Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ (SY0-701) > Lesson 3: Explain Cryptographic Solutions > Flashcards

Lesson 3: Explain Cryptographic Solutions Flashcards

1
Q

Define ‘Cryptography’

A

The science and practice of encoding or decoding data to make it unintelligible to unauthorized parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define ‘security through obscurity’

A

Keeping something a secret by hiding it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define ‘Plaintext/Cleartext’

A

Unencrypted data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define ‘Ciphertext’

A

Encrypted data that can’t be read without the cipher key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define an ‘Algorithm’

A

Process that encrypts and decrypts data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define ‘Cryptanalysis’

A

The science/practice of breaking ciphers and cryptographic systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define an ‘Encryption’ algorithm/cipher

A

Process that encodes data so that it can be stored or transmitted securely and then decrypted only by its owner or its intended recipient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define a ‘key’ in cryptography

A

Specific piece of data that is used in an algorithm to perform encryption and decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the two types of encryption algorithms?

A
  1. Symmetric
  2. Asymmetric
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define a ‘substitution’ cipher/algorithm

A

Replacing characters or blocks in the plaintext with different text or ciphertext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define a ‘Transposition’ cihper/algorithm

A

The units of data stay the same, but their order is changed depending on the mechanism.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define ‘Symmetric Encryption’

A

Shared-key encryption; Two-way encryption process in which encryption and decryption are both performed by the same key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the benefit of symmetric encryption?

A

Used for bulk encryption of large amounts of data due to its speed; Very fast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the security risk in symmetric encryption?

A

The transmission/receipt of the shared-key; Security is broken if the key is intercepted along with the cipher text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define ‘key length’

A

Size of a cryptographic key in bits; Longer keys generally offer better security and are harder to crack with brute force.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the downside to using larger encryption keys?

A

The computer must use more resoruces to perform encryption and decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define ‘Asymmetric Encryption’

A

One-way encryption; Cipher that uses public and private keys mathematically linked by RSA or ECC algorithms;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the difference between asymmetric encryption and symmetric encryption?

A

An asymmetric key cannot reverse the operation it performs; The public key cannot decrypt what it has encrypted and vise versa.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the function of the public key in asymmetric encryption?

A

Key is freely distributed and can be used to perform reverse encryption or decryption operation of the linked private key in the pair.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the function of the private key in asymmetric encryption?

A

Uniquely associated with the owner and is not made public; Used to encrypt data that can be decrypted by the linked public key or vice versa.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a downfall of asymmetric encryption?

A

Involves substantial computing overhead compared to symmetric encryption and is inefficient for large amounts of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How can the overhead from asymmetric encryption be mitigated with large amounts of data?

A

Asymmetric encryption can be used to encrypt a symmetric key that was used to encrypt data before transmitting the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define ‘cryptographic hashing’ algorithms

A

One-way encryption that produces a fixed-length string of bits from a plaintext input.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does a hashing algorithm produce?

A

The output is a ‘hash’ or ‘message digest’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the typical function/purpose of hashing algorithms?

A

To prove integrity; Ensure that data has not been manipulated in transmission/receipt/storage and for authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two popular hashing algorithms?

A
  1. Secure Hash Algorithm (SHA)
  2. Message Digest Algorithm #5 (MD5)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define ‘Secure Hash Algorithm (SHA)’

A

Replacement for message digest algorithm (MDA); Considered strongest - most popular is SHA256 producing a 256-bit digest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define ‘Message Digest Algorithm #5 (MD5)’

A

Considered not as safe as SHA256; Produces a 128-bit digest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define a ‘cryptographic primitive’

A

A single hash function, symmetric cipher, or asymmetric cipher.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define a ‘complete cryptographic system/product’

A

The use of multiple cryptographic primitives within a cipher suite.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What two forms of cryptography combine to create a digital signature?

A

Combines Asymmetric encryption for confidentiality to authenticating the sender with hashing to provide integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is ‘Public Key Infrastructure (PKI)’

A

Framework that establishes trust in the use of public key cryptography to sign and encrypt messages via digital certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the purpose of Public Key Infrastructure (PKI)?

A

To prove the owners of public keys are who they say they are.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Define a ‘Digital Certificate’

A

A public assertion of identity, authenticated by a certificate authority (CA) that contains a subjects public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Define a ‘certificate authority (CA)’

A

A server that guarantees subject identities by issuing signed digital certificate wrappers for their public keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is a 3rd party certificate authority (CA)?

A

A public CA that issues certificates for multiple domains; Widely trusted as a root trust by operating systems and browsers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What purpose of a 3rd party public CA?

A
  1. Provide a range of cert services.
  2. Ensure the validity of certs and the identity of those applying for them.
  3. Manage the repositories that store and administer certs.
  4. Key and cert lifecycle management (revoking invalid certs).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How does a subject generate a certificate from a public 3rd party root CA?

A
  1. Register to the CA to prove identity
  2. Generate a cert signing request (CSR) from a webserver containing the public key and submit the CSR to CA for validation
  3. CA generates a signed cert with the public key and sends to subject.
  4. Publishing of cert in webservice manager (IIS/Apache/other)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Define a ‘digitally signed certificate’

A

Proof that a cert was validly issued to a subject (user/host) by a public 3rd party root CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

When going to a URL, how does the client verify identity?

A
  1. Client checks web server’s certificate and validates that it is signed by a trusted CA.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is packaged in a digitally signed cert?

A

Information identifying the subject and the public key authenticating the connection presented in X.509 format, and digital signature from the issuing CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Define a ‘root certificate/trusted root’

A

Pre-installed self-signed cert and public key from a CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the purpose/function of a root certificate?

A

Issues signed certificates to intermediate CAs; Sign other certificates issued by the CA;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How do clients trust a public 3rd party root CA?

A
  1. CA generates a root certificate, signs it with private key, and publishes it with the public key.
  2. Client obtains CA’s certificate and adds it to a store of trusted root certificates.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the outcome of installing a CA’s root certificate?

A

Host will automatically trust any certificates signed by that CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Define a ‘Single CA’ model

A

Single root CA issues certificates directly to users and computers; Often used on private networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the shortcoming of the single CA model?

A

Single CA server is exposed; If it is compromised the whole PKI collapses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Define the ‘3rd party CA model’

A

Hierarchical model where the root CA issues certs to one or more intermediate CAs; The intermediate CAs issue certs to subjects (end entities).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Define ‘certificate chaining’ or ‘chain of trust’

A

Method of validating a certificate by tracing each CA that signs the certificate, up through the hierarchy to the root CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Define a ‘Self-signed Certificate’

A

A digital certificate that has been signed by the entity that issued it (any machine, webserver or code), rather than by a CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the process to register with a CA?

A

End users create an account with the CA and become authorized to request certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the contents of a ‘certificate signing request (CSR)’?

A

A Base64 ASCII file containing the information that the subject wants to use in the certificate, including its public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Define a ‘common name (CN)’

A

X.500 certificate identifier expressing a host or username; The subject identifier for a digital certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Define a ‘subject alternative name (SAN)’

A

X.500 certificate identifier allowing a host to be represented by multiple host names/subdomains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What takes precedence in a certificate, a subject alternative name (SAN) or common name (CN)?

A

If a certificate is configured with a SAN, the browser should validate that and ignore the CN value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Define a ‘wildcard certificate’

A

A digital certificate that will match multiple subdomains of a parent domain using a ‘’ as the subdomain before the parent domain (.comptia.org)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are the two types of invalid certificates?

A
  1. Revoked - no longer valid and can’t be unrevoked
  2. Suspended and can be reenabled
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Define a ‘certificate revocation list (CRL)’

A

A list maintained by a CA of all revoked and suspended certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is the purpose of a certificate revocation list (CRL)?

A

To inform users whether a certificate is valid, revoked, or suspended.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Where can a certificate revocation list (CRL) be found for browsers to check validity of certs?

A

Each certificate should contain information for the browser on how to check the CRL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are the 4 attributes of a certificate revocation list (CRL)?

A
  1. Publish Period
  2. Distribution Points
  3. Validity Period
  4. Signature
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Define the ‘Publish Period’ attribute of a certificate revocation list (CRL)

A

Date and time at which the CRL is published. Most CAs are set up to publish the CRL automatically.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Define the ‘Distribution Point(s)’ attribute of a certificate revocation list (CRL)

A

Location(s) to which the CRL is published.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Define the ‘Validity Period’ attribute of a certificate revocation list (CRL)

A

Period during which the CRL is considered authoritative. This is usually a bit longer than the publish period

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Define the ‘Signature’ attribute of a certificate revocation list (CRL)

A

CRL is signed by the CA to verify its authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Define an ‘Online Certificate Status Protocol (OCSP)’ server

A

Allows clients to request the status of a digital certificate by querying the certificate database directly instead of relying on a CRL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Define ‘Key management’

A

Operational considerations for the various stages in a key’s lifecycle.

68
Q

What are the 4 stages in a key’s lifecycle?

A
  1. Key Generation
  2. Storage
  3. Revocation
  4. Expiration/Renewal
69
Q

Define the ‘Key Generation’ stage in the key management lifecycle

A

Creating an asymmetric key pair or symmetric secret key

70
Q

What is the purpose of the ‘Storage’ stage in the key management lifecycle

A

Prevents unauthorized access to a private/secret key and protecting against loss or damage.

71
Q

Define the ‘Revocation’ stage in the key management lifecycle

A

Prevents use of the key if it is compromised.

72
Q

What is best practice if a key is revoked?

A

Re-encrypt any data encrypted by the revoked key with a new key.

73
Q

Define the ‘Expiration and Renewal’ stage in the key management lifecycle

A

Every certificate expires after a certain period; Certificates can be renewed with the same key pair or with a new key pair.

74
Q

Define a decentralized key management model

A

Keys are generated and managed directly on the computer or user account that will use the certificate.

75
Q

Define a key management system

A

Centralizes generation and storage of cryptographic keys.

76
Q

Define ‘Key Management Interoperability Protocol (KMIP)’

A

Client/server communication protocol for the storage and maintenance of key, certificate, and secret objects.

77
Q

How are cryptographic keys generated?

A

Generated using a random process with a high degree of disorder.

78
Q

Define ‘entropy’

A

A measure of disorder; Cryptographic systems should exhibit high entropy to better resist brute force attacks.

79
Q

What is the drawback of generating a key pair or secret key on a host running general purpose OS?

A

Computer hardware and software is extremely low entropy.

80
Q

What two technical controls can be implemented to ensure strong key generation?

A

pseudo RNG (PRNG) software and true random number generator (TRNG) hardware.

81
Q

Define ‘pseudo RNG (PRNG) software’

A

Software that is still deterministic, but able to approximate a high level of disorder

82
Q

Define ‘true random number generator (TRNG) hardware’

A

Generates random key values by sampling physical phenomena (noise/air movement) that has a high rate of entropy.

83
Q

What is the drawback of storing a key pair or secret key on a host/file system running general purpose OS?

A

Could easily be compromised via user credential or physical theft of the device; Difficult to ensure that key access is fully audited.

84
Q

What is best practice to securly monitor cryptographic keys?

A

Tamper evident; Immediately known when a private/secret key has been compromised.

85
Q

Define a ‘cryptoprocessor’

A

Dedicated hardware for key generation and storage and can decrypt and sign on behalf of applications.

86
Q

What is the security benefit of a cryptoprocessor?

A

Creates smaller attack surface for key management because key material never leaves the cryptoprocessor.

87
Q

What are the two main implementations of cryptoprocessor hardware?

A
  1. Trusted Platform Module (TPM)
  2. Hardware security module (HSM)
88
Q

Define a ‘Trusted Platform Module (TPM)’

A

Implemented as a module within the CPU on a computer or mobile device.

89
Q

Define a ‘Hardware security module (HSM)’

A

Implemented in a removable or dedicated form factor, including rack-mounted appliances, plug-in PCIe adapter cards, and USB-connected security keys; Can be provisioned as a virtual appliance.

90
Q

How does a cryptoprocessor decrease attack surface?

A

Keys are not directly accessible via the file system.

91
Q

How do cryptoprocessors interact with applications that need to access a key?

A

Via an application programming interface (API)

92
Q

Define an ‘Application programming interface (API)’

A

Mechanisms that enable two software components to communicate with each other using a set of definitions and protocols.

93
Q

What is the mechanism implemented to mitigate vulnerabilities in cryptoprocessors?

A

A trusted execution environment (TEE) secure enclave

94
Q

Define a ‘trusted execution environment (TEE) secure enclave’

A

CPU extensions that protects data stored in system memory so that an untrusted process cannot read it.

95
Q

What is a vulnerability with cryptoprocessors?

A

Decrypted data needs to be loaded into the computer’s system memory (RAM) for applications to access it raising the potential for a malicious process to gain access to the data via some type of exploit.

96
Q

How do secure enclaves (Trusted Execution Environments, TEEs) protect API’s moving data from a cryptoprocessor to another application?

A

Only authorized processes can have access, regardless if it has system/root privilege.

97
Q

What is the result of a misplaced/damaged cryptographic key?

A

Ciphertexts cannot be recovered unless a backup of the key has been made.

98
Q

Why is it against best practice to make backups of private keys or secret keys?

A

Problematic as it becomes more likely that a copy will be compromised and more difficult to detect that a compromise has occurred.

99
Q

What are controls to mitigate issues of making copies of a private key/secret key?

A
  1. Escrow
  2. M of N controls
100
Q

Define ‘Escrow’ in key management

A

The storage of a backup key with a third party.

101
Q

Define ‘M of N controls’ in key management

A

An operation cannot be performed by a single individual; A quorum (M) of available persons (N) must agree to authorize the operation.

102
Q

How can risks of a compromised private key be reduced?

A

Splitting the key in to parts, and each part being held by sperate escrow providers.

103
Q

Define a ‘key recovery agent (KRA)’

A

An account authorized to access a key held in escrow.

104
Q

What should be included in a key recovery policy to mitigate impersonation?

A

Require two or more KRAs to authorize an operation.

105
Q

How does encryption fulfill the goal of confidentiality?

A

Threat actor will not be able to understand or change what has been stolen.

106
Q

List the 3 states data can be described as?

A
  1. Data at rest
  2. Data in transit
  3. Data in use
107
Q

Define ‘Data at rest’

A

When the data is in some sort of persistent storage media.

108
Q

Define ‘Data in transit’

A

Data transmitted between two hosts, such as over a private network or the Internet.

109
Q

Define ‘Data in use’

A

Data present in volatile memory, such as system RAM or CPU registers and cache.

110
Q

Define ‘bulk encrypton’

A

Encrypting megabytes or gigabytes of data.

111
Q

What encryption method is best suited for bulk encryption?

A

Symmetric encryption due to overhead of asymmetric.

112
Q

Define an ‘encryption level’

A

Depth of encryption; Ranging from more granular (file/folder or row/record) to less granular (volume/partition/disk or database).

113
Q

Define ‘Full-disk encryption (FDE)’

A

Disk/Drive firmware that encrypts the full contents of a storage device, including metadata, free space.

114
Q

What is the purpose of Full-disk encryption (FDE)?

A

Protects against physical theft of the disk.

115
Q

What is a software/firmware alternative to Full-disk encryption (FDE)?

A

A self-encrypting drive (SED).

116
Q

Define a ‘A self-encrypting drive (SED)’

A

Storage device (SSD/HDD/USB) with cryptoprocessor firmware that can perform self-encryption and storage of keys.

117
Q

Define a ‘volume’

A

Any storage resource with a single file system; The way the OS “sees” a storage resource.

118
Q

What can be defined as a ‘volume’?

A

A removable disk; Partition on an HDD or SSD; RAID array.

119
Q

What makes self-encrypting drives less secure?

A

Typically only encrypts volumes, implemented as a software application rather than disk firmware.

120
Q

What is the difference between ‘Full-disk encryption (FDE)’ and ‘Self-encrypting drive (SDE) software’?

A

Self-encrypting drive (SDE) software
may or may not encrypt free space and/or metadata.

121
Q

Define a ‘file encryption product’

A

Software that applies encryption to individual files (or perhaps to folders/directories).

122
Q

What products are defined as A self-encrypting drive?

A

Microsoft’s BitLocker and Apple’s FileVault products perform volume encryption.

123
Q

What are the two methods of encrypting a database?

A
  1. Database-level encryption
  2. Record-level encryption
124
Q

Define how ‘Database/Page-Level Encryption’ functions

A

All records and logs are encrypted while they are stored on disk.

125
Q

How does ‘Database/Page-Level Encryption’ manage the transfer of data between an application and storage?

A

Encryption and decryption occurs when any data is transferred between disk and memory.

126
Q

Define how ‘Record-Level Encryption’ is implemented

A

DBA determines which fields need encryption with asymmetric encryption.

127
Q

How does ‘Record-Level Encryption’ or ‘Cell/column encryption’ leverage PKI?

A

Storing the private key used to unlock the value of a cell outside of the database.

128
Q

How does ‘Record-Level Encryption’ protect the transfer of data between storage and an application?

A

Data remains encrypted when loaded into memory; It is only decrypted when the client application supplies the key in the DBMS.

129
Q

Define ‘Transport/communication encryption’ and its function

A

Protects data-in-motion using key exchange.

130
Q

Define ‘key exchange’

A

Any method by which cryptographic keys are transferred between users, enabling the use of a cryptographic algorithm.

131
Q

What protocols are commonly used for Transport/communication encryption?

A

Wi-Fi Protected Access (WPA), Internet Protocol Security (IPsec), Transport Layer Security (TLS).

132
Q

Define ‘Wi-Fi Protected Access (WPA)’ and its purpose

A

Securing traffic sent over a wireless network.

133
Q

Define ‘Internet Protocol Security (IPsec)’ and its purpose

A

Secured traffic sent between two endpoints over a public or untrusted transport network - refereed to as a VPN.

134
Q

Define ‘Transport Layer Security (TLS)’ and its purpose

A

Securing application data, such as web or email data, sent over a public or untrusted network.

135
Q

What protocol is used to ensure integrity/confidentiality of transport encryption?

A

Cryptographic protocol ‘Hash-based Message Authentication Code (HMAC)’.

136
Q

Define the purpose and function of ‘Hash-based Message Authentication Code (HMAC)’

A

Provides confidentiality/integrity for a message by combining a cryptographic hash of the data with a symmetric secret key.

137
Q

Define the function of ‘Perfect Forward Secrecy (PFS)’

A

Periodically creates a new key value based on data supplied by both parties in the exchange.

138
Q

What is the security benefit of ‘Perfect Forward Secrecy (PFS)’

A

Ensures if a key is compromised, the compromise will only affect a single session and not facilitate recovery of plaintext data from other sessions.

139
Q

What cipher does Perfect Forward Secrecy (PFS) use to implement new session keys?

A

Diffie-Hellman (D-H) key agreement to create ephemeral session keys.

140
Q

Define an ‘ephemeral session key’

A

Created by Diffie-Hellman (D-H), a key that is used within the context of a single session only.

141
Q

What is the purpose of ‘salting’ and ‘key stretching’?

A

Help to protect password-derived cryptographic secrets from discovery through cryptanalysis.

142
Q

Define a ‘salt’ or the process of ‘salting’

A

Adds a random value to each plaintext input.

143
Q

Define a ‘salted hash’

A

The combination of a password and salt, input into a hashing algorithm outputs a salted hash.

144
Q

Why is salting crucial for secure password storage?

A

Mitigates the risk that if users choose identical plaintext passwords, there won’t be identical hash values in the password file.

145
Q

Define ‘Key Stretching’

A

A salted hash repeatedly inserted into a hashing algorithm to multiply length and disorder.

146
Q

Define ‘Blockchain’

A

A decentralized/public ledger containing a growing list of records secured using cryptographic hashing.

147
Q

How does ‘Blockchain’ function?

A

A record (block) is has a hash value, the hash value of the previous record is added to the hash calculation of the next record in the chain.

148
Q

What is security benefit of blockchain?

A

Ensures integrity of all historical records (blocks); Each block validates the hash of the previous block.

149
Q

Where are blockchain records kept?

A

Recorded in an open public ledger.

150
Q

Define an ‘open public ledger’

A

Distributed public record of transactions.

151
Q

Define the means of which a ledger is made open to the public

A

Decentralized peer-to-peer (P2P) network.

152
Q

What is the purpose of a decentralized peer-to-peer (P2P) network?

A

Mitigate the risks a of a single point of failure/compromise ensuring equal trust between users.

153
Q

What are the potential applications of blockchain technology?

A

Ensure the integrity and transparency of financial transactions, legal contracts, copyright and intellectual property (IP) protection, online voting systems, identity management systems, and data storage.

154
Q

Define ‘Obfuscation’

A

Security through obscurity; Technique that “hides” or “camouflages” code or data so that it is difficult to find.

155
Q

What are 3 forms of obfuscation?

A
  1. Steganography
  2. Data masking
  3. Tokenization
156
Q

Define ‘Steganography’

A

Hiding the presence of data, often by embedding information within a file or other entity called ‘covertext’

157
Q

Define ‘De-identification’

A

Obfuscates personal data from databases so that it can be shared without compromising privacy.

158
Q

Define ‘Data masking’

A

De-identification method; Generic/placeholder labels are substituted for real data while preserving the structure or format of the original data.

159
Q

Define ‘Tokenization’

A

De-identification method where a unique token is substituted for real data.

160
Q

How is a token stored, and how can it be interacted with?

A

Token is stored with the original value on a dedicated token server/vault; An authorized query or app can retrieve the original value from the vault.

161
Q

In an FDE product, what type of cipher is used for a key encrypting key (KEK)?

A

An asymmetric cipher (RSA or ECC) private key.

162
Q

In an FDE product, what type of cipher is used for a data encrypting key (DEK)?

A

A secret symmetric key to perform bulk encryption of a disk.

163
Q

What is the primary reason to avoid the use of MD5?

A

Propensity for collisions.

164
Q

What cipher and key length is best practice for asymmetric key pair signing?

A

RSA 2,048-bit or ECC 256-bit.

165
Q

What cipher and key length is best practice for asymmetric key pair exchange?

A

RSA 2,048-bit or ECDHE 256-bit.

166
Q

What cipher and key length is best practice for a symmetric secret key?

A

AES-128 or AES-256

167
Q

What cipher and key length is best practice for hashing?

A

SHA256 or SHA512; MD5 allowed for documented compatibility requirements.

Security+ (SY0-701) (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions