Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

justin's cissp > CISSP ch 6 > Flashcards

CISSP ch 6 Flashcards

1
Q

Symmetric modes of operation that propagate errors

A

CBC and CFB (stream version of CBC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Symmetric modes of operation that provide authentication

A

GCM and CCM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

HSM

A

Hardware security module

Manages cryptographic keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Fair cryptosystems

A

Pieces of secret key are given to an independent third party who will share pieces with government pursuant to a court order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

PKI

A

Public Key Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Math of RSA

A

Factoring large prime numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Math of Elgamal

A

Modular arithmetic (extension of Diffie Helman), doubles size of message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Math of ECC

A

Elliptic curve cryptography, elliptic curve discrete logarithm problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

DHE / EDH

A

Diffie Helman key exchange, relies on factoring of prime numbers and modular arithmetic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ECDHE

A

Elliptic curve Diffie Helman exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SHA-256 message size

A

256 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SHA 256 block processing size

A

512 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SHA 224 processing block size

A

512 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SHA 512 message size

A

512 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SHA 512 processing block size

A

1024 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SHA 384 processing block size

A

1024 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

MD5 processing block size

A

512 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

MD5 message size

A

64 bits less than a multiple of 512

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

RIPEMD

A

RIPE message digest, hashing used in Bitcoin, only RIPEMD 160 and 320 are secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

HMAC

A

hashed message authentication code = implements a partial digital signature, guarantees integrity of message, but does not provide nonrepudiation = uses symmetric encryption / shared secret key that encrypts a hash value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DSS

A

Digital signature standard = specified by NIST in FIPS 186-5, all federally approved digital signature algorithms must use SHA-3 hashing functions, specifies encryption algorithms (only three that are approved):
RSA, specified in ANSI X9.31
ECDSA = Elliptic Curve digital signature algorithm, specified in ANSI X9.62
EdDSA = Edwards-Curve Digital Signature Algorithm

22
Q

ECDSA

A

Elliptic Curve digital signature algorithm

23
Q

EdDSA

A

Edwards-Curve Digital Signature Algorithm

24
Q

DSA

A

Digital signature algorithm, no longer approved in current version of FIPS 186-5

25
Q

Digital certificates

A

endorsed copies of an individual’s public key, use x.509 standard

26
Q

CN and DN on a digital certificate

A

Common name and distinguished name of a subject

27
Q

CA

A

Certificate Authority

28
Q

RA

A

Registration authority = assist certificate authority with verifying users’ identities

29
Q

CSR

A

Subject provides their public key in the form of a certificate signing request

30
Q

DV certificate

A

Domain validation certificates, simples and most common, verifies that subject has control of the domain name

31
Q

EV certificate

A

Extended validation certificates, higher level of assurance, certificate authority takes steps to verify that the certificate owner is a legitimate business

32
Q

CRL

A

a certificate revocation list (CRL)
maintained by the various certificate authorities, contain serial numbers of certificates issued and revoked by a given certificate authority, along with date and time of revocation
must be downloaded and cross-referenced periodically, introducing a period of latency between the time a certificate is revoked and the time end users are notified of the revocation

33
Q

OCSP

A

the Online Certification Status Protocol (OCSP)
eliminates latency by providing a means for real-time certificate verification
when a client receives a certificate, it sends an OCSP request to the CA’s OCSP server, who then responds with a status of valid, invalid or unknown
places significant burden on OCSP server

34
Q

Certificate Stapling

A

An extension of OCSP that relieves some of the burden placed on certificate authorities
Web server contacts the OCSP server itself and receives a signed and timestamped response from the OCSP server, which it then attaches, or staples, to the digital certificate provided to the client/user
When the next user visits the website, stapled certificate can be reused as long as the timestamp is recent enough (usually have a validity period of 24 hours)

35
Q

DER certificate format

A

Distinguished Encoding Rules = most common binary format = .der, .crt or .cer extensions

36
Q

PEM certificate format

A

Privacy Enhanced Mail = ASCII text version of the DER format = .pem or .crt

37
Q

PFX certificate format

A

Personal Information Exchange = format commonly used by Windows systems, may be stored in binary form = .pfx or .p12

38
Q

P7B certificate format

A

used by Windows systems, stored in ASCII text format = .p7b

39
Q

TPM

A

Trusted Platform Module = chip that resides on the motherboard to store and manage keys used for full-disk encryption (FDE) solutions, prevents someone from removing and accessing the drive on another device

40
Q

PGP

A

Pretty Good Privacy = secure email system developed by Phil Zimmerman in 1991, combines certificate authority hierarchy with the ‘web of trust’ concept (must become trusted by one or more PGP users to being using the system) = commercial product sold by Symantec and open source variant called OpenPGP, commercial providers also offer PGP-based email services
ProtonMail
StartMail
Mailvelope
SafeGmail
Hushmail

41
Q

Minimum TLS security

A

TLS 1.2 (2008) now considered minimum secure option, anything older (SSL 3.0, TLS 1.0, TLS 1.1) is insecure
TLS 1.3 (2018) is also secure and adds performance improvements. Note: Must ensure that security algorithms being used by TLS are secure as well

42
Q

POODLE

A

Padding On Downgraded Legacy Encryption = attack in 2014 on SSL 3.0 fallback mechanism of TLS, caused TLS v1.2 to drop this backward compatibility

43
Q

Link encryption

A

protects entire communications circuits by creating a secure tunnel between two points using either a hardware solution or a software solution
all the data (header, trailer, address and routing data) is encrypted, each packet has to be decrypted and re-encrypted at each hop to be properly routed, which slows the routing
done at lower OSI layers

44
Q

SSH minimum security

A

SSH2 drops support for DES and IDEA, but adds support for Diffie-Hellman key exchange and the ability to run multiple sessions over a single SSH connection, provides added protection against man-in-the-middle (on-path) attacks, eavesdropping and IP/DNS spoofing

45
Q

IPsec transport mode vs tunnel mode

A

transport mode
for end-to-end encryption and peer-to-peer communication
only the packet payload is encrypted

tunnel mode
for link encryption
the entire packet, including the header is encrypted

46
Q

IPsec SA

A

At runtime, you set up an IPsec session by creating a security association (SA)
SA represents the communication session and records any configuration and status information about the connection
Represents a simplex connection, if you want a two-way channel, you need two SAs, one for each direction. If you want a bidirectional channel using both AH and ESP, you will need to set up four SAs
IPsec can filter and manage communications on a per-SA basis
Without a valid SA defined, pairs of users or gateways cannot establish IPsec links

47
Q

PBKDF2, bcrypt and scrypt

A

Specialized password hashing functions PBKDF2, bcrypt and scrypt allows for the creation of hashes using salts and incorporate a technique known as key stretching (adding values until input is a fixed length) that makes it more computationally difficult to perform a single password guess

48
Q

Analytic Attack

A

Algebraic manipulation that attempts to reduce the complexity of the algorithm
Focuses on the logic of the algorithm itself

49
Q

Implementation attack

A

Exploits weaknesses in the implementation of a cryptography system
Focuses on exploiting the software code

50
Q

Statistical attack

A

Exploits statistical weaknesses in a cryptosystem (e.g., floating-point errors or the inability to produce truly random numbers)
Focuses on hardware or operating system hosting the cryptography application

justin's cissp (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions