Domain 3: Review Questions

Question 1

Which of the following is most correct?

A. Asymmetric crypto has a larger key space.
B. A cryptogram is a segment of cipher text transmitted over the internet, but not over a VPN.
C. TLS and SSL use symmetric crypto
D. The key schedule is determined by the programmer when writing the software but can be changed by the device’s system admin.

Answer 1

A. Asymmetric crypto has a larger key space.

Asymmetric cryptography (e.g., RSA, ECC) typically uses much larger key sizes than symmetric cryptography to achieve equivalent security. For example:
A 2048-bit RSA key provides security comparable to a 128-bit AES key.
The larger key space increases the complexity of brute-force attacks in asymmetric encryption.

Question 2

Which of the following is NOT correct?

A. When using PKI, the sender can use their own private key or the public key of the receiver.
B. When electing to use their private key, the sender provides proof of origin
C. A strength of Asymmetric cryptography is that is scales well in a mesh network
D. One strength of symmetric crypto is key distribution

Answer 2

D. One strength of symmetric crypto is key distribution.

D is Incorrect.

Key distribution is a major weakness of symmetric cryptography because the secret key must be securely shared between parties before communication can occur. This requires secure channels or additional mechanisms, making symmetric cryptography less scalable.

Question 3

Which of the following is provided if data cannot be read?

A. Integrity
B. Confidentiality
C. Availability
D. Defense in depth

Answer 3

B. Confidentiality is provided if the data cannot be read. It can be provided either through access controls and encryption for data as it exists on a hard drive or through encryption as the data is in transit.

Question 4

In a distributed environment, which of the following is software that ties the client and server software together?

A. Embedded system
B. Mobile code
C. Virtual computing
D. Middleware

Answer 4

D. In a distributed environment, middleware is software that ties the client and server software together. It is neither a part of the operating system nor a part of the server software. It is the code that lies between the operating system and applications on each side of a distributed computing system in a network.

Question 5

Which of the following is composed of the components (hardware, firmware, and/or software) that are expected to enforce the security policy of the system?

A. Security perimeter
B. Reference monitor
C. Trusted Computer Base (TCB)
D. Security kernel

Answer 5

C. The Trusted Computer Base (TCB) is composed of the components (hardware, firmware, and/or software) that are trusted to enforce the security policy of the system and that if compromised jeopardize the security properties of the entire system.

Question 6

Which process converts plaintext into ciphertext?

A. Hashing
B. Decryption
C. Encryption
D. Digital signature

Answer 6

C. Encryption converts plaintext into ciphertext. Hashing reduces a message to a hash value. Decryption converts ciphertext into plaintext. A digital signature is an object that provides sender authentication and message integrity by including a digital signature with the original message.

Question 7

Which type of cipher is the Caesar cipher

A. Polyalphabetic substitution
B. Mono-alphabetic substitution
C. Polyalphabetic transposition
D. Mono-alphabetic transposition

Answer 7

B. The Caesar cipher is a mono-alphabetic substitution cipher. The Vigenere substitution is a polyalphabetic substitution.

Question 8

Which of the following is the most secure encryption scheme?

A. Concealment cipher
B. Symmetric algorithm
C. One-time pad
D. Asymmetric algorithm

Answer 8

C. A one-time pad is the most secure encryption scheme because it is used only once.

Question 9

Which 3DES implementation encrypts each block of data three times, each time with a different key?

A. 3DES-EDE3
B. 3DES-EEE3
C. 3DES-EDE2
D. 3DES-EEE2

Answer 9

B. The 3DES-EEE3 implementation encrypts each block of data three times, each time with a different key.

The 3DES-EDE3 implementation encrypts each block of data with the first key, decrypts each block with the second key, and encrypts each block with the third key. The 3DES-EDE2 implementation encrypts each block of data with the first key, decrypts each block with the second key, and then encrypts each block with the first key. The 3DES-EEE2 implementation encrypts each block of data with the first key, encrypts each block with the second key, and then encrypts each block with the third key.

Question 10

Which of the following is NOT a hash function?

A. ECC
B. MD6
C. SHA-2
D. RIPEMD-160

Answer 10

A. Elliptic Curve Cryptosystem (ECC) is NOT a hash function. It is an asymmetric algorithm. All the other options are hash functions.

Question 11

Which of the following is an example of a preventive control?

A. A door lock system on a server room
B. An electric fence surrounding a facility
C. Armed guards outside a facility
D. Parking lot cameras

Answer 11

A. An electric fence surrounding a facility is designed to prevent access to the building by those who should not have any access (an external threat), whereas a door lock system on the server room that requires a swipe of the employee card is designed to prevent access by those who are already in the building (an internal threat).

Question 12

Which of the following is NOT one of the three main strategies that guide CPTED?

A. Natural access control
B. Natural surveillance reinforcement
C. Natural territorials reinforcement
D. Natural surveillance

Answer 12

B. The three strategies are natural access control, natural territorials reinforcement, and natural surveillance.

Question 13

What occurs when different encryption keys generate the same ciphertext from the same plaintext message?

