical algorithm that allows two computers to generate an identical shared secret on both systems without having communicated before. DH is commonly used when data is exchanged using an IPsec VPN.
Which two statements describe the characteristics of symmetric algorithms? (Choose two.)
- They are referred to as a pre-shared key or secret key.
- They use a pair of a public key and a private key.
- They are commonly used with VPN traffic.
- They provide confidentiality, integrity, and availability.
- They are commonly implemented in the SSL and SSH protocols.
Symmetric encryption algorithms use the same key (also called shared secret) to encrypt and decrypt the data. In contrast, asymmetric encryption algorithms use a pair of keys, one for encryption and another for decryption.
An online retailer needs a service to support the nonrepudiation of the transaction. Which component is used for this service?
- the digital signatures
- the public key of the retailer
- the private key of the retailer
- the unique shared secret known only by the retailer and the customer
Digital signatures, generated by hash function, can provide the service for nonrepudiation of the transaction. Both public and private keys are used to encrypt data during the transaction. Shared secrets between the retailer and customers are not used.
What is the purpose of a digital certificate?
- It guarantees that a website has not been hacked.
- It provides proof that data has a traditional signature attached.
- It ensures that the person who is gaining access to a network device is authorized.
- It authenticates a website and establishes a secure connection to exchange confidential data.
Digital signatures commonly use digital certificates that are used to verify the identity of the originator in order to authenticate a vendor website and establish an encrypted connection to exchange confidential data. One such example is when a person logs into a financial institution from a web browser.
What technology allows users to verify the identity of a website and to trust code that is downloaded from the Internet?
- asymmetric key algorithm
- digital signature
- hash algorithm
Digital signatures provide assurance of the authenticity and integrity of software codes. They provide the ability to trust code that is downloaded from the Internet.
Which three algorithms are designed to generate and verify digital signatures? (Choose three.)
There are three Digital Signature Standard (DSS) algorithms that are used for generating and verifying digital signatures:Digital Signature Algorithm (DSA)
Rivest-Shamir Adelman Algorithm (RSA)
Elliptic Curve Digital Signature Algorithm (ECDSA)
Which three services are provided through digital signatures? (Choose three.)
Digital signatures use a mathematical technique to provide three basic security services:Integrity
What is the service framework that is needed to support large-scale public key-based technologies?
The service framework that is needed to support large-scale public key-based technologies is a PKI (public key infrastructure). SHA and HMAC are hashing algorithms. RSA is an asymmetric encryption algorithm.
What are the two important components of a public key infrastructure (PKI) used in network security? (Choose two.)
- intrusion prevention system
- certificate authority
- digital certificates
- pre-shared key generation
- symmetric encryption algorithms
A public key infrastructure uses digital certificates and certificate authorities to manage asymmetric key distribution. PKI certificates are public information. The PKI certificate authority (CA) is a trusted third-party that issues the certificate. The CA has its own certificate (self-signed certificate) that contains the public key of the CA.
What technology has a function of using trusted third-party protocols to issue credentials that are accepted as an authoritative identity?
- PKI certificates
- symmetric keys
- hashing algorithms
- digital signatures
Digital certificates are used to prove the authenticity and integrity of PKI certificates, but a PKI Certificate Authority is a trusted third-party entity that issues PKI certificates. PKI certificates are public information and are used to provide authenticity, confidentiality, integrity, and nonrepudiation services that can scale to large requirements.
Two users must authenticate each other using digital certificates and a CA. Which option describes the CA authentication procedure?
- The CA is always required, even after user verification is complete.
- The users must obtain the certificate of the CA and then their own certificate.
- After user verification is complete, the CA is no longer required, even if one of the involved certificates expires.
- CA certificates are retrieved out-of-band using the PSTN, and the authentication is done in-band over a network.
When two users must authenticate each other using digital certificates and CA, both users must obtain their own digital certificate from a CA. They submit a certificate request to a CA, and the CA will perform a technical verification by calling the end user (out-of-band). Once the request is approved, the end user retrieves the certificate over the network (in-band) and installs the certificate on the system. After both users have installed their certificate, they can perform authentication by sending their certificate to each other. Each site will use the public key of the CA to verify the validity of the certificate; no CA is involved at this point. If both certificates are verified, both users can now authenticate each other.
Which statement describes the use of certificate classes in the PKI?
- The lower the class number, the more trusted the certificate.
- A vendor must issue only one class of certificates when acting as a CA.
- A class 5 certificate is more trustworthy than a class 4 certificate.
- Email security is provided by the vendor, not by a certificate.
The higher the certificate number, the more trustworthy the certificate. Class 1 certificates are for individuals, with a focus on email verification. An enterprise can act as its own CA and implement PKI for internal use. In that situation, the vendor can issue certificates as needed for various purposes.
What role does an RA play in PKI?
- a root CA
- a super CA
- a subordinate CA
- a backup root CA
A registration authority (RA) is a subordinate CA. It is certified by a root CA to issue certificates for specific uses.
What are two methods to maintain certificate revocation status? (Choose two.) CRL
- subordinate CA
A digital certificate might need to be revoked if its key is compromised or it is no longer needed. The certificate revocation list (CRL) and Online Certificate Status Protocol (OCSP), are two common methods to check a certificate revocation status.
In which way does the use of HTTPS increase the security monitoring challenges within enterprise networks?
- HTTPS traffic is much faster than HTTP traffic.
- HTTPS traffic enables end-to-end encryption.
- HTTPS traffic does not require authentication.
- HTTPS traffic can carry a much larger data payload than HTTP can carry.
HTTPS enables end-to-end encrypted network communication, which adds further challenges for network administrators to monitor the content of packets to catch malicious attacks.