ISC2 - Study Notes 3

Question 1

A token using an ??? doesn’t require exact clock synchronization. Instead, it uses another method to create one-time dynamic passwords. As an example, the user can enter a PIN into the device, which prompts the token to generate a one-time password.

Answer 1

Asynchronous dynamic password

Question 2

The goal of both OPIE and S/KEY is to generate an asynchronous password known to both a client and a server and used in a single session. Both S/KEY and OPIE combine the user’s real password with other data, and use a hashing algorithm such as Message Digest 5 (MD5) to create a one-time password.

Answer 2

info

Question 3

??? includes data electronically embedded within the card. It doesn’t have power, but does have an inductor that can be electrically excited when it passes through a magnetic field. This provides enough power for the proximity card to transmit data to a nearby receiver.

Answer 3

Proximity Cards

Question 4

A person’s eyes have a pattern of blood vessels at the back of the eye, and a ??? scan uses an infrared light to measure that pattern. While ??? scans are very accurate, people object to them because they can reveal medical conditions. Also, ??? scans typically require physical contact with the scanner.

Answer 4

Retina

Question 5

The area surrounding the eye’s pupil is the ???, which is almost as unique as the retina. ??? scans are more acceptable to users because they don’t require physical contact and cameras can take pictures of the ??? from a distance. However, lighting can affect the accuracy of an ??? scan, and some ??? scanners can be tricked with a high-quality picture.

Answer 5

Iris

Question 6

Also called a type 1 error, ??? refers to the percentage of times a biometric system falsely rejects a known user. Instead, the system indicates that the user is unknown.

Answer 6

False Rejection Rate (FRR)

Question 7

Also called a type 2 error, ??? refers to the percentage of times a biometric system falsely identifies an unknown user. Instead, the system indicates the user is a known user.

Answer 7

False Acceptance Rate (FAR)

Question 8

Also called the Equal Error Rate (EER), ??? identifies the point where the FAR and FRR of a biometric system are equal or cross over each other on the chart. A lower ??? indicates a better-performing biometric system.

Answer 8

Crossover Error Rate (CER)

Question 9

A smart card (something you have) and a PIN (something you know)

A fingerprint (something you are) and a password (something you know)

A hardware token (something you have) with a username and password (something you know)

Answer 9

examples of multifactor authentication include the following:

Question 10

provides authentication on a network and contributes to the confidentiality and integrity of information. It uses symmetric encryption (also called secret key cryptography) to encrypt tickets in a secure format between systems. ??? requires a database of accounts and time synchronization for all systems.

Answer 10

Kerberos