A. Key clustering
B. Cryptanalysis
C. Keyspace
D. Confusion

Answer 13

A. Key clustering occurs when different encryption keys generate the same ciphertext from the same plaintext message.

Cryptanalysis is the science of decrypting ciphertext without prior knowledge of the key or cryptosystem used. A keyspace is all the possible key values when using a particular algorithm or other security measure. Confusion is the process of changing a key value during each round of encryption.

Question 14

Which encryption system uses a private or secret key that must remain secret between the two parties?

A. Running key cipher
B. Concealment cipher
C. Asymmetric algorithm
D. Symmetric algorithm

Answer 14

D. A symmetric algorithm uses a private or secret key that must remain secret between the two parties.

A running key cipher uses a physical component, usually a book, to provide the polyalphabetic characters. A concealment cipher occurs when plaintext is interspersed somewhere within other written material. An asymmetric algorithm uses both a public key and a private or secret key.

Question 15

Which of the following is an asymmetric algorithm?

A. IDEA
B. Twofish
C. RC6
D. RSA

Answer 15

D. RSA is an asymmetric algorithm. All the other algorithms are symmetric algorithms.

Question 16

Which PKI component contains a list of all the certificates that have been revoked?

A. CA
B. RA
C. CRL
D. OCSP

Answer 16

C. A certificate revocation list (CRL) contains a list of all the certificates that have been revoked.

A certificate authority (CA) is the entity that creates and signs digital certificates, maintains the certificates, and revokes them when necessary. A registration authority (RA) verifies the requestor’s identity, registers the requestor, and passes the request to the CA. Online Certificate Status Protocol (OCSP) is an Internet protocol that obtains the revocation status of an X.509 digital certificate.

Question 17

Which attack executed against a cryptographic algorithm uses all possible keys until a key is discovered that successfully decrypts the ciphertext?

A. Frequency analysis
B. Reverse engineering
C. Ciphertext-only attack
D. Brute force

Answer 17

D. A brute-force attack executed against a cryptographic algorithm uses all possible keys until a key is discovered that successfully decrypts the ciphertext.

A frequency analysis attack relies on the fact that substitution and transposition ciphers will result in repeated patterns in ciphertext. A reverse engineering attack occurs when an attacker purchases a particular cryptographic product to attempt to reverse engineer the product to discover confidential information about the cryptographic algorithm used. A ciphertext-only attack uses several encrypted messages (ciphertext) to figure out the key used in the encryption process.

Question 18

In ISO/IEC 15288:2015, which process category includes acquisition and supply?

A. Technical management processes
B. Technical processes
C. Agreement processes
D. Organizational project-enabling processes

Answer 18

C. ISO/IEC 15288:2015 establishes four categories of processes:

• Agreement processes, including acquisition and supply
• Organizational project-enabling processes, including infrastructure management, quality management, and knowledge management
• Technical management processes, including project planning, risk management, configuration management, and quality assurance
• Technical processes, including system requirements definition, system analysis, implementation, integration, operation, maintenance, and disposal

Question 19

Which statement is true of dedicated security mode?

A. It employs a single classification level.
B. All users have the same security clearance, but they do not all possess a need-to-know clearance for all the information in the system.
C. All users must possess the highest security clearance, but they must also have valid need-to-know clearance, a signed NDA, and formal approval for all information to which they have access.
D. Systems allow two or more classification levels of information to be processed at the same time.

Answer 19

A. Dedicated security mode employs a single classification level.

Question 20

What is the first step in ISO/IEC 27001:2013?

A. Identify the requirements.
B. Perform risk assessment and risk treatment.
C. Maintain and monitor the ISMS.
D. Obtain management support.

Answer 20

D. The first step in ISO/IEC 27001:2013 is to obtain management support.

Question 21

Which two states are supported by most processors in a computer system?

A. Supervisor state and problem state
B. Supervisor state and kernel state
C. Problem state and user state
D. Supervisor state and elevated state

Answer 21

A. Two processor states are supported by most processors: supervisor state (or kernel mode) and problem state (or user mode).

Question 22

When supporting a BYOD initiative, from which group do you probably have most to fear?

A. Hacktivists
B. Careless users
C. Software vendors
D. Mobile device vendors

Answer 22

B. As a security professional, when supporting a BYOD initiative, you should take into consideration that you probably have more to fear from the carelessness of the users than you do from hackers.

Question 23

Which term applies to embedded devices that bring with them security concerns because engineers that design these devices do not always worry about security?

A. BYOD
B. NDA
C. IoT
D. ITSEC

Answer 23

C. Internet of Things (IoT) is the term used for embedded devices and their security concerns because engineers that design these devices do not always worry about security.

Question 24

Which option best describes the primary concern of NIST SP 800-57?

A. Asymmetric encryption
B. Symmetric encryption
C. Message integrity
D. Key management

Answer 24

D. Key management is the primary concern of NIST SP 800-57.

Question 25

Which of the following key types requires only integrity security protection?

A. Public signature verification key
B. Private signature key
C. Symmetric authentication key
D. Private authentication key

Answer 25

A. Public signature verification keys require only integrity security protection.

Question 26

What is the final phase of the cryptographic key management life cycle, according to NIST SP 800-57?

A. Operational phase
B. Destroyed phase
C. Pre-operational phase
D. Post-operational phase

Answer 26

B. The destroyed phase is the final phase of the cryptographic key management life cycle, according to NIST SP 800-57.