Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Module 03 - Criptography > Flashcards

Module 03 - Criptography Flashcards

1
Q

Definition:
Cryptography

A

The process of writing or solving messages using a secret code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Definition:
Security through obscurity

A

Protecting by hiding something

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Definition:
Encryption

A

A form of cryptography, it’s a process of converting text into unintelligible text, or a ciphertext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Definition:
Ciphertext

A

Encrypted text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What’s Cryptanalysis?

A

The art of cracking cryptographic systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are Encryption Keys?

A

String used to encrypt and decrypt messages, generated by ciphers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What kinds of encryption keys are there?

A

Symmetric and Assymetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Definition:
Symmetrick algorithm

A

The same key that encrypts also decrypts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Definition:
Asymmetric algorithm

A

Uses a public key to encrypt and a private key to decrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Definition:
Hashing

A

The process of converting one value into another, no decrypting, no duplicates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Definition:
Salt [Hashing]

A

It’s the process of fixating a string at the end of a value before hashing it, to generate a completely different hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What’s a Digital Signature?

A

Verifies that data is legitimate, non-repudiation.

Private key + Hash of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What’s non-repudiation?

A

The concept of not being able to disassociate the ‘cause’ from the ‘consequence’.
Audit trails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Acronym:
ECC

A

Elliptic Curve Cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Definition:
Elliptic Curve Cryptography - ECC

A

Cryptography method that generates more complex and smaller encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Definition:
Perfect Forward Secrecy

A

Most used in messaging apps, uses a different encryption key for each message in the same conversation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Definition:
Steganography

A

Technique of hiding files, messages, bytes in other files, messages or bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Definition:
Cipher or Encryption Algorithm

A

Cryptographic process that encodes and decrypts data, using encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the types of ciphers?

A
  1. Substitution and Transposition algorithm
  2. Symmetric Algorithm
  3. Asymmetric Algorithm
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Acronym:
AES

A

Advances Encryption Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

True or false:
The larger the key’s length the more memory and processing power to encrypt/decrypt

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Definition:
Brute force cryptoanalysis

A

Attempt to decrypt a ciphertext with every possible key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

True or false:
Symmetric algorithm is more processing consuming that Asymmetric

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

List common asymmetric algorithms

A
  1. RSA
  2. ECC
  3. DSA
  4. Diffie-Hellman
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Acronym:
RSA

A

Rivest-Shamir-Adleman

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Acronym:
DSA

A

Digital Signature Algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What RSA is used in?

A

Mostly in creating digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What DSA is used in?

A

Only in creating digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What Diffie-Hellman is used in?

A

Security protocols such as TLS, SSH, IPSec and others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What ECC is used in?

A

Securing data transmission, mainly in websites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are Hybrid Cryptosystems?

A

Combine the efficiency of symmetric encryption with the convenience of asymmetric encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Describe the process in Hybrid Cryptosystems

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Definition:
Ephemeral Keys

A

Encryption keys generated for each new session or message sent, used in PFC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Acronym:
PFS

A

Perfect Forward Secrecy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Definition:
Open Public Ledger

A

Distributed public record of transactions that supports the integrity of blockchains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Definition:
Blockchain

A

Expanding list of transactions protected by cryptography.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Definition:
Blocks, [In blockchain]

A

It’s a record of a transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How are the blocks linked criptographycally?

A

The hash value of the previous block in the chain is added to the hash calculation of the next block in the chain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is in a block?

A
  • Time
  • Date
  • Parties involved
  • A unique hash that separates the block from other blocks on the chain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are the applications of blockchain?

A

Financial transactions
Legal contracts
Copyright and Intelectual property
Online voting systems
Identity Management System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Definition:
Mining [In blockchain]

A

It’s the process of adding block to the chain, by generating the 64-digit hexadecimal based hash

42
Q

What are the most common cryptographic attacks?

A
  1. Dictionary Attack
  2. Collision Attack
  3. Birthday Attack
  4. Downgrade Attack
43
Q

Definition:
Dictionary Attack

A

The use of a list of words and phrases to try to guess the decryption key.

44
Q

Definition:
Collision Attack

A

A collision attack tries to find two inputs that produce the same hash value.

Done to fake digital signatures

45
Q

Definition:
Birthday Attack

A

This attack combines a collision attack and a brute-force attack. The name is taken from the birthday probability math problem.

46
Q

Definition:
Downgrade Attack

A

Forcing systems to use an older, less secure communication protocol.

47
Q

Definition
Cryptographic primitive

A

Single hash function, symmetric or asymmetric ciphers

48
Q

Definition:
Key Streching

A

Salts an encryption key, and converts it to a longer and disordered key

49
Q

What are the most common hash uses?

A
  1. File Integrity
  2. Digital Signaturee
  3. Secure Logon Credential exchamge
50
Q

Definition:
Hash collision

A

Hashing is a good file verification method, but it is not perfect. Depending on the algorithm used, there is a potential for hash collisions.

51
Q

Most popular hashing algorithm

A

SHA
MD5
HMAC
RIPEMD

52
Q

Acronym:
SHA

A

Secure Hashing Algorithm

53
Q

Acronym:
MD5

A

Message-Digest Algorithm 5

54
Q

Acronym:
HBMSC

A

Hash-Based Message Authotication Code

55
Q

What are the 3 states of data?

A
  1. Data in transit
  2. Data at rest
    3 . Data in use [RAM, registers]
56
Q

What are the types of disk and file encryption?

A
  1. Full-disk Encryption and partition encryption
  2. Volume and file encryption
  3. Database encryption
  4. Database-level encryption
  5. Record-level encryption
57
Q

What are the most common data transport encryption? And where are they used?

A
  1. WPA (Wi-fi)
  2. IPSec (VPN)
  3. TLS (Internet)
58
Q

Acronym:
WPA

A

Wi-Fi Protected Access

59
Q

Acronym:
IPSec

A

Internet Protocol Security

60
Q

Acronym:
TLS

A

Transport Layer Security

61
Q

Acronym:
EFS

A

Encrypting File System

62
Q

Definition:
Encrypting File System - EFS

A

EFS combines the speed of symmetric encryption with the convenience of asymmetric encryption using a process called key encapsulation.

63
Q

Definition:
Pretty Good Privacy (PGP)

A

PGP is a product by Symantec that encrypts devices

64
Q

Definition:
GNU Privacy Guard (GPG)

A

GNU Privacy Guard (GPG) is an encryption tool that encrypts emails, digitally signs emails, and encrypts documents

65
Q

Acronym:
GPG

A

GNU Privacy Guard

66
Q

Acronym:
PGP [Encryption Software]

A

Pretty Good Privacy

67
Q

Acronym:
PKI

A

Public Key Infrastructure

68
Q

Definition:
Public Key Infrastructure

A

Framework that establishes trust in the use of public key cryptography to sign and encrypt messages via digital certificates.

Aims to prove that the owners of public keys are who they say they are

69
Q

Difinition:
Digital certificate

A

Public assertion of identity validaded by a certificate authority (CA)

70
Q

Acronym:
CA

A

Certificate Authority

71
Q

Definition:
Certificate Authority

A

Entity that guarantees a digital certificate’s validity

Comodo, DigiCert, GeoTrust, IdenTrust, and Let’s Encrypt.

72
Q

What standard is used on Digital Certificates?

A

X.509 standard

Approved by the International Telecommunications Union

Standardized by the Internet Engineering Task Force

73
Q

What are the digital certificate’s attributes? What information does it hold?

A
  1. Version
  2. Serial Number
    Signature algorithm [Cryptographic Algorithm]
  3. Issuer - CA
  4. Valid From and Valid To
  5. Subject
  6. Public Key [Encryption algorithm]
74
Q

Aside from expiration, what other reasons a certificate might be invalidated?

A
  1. The organization no longer exists.
  2. The private key has been compromised.
  3. The issued certificate is discovered to be fake.
75
Q

Acronym:
CRL

A

Certificate Revocation List

76
Q

Definition:
Certificate Revocation List - CRL

A

Blacklist of expired or untrustworthy certificates maintained by CAs

77
Q

Acronym:
OSCP

A

Online Certificate Status Protocol

78
Q

Definition:
Online Certificate Status Protocol - OSCP

A

Internet protocol used to determine the validity or state of a certificate.

79
Q

Why use OSCP rather than CRL?

A
  • Faster validation
  • No need to download the entire CRL.
  • A grace period for expired certificates.
80
Q

List the certificates types

A
  1. Root certificate
  2. Subject Alternative Name (SAN) certificate
  3. Wildcard certificate
  4. Code-signing certificate
  5. Self-signed certificate
  6. Email certificate
  7. User and computer certificate
81
Q

Definition:
Root certificate

A

Emitted by a CA, basically a self-signed certificate

82
Q

Definition:
Subject Alternative Name (SAN) certificate

A

Allows organizations to use the same certificate for different domain names

83
Q

Definition:
Wildcard certificate

A

Similar to SAN certificate, instead of multiple domain names allows the use for different subdomains

84
Q

Definition:
Code-signing certificate

A

Used by app developers to prove their application is legitimate.

85
Q

Definition:
Self-signed certificate

A

Self-signed certificates are certificates that have not been validated or signed by a CA.

86
Q

Definition:
Email certificate

A

Used to secure email communication.

87
Q

Definition:
User and computer certificate

A

User and computer certificates are used in a network environment to identify and validate specific users or computers.

88
Q

Acronym:
CSR

A

Certificate Signing Request

89
Q

Definition:
Certificate Signing Request - CSR

A

The CSR is a file containing the information the subject wants to use in the certificate, including its public key, sent to the CA to sign.

90
Q

Acronym:
FQDN

A

Fully Qualified Domain Name

91
Q

What is the field SAN used for?

A

Structured to represent different types of identifiers, including FQDNs and IP addresses.

92
Q

What is the field CN - Common Name

A

Previous used to identify the FQDN, it’s now deprecated

93
Q

What are the attributes of a CRL - Certificate Revocation List?

A
  1. Publish Period
  2. Distribution Point(s)
  3. Validity Period
  4. Signature - the CRL is signed by the CA
94
Q

Definition:
Root of Trust Model

A

Defines how users and different CAs can trust one another. It’s the root certificate

95
Q

Definition:
Single CA Model

A

In this simple model, a single root CA certificates directly to users and computers.

96
Q

Definition:
Hierarchical model - Third Party CAs

A

The root CA issues certificates to one or more intermediate CAs.

The intermediate CAs issue certificates to subjects (leaf or end entities).

97
Q

Definition:
Certificate chaining/Chain of trust

A

Each leaf certificate can be traced to the root CA along the certification path, in the hierarchical model.

98
Q

What are the main methods to keep Private Key Safety

A
  1. Key archival
  2. Key escrow
99
Q

Definition:
Key archival Method

A

The private key is sent securely and backed up by the CA.

100
Q

Definition:
Key escrow

A

Refers to archiving a key (or keys) with a third party. A key can be split into more parts.

Each part can be held by separate escrow providers, reducing the risk of compromise.

101
Q

Acronym:
KRA

A

Key Recovery Agent

102
Q

Definition:
Key Recovery Agent - KRA

A

Account with permission to access a key held in escrow, usually required two or more KRA to authorize the operation.

Security+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions