Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Principles of Cyber Security > Part 1 > Flashcards

Part 1 Flashcards

1
Q

What are the 3 aspects of the CIA triad?

A

Confidentiality: No unauthorised reading/learning of data.
Integrity: No unauthorised modification or destruction.
Availability: Timely and reliable access to data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is non-repudiation?

A

The assurance that an entity cannot deny having done an action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is authenticity?

A

Property of being genuine and being able to be verified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is accountability?

A

Property that an action should be able to be traced back to the entity that performed it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the assets of a security system?

A

Software
Hardware
Data
Communication facilities and networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 3 types of vulnerability?

A

Leaky: Unauthorised access
Unavailable: Slow, using becomes impossible/impractical
Corrupted: wrong thing/wrong answers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an attack?

A

A thread that is carried out.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two attack classifications?

A

Active: Attempt to alter/affect operation of assets.
Passive: Attempt to learn/make use of information from a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an inside attack?

A

An attack initiated by an entity inside the security perimeter.
The entity has authorised access to the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an outside attack?

A

An attack initiated by someone outside the security perimeter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a risk?

A

Measure of the extent to which an asset is threatened by a potential circumstance/event.
The likelihood of occurance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a countermeasure?

A

An action that mitigates the effects of an attack/risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is encryption?

A

Transformation of information using a secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is access control?

A

Rules, policies and mechanisms that limit access to resources to those people/systems with a “need to know”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a “need-to-know” determined by?

A

Identity

Role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is authorisation?

A

Determining whether a person or system is allowed to access resources, based on an access policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is authentication?

A

Determination of role/identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How can an entity be authentication?

A

Something they have (smart card)
Something they know (password)
Something they are (biometrics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is physical security?

A

The physical barriers and restrictions used to improve the security of resources and components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are examples of physical security?

A

Copper meshes in walls
Locks
Placement of computers in windowless rooms.
Sound dampening materials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are backups?

A

Periodic archiving of data to enable restoration in the event of failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are checksums?

A

Functions turning a file into a numerical value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does a checksum function rely on?

A

The whole file.

Flipping a single bit should change the output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are computational redundancies?

A

Computers/storage devices that serve as fallbacks in the case of failures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is symmetric encryption?

A

Encryption using a single, secret key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is asymmetric encryption?

A

Encryption using a public-private key pair.

Public for encryption, private for decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the RSA process?

A
  1. Choose 2 prime numbers (p and q).
  2. Calculate N (N = pq).
  3. Calcuate T (T = (p-1)(q-1)
  4. Choose numbers e,d where ed mod T = 1.
  5. PU = (N,e), PR = (N,d)

To encrypt: (message)^e
To decrypt: (message)^d

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a digital signature?

A

Encryption of the hash of a message using the senders private key that can be used to authenticate their identity using their private key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a Man-In-The-Middle attack?

A

An attack where communication is intercepted by a third party.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a primitive root?

A

N is a primitive root of the prime q if its powers mod q is an integer in the range 1-(q-1).
(2,13),(2,17)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a discrete logarithm?

A

i is the discrete logarithm of b:

b = a^i mod q

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the diffe-hellman process?

A

Explain it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the job of a certificate?

A

BInd a user/company identity to their public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the mandatory fields of a certificate?

A 
Version
Serial Number
Signature
Issuer
Validity
Subject
Public Key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the PKI?

A

Public Key Infrastructure.

Set of hardware, software, people, processes and policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the role of the PKI?

A

Faciliate the creation of a verifiable association between a public key and the identity of the holder of the corresponding private key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What cryptography does the PKI use?

A

Asymmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the job of the CA?

A

Certification Authority

Issue, revoke and distribute public key certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How are certificates signed?

A

Using the private key of the CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is the PKI repository?

A

A means of storing and distributing x.509 certificates and CRL, and managing updates to certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the job of the RA?

A

Registration Authority.

Verify user request for a certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the process of certificate issuance?

A
  1. RA verifies user request.
  2. User chooses PR, CA chooses PU.
  3. Certificate issued by CA.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the process of certificate usage?

A

1 . User fetches certificate.

  1. User fetches CRL.
  2. User checks that the certificate is valid using CRL.
  3. User checks the signature using certificate.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are the reasons for certificate revocation?

A

Compromised private key
Company moves physical address
Expiration
HR reasons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is a CRL?

A

Certificate Revocation List.

List of no longer valid certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the issues of a CRL?

A

Expensive to distribute.
Updates not sent quickly enough to defend against atttacks.
Vulnerable to DOS attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the mandatory fields of a CRL?

A 
Version
Signature
This Update
Next Update
Revoked Certificates [ ]
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is TSL?

A

Transport Layer Security Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What does the TLS provide?

A

Privacy and data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are the 2 protocols of TLS?

A

Handshake protocol.

Record protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the handshake protocol?

A

User sends: Client hello, protocol version, suite of supported cryptographic algorithms.
Server responds: Highest common version and suite, public key certificate (with key).
Client checks certificate, generates secret key and sends to server using its public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

How does a client check the certificate of a server?

A

The certificate is signed by the private key of the CA, so can be verified using the public key of the CA which is included in browsers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is kerberos?

A

Network Authentication Protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What encryption does kerberos use?

A

Symmetric encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What are the goals of kerberos?

A

Usrs password shouldn’t travel on the network.
Single login for a session
Client and servers mutually authenticate.
User passwords never stored
Authentication information centralised on the authentication server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is a realm in kerberos?

A

The users and services authenticated by a KDC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is a principal?

A

User, application server, sevices on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is a ticket in kerberos?

A

Proof of id for a user to access a service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is the KDC?

A

Key Distribution Center.`

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What does the KDC store?

A

A database of principals and their master keys generated using their passwords.
Database is encrypted using the master key of the KDC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are the 3 components of the KDC?

A

Database
Authentication Server
Ticket Granting Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is phase 1 of Kerberos?

A

User requests ticket.
AS generates SA.
AS generates TGT: (Username, SA, T1)
AS encrypts TGT with KDC master key.
AS sends to user, encrypting with user’s key KA.
User logins in, KA generated from password.
User decrypts and obtains the TGT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What are the limitations of Kerberos?

A

Single point of failure
Requires synchronised clocks
Assumes client’s workstation is secure
Vulnerable to password guessing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What are the 2 steps of User Authentication?

A

Identification, Verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are the problems with passwords?

A

Password Overload
Passwords can be guessed
Must be stored safely
Password reuse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

How can an attack crack a password?

A 
Brute Force
Shoulder Surfing
Dumpster Diving
Guessing
Interception
Key Logging
Social Engineering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is phising? + countermeasure

A

Using a fake site to gain credentials to be used on a target site.
CM: Server-side authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is interception? + countermeasure

A

Clear text information intercepted by an attacker (man in the middle)
CM: Encrypt communication among users and website.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is keylogging?

A

Using software to record the keys typed by users.
Can get passwords from this.
E.g. Kidlogger, Revealer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What are the countermeasures for Shoulder Surfing and Dumpster Diving?

A

User Training and awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What are the 2 types of password attacks?

A

Offline/Online

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

How many combinations are the for a brute force attack?

A

(Length of alphabet)^(length of password)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What is an online dictionary attack?

A

An attack that tries passwords from a dictionary of words, common passwords, important words to the user (name, address, pet…) etc.
Not 100% guarenteed to crack the password, but can lead to less trials and time needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What are good countermeasures for password cracking?

A

Throttling
Locking
Protective Monitoring
Password Blacklisting (common passwords)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is password strength?

A

The effectiveness of a password against a brute force attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is password entropy?

A

nlog(A)/log(2)

77
Q

What is an offline dictionary attack?

A

An attack that tries to crack passwords in a password file.

The attacker tries passwords from a dictionary of common passwords and compares the hashes.

78
Q

What are the countermeasures for an offline dictionary attack?

A

Hashing
Salting
Password File access (only priviledged users)
Separation of user ids to passwords

79
Q

What are the properties of a good hash function?

A

Non-reversible
Fixed length
Unique for each input

80
Q

What is salting?

A

The process of adding random bits to a password, then hashing the result to make a brute force attack even harder.

81
Q

What is the salting process?

A
  1. Compute hash of the password.
  2. Add salt (prepend/append).
  3. Hash the result.
  4. Store the hash and salt
82
Q

What can be used to crack passwords?

A

Pwdump

L0phtcrack

83
Q

What are the password cracking methods?

A

Brute force
Dictionary: Only as good as your dictionary
Hybrid

84
Q

What is a reduction function? + examples

A

A function that transforms a hash into a new string (possible password0 to be hashed.
E.g : First 6 letters, first 6 characters, last 5 numbers etc.

85
Q

What is the rainbow table process?

A
  1. Precompute hashes, apply red. funcs, compute hashes etc. to create the rainbow table. Only store first and last column.
  2. Apply last red. func to hash to crack.
  3. Check if result is in the table.
  4. If so, go to the start of that row, and compute the hashes until the plaintext is found. (Its the plaintext that generates the hash.)
  5. If not, apply the penultimate red. func, last red. func, check.
  6. Repeat until row is found.
  7. Go to the start of the row and calculate the hashes forward until the correct value is found.
86
Q

Why are rainbow tables used?

A

They are a good trade off between time and space.

87
Q

What is online and offline cracking?

A

Offline: Password of a program (zip file)
Online: Online service to crack (ssh) - Use hydra.

88
Q

What are the security properties of privacy?

A

Confidentiallity, Integrity, Availability, Accountability

89
Q

What must be considered with privacy?

A

The system as a whole: Software, Hardware, Physical Environment, Legal, Coroporate, Personnel

90
Q

What is confidentiality?

A

Unauthorised reading/learning of data.

Presumes an access control security policy.

91
Q

What is privacy?

A

Keeping individuals information confidential.

92
Q

What is secrecy?

A

Keeping company information confidential.

93
Q

What is anonimity?

A

True identity of an individual is not known and cannot be learned.

94
Q

What is intrusion?

A

Invasive acts that threaten the solitude or tranquility of a person.

95
Q

What is decisional inference?

A

Government’s incursion into the data subjects decisions regarding their private affairs.

96
Q

What is surveillance?

A

The watching, listening to or recording of an individuals activies.

97
Q

What is interrogation?

A

Various forms of questioning and probing for information.

98
Q

What is aggregation?

A

Combining of data about a person.

99
Q

What is identification?

A

Linking information to a particular individual.

100
Q

What is insecuity?

A

Carelessness in protecting stored information from leaks and improper access.

101
Q

What is secondary use?

A

The unconsensual use of data for purposes other than those for which the data was originally collected.

102
Q

What is exclusion?

A

Failure to allow the data subject to know about the data that others have about them and participate in its handling and use.

103
Q

What is a breach in confidentiality?

A

Breaking a promise to keep data confidential.

104
Q

What is disclosure?

A

Releasing information that influences how an individual is jduged.

105
Q

What is exposure?

A

Revealing nudity, greif or bodily functions.

106
Q

What is increased accessibility?

A

Amplifiying accessibility of information.

107
Q

What is blackmail?

A

The threat to relese personal information.

108
Q

What is appropriation?

A

The use of someone’s identity in order to serve another’s aims.

109
Q

What is distortion?

A

Dissemination of false/misleading information about an individual.

110
Q

What is privacy as confidentiality?

A

Data anonymisation, secure messaging, anonymous communication, data minimisation.

111
Q

What is privacy as control?

A

Annonymous credentials, privacy policy languages, purpose-based AC.

112
Q

What is privacy as practice?

A

Feedback and awareness tools, privacy nudges, aid in privacy decision making.

113
Q

What is a privacy policy?

A

Text that specifies how data may be used, under which conditions and what obligations this entails.

114
Q

What are the privacy requirements?

A 
AC requirements
Actions required before access
Actions that must be performed within a certain time period.
Restrictions on further distribution of data.
Restrictions on purpose of use.
Limitations of retention time.
Mandatory use of protection mechanisms
Duties of keeping data up-to-date.
115
Q

What are the 2 pet families?

A

Soft Privacy Technology
Assume trust of 3rd party. (AC, tunnel encryption)
Hard Privacy Technology
No trust of 3rd party. (Tor)

116
Q

What is a data controller, data subject and data analyst?

A

Controller: Entity that collects, holds and controls the data.
Subject: Entities that the data is about.
Analyst: Entities that use the data for studies and predictions.

117
Q

What are the 3 classifications of attributes?

A

Explicit (key) Identifiers: Name, NI
Quasi-identifierL DOB, Postcode
Sensitive: Medical records

118
Q

What is k-anonimity?

A

A record must be indistinguishable from at least k-1 other records with the same quasi-identifier.
There must be at least k records with the same equivalence class.
If this holds for each quasi-identifer, a table is k-anonymous.

119
Q

How can k-anonimity be achieved?

A

Generalisation: Making quasi-identifiers less specific. (>40). Partition ordered-value domains into intervals.
Supression: 478**, if there is too much loss with generalisation.

120
Q

How can k-anonimity be attacked?

A

If the attacker has backgroud information (background knowledge attack).
If there is not enough diversity in sensitive attributes for each equivalence class. (Homogeniety attack).

121
Q

What is l-diversity?

A 
If an equivalence class has at least l well represented values, then it has l diversity.
If all equivalence classes have l-diversity, the table is l-diverse.
122
Q

What is distinct l-diversity?

A

Each equivalence class at at least l sensitive values for the field.

123
Q

What is a limitation of l-diversity?

A

It doesn’t protect again senstive attribute disclosure.

Doesn’t consider overall distribution of sensitive values.

124
Q

What is sensitive attribute disclosure?

A

The attacker can make broader claims about an individual. (Salary range, illness domain - mental illness, stomach illness)
This is a similarity attack.

125
Q

What is t-closeness?

A

The distribution of sensitive values in each equivalence class should be within a threshold t of the original distribution.

126
Q

What is differential privacy?

A

The probability of a result of a query being nearly the same, regardless of whether a individual is included in the dataset.

127
Q

Why is a proxy not fully anonymous?

A

The proxy server knows where information is coming from and going to.
The sender is not known to the recevier and vice versea, but known to the proxy.

128
Q

What is a VPN?

A

Virtual Private Network.

Can make computers outside a network be treated as if they are in the network.

129
Q

What is encapsulation in a VPN?

A

The wrapping of a message for travel over a channel into a VPN. It is unwrapped once it arrives, and is then treated as normal network traffic.

130
Q

Why are VPNs good?

A

Provide anonymity.
Can access sensitive resources from outside of a network.
Can be used to simulate current position to that of the server (US Netflix).

131
Q

What is a mix network?

A

A routing protocol that sends traffic to different proxy servers to reach a final destination.

132
Q

What is the process of a mix network?

A
  1. Path identified by the user, public keys of servers collected.
  2. Layers of encryption added to message using each public key.
  3. Message sent along the path.
133
Q

Why is a mix network anonymous?

A

Each server only knows its direct neighbours in the path.

134
Q

How are replied returned to the user?

A

The server sends the data to the last in the path, it encrypts the reply using a key given to it by the user when the first request was sent. Then the data is passed up the path, each with a new layer of encryption being given to it.
Once it reaches the user, it is decrypted.

135
Q

What are the 3 nodes in Tor network?

A

Guard, relay, exit

136
Q

What is the job of a Tor browser?

A

To provide a path of nodes for the user to use to send a message.

137
Q

What is perfect forward secrecy?

A

Using keys of each server to encrypt the data, so no nodes can access the data.

138
Q

What are the 2 types of relay node?

A

Bridge node: Unlisted

Advertised

139
Q

How is 2-way anonimity achieved?

A

A rendezvous point is agreed on by a user and server. Messages are routed using paths to this point.
A server will register an Onion URL which can be accessed via a Tor browser. Server has introduction points, via a path, which is used to agree the rendezvous point.

140
Q

What is the process of E-voting in Estonia?

A 
Voter uses ID card and PinPad.
ID card and PinPad used to create key. 
Key used to authenticate website.
Users uses second key to confirm vote. 
Vote sent.
Vote encrypted using PU of government or LA.
Vote wrapped with voter's signature.
Vote collected, unwrapped and mixed.
All votes then counted.
141
Q

What is homomorphic encryption?

A

Uses mathematical functions that allow for results to be found without decryption.

142
Q

Where can AC be implemented?

A

Locally or over a network.

143
Q

What is a security policy?

A

Defines which executions are allowed by which users/systems according to a set of measurable, high-level rules.

144
Q

What is a security model?

A

A formal representation of a class of systems, highlighting security features.

145
Q

What are 2 security models?

A

Code based

Database oriented.

146
Q

What is Discretionary Access Control?

A

Principle: Users own resources and control access to them.

Each resource has a DAC list which specfies which entities have which access.

147
Q

What are the issues of DAC?

A

Large systems are complex to manage.
Difficult to understand whether correct permissions have been given to the right users.
The objects and users change frequently, so their permissions need to be update frequently as well.

148
Q

What is Mandatory Access Control?

A

Access control based upon security levels of subjects and objects.
Most systems use multi-level security policies.
Decisions are made by comparing security clearance of a subject with the security clearance of an object.

149
Q

What does each subject have in a MAC system?

A

A clearance and “need-to-know”.
To access a resource, the subject must have a clearance level or higher than that of the resource, and contain all the “need-to-knows” of an object.

150
Q

What is an RBAC?

A

Role-Based Access Control.
Access given to subjects based upon their role an organisation.
Permissions are assigned to roles.

151
Q

What are the advantages of RBAC?

A 
Distinct from user groups.
Emphasis on responsibility
Increases abstraction in policies (more managable)
Simple
Reduces user administration.
152
Q

What are the types of RBAC?

A

Flat
Hierarchical
Constrained

153
Q

What is the Chinese Wall Model?

A

Commercially inspired confidentiality model.
Uses conflict classes.
A user can only have access to one dataset within each conflict class.

154
Q

What is blockchain?

A

A decentralised ledger of transactions, fully replicated over a trustless peer to peer network.

155
Q

What are the transactions of blockchain?

A

Events of interest for a specific application.

156
Q

What is bitcoin?

A

A decentralised cryptocurrency that transfers currency via blockchain, providing pseudo-anonimity.

157
Q

How are transacrtions carried out in blockchain?

A

Transaction is broadcasted to the whole network.
All nodes verify the transaction.
Each replica updates its ledger.

158
Q

What are digital signatures used for?

A

Verifiying the sender, and proving ownership of the UTXO.

159
Q

How are transactions identified?

A

Using the addresses which are associated to a (PU,PR).

A wallet contains the key pairs associated to the addresses of a user.

160
Q

What are the inputs for a transaction?

A

An amount of unspent bitcoin to be used for the transaction.

161
Q

What is the UTXO?

A

Unspent Transaction Output

162
Q

How is ownership of the UTXO proved?

A

Using digital signatures which verify the ownership of the private key associated to the address.

163
Q

Why does having multiple address provide full anonymity?

A

A user can be profiled when different transactions are used for a UTXO.

164
Q

Why is decentralisation good?

A

Doesn’t require trust
No single point of failure
No censorship

165
Q

How are blocks created?

A

Miners choose which txns to include in a block.
Miners choose which block to use as previous.
Miners solve resource-intensive puzzle to compute Proof-of-Work (PoW).
New block is broadcast to the network.
Each node adds it to its local blockchain replica.

166
Q

What is on a new block?

A

A number of transactions.
Reference to previous block (hash)
Random number (solution)

167
Q

What is the puzzle?

A

Find a number s.t the hash of the block has a certain number of zeros as a most significant digit.

168
Q

What are the insentives to mine?

A

Amount of bitcoin for the block.

Transaction fees.

169
Q

How are branches dealt with?

A

They are allowed to grow until one becomes longer and is accepted; the others are rejected and the transactions are rolled back.

170
Q

What is pooling?

A

The combination of computational power between groups of miners.
More chance of branches (and blocks) being accepted, so more fees.
Fees split between the group.

171
Q

What are the advantages of blockchain?

A 
Decentralised
Reliable
Pseudo-anonymity
No need for trust
Immutable history of txns.
172
Q

What are the disadvantages of blockchain?

A

Not stablised
High transaction fees
Slow txn confirmation
Business may not be protected.

173
Q

What is a smart contract?

A

A computerised txn protocol that executes the terms of a contract.
Digital representation of a legal contract that can be executed determinisically.

174
Q

What is the life cycle of a contract?

A

Definition, Execution, Audit

175
Q

What are the 4 conditions of a smart contract?

A

Integrity of Control: Accountability of contract enforcement
Democratic Control: Responsiblilty should be shared, no controlling party.
Non-repudiation: Cannot argue with any part of the execution.
Building of trust: Should start trustless, build and preserve for duration.

176
Q

How does blockchain adhere to the conditions of smart contracts?

A

IoC: Transactions are immutable.
DC: Executedby all peers.
N-R: Transactions are immutable
BoT: PoW consensus builds trust.

177
Q

What is ethereum?

A

Decentralised platform for executing smart contracts.

178
Q

What are the 2 types of account for Ether?

A

Externally Owned Account

Contract

179
Q

What is EOA used for?

A

Transferring cryptocurrency.

180
Q

What can contracts do?

A

Update state

Carry out transactions to EOA/contracts

181
Q

What is the cost of a smart contract?

A

Gas unit

182
Q

What is a gas limit?

A

The maximum amount of gas units that a transaction is willing to pay.

183
Q

What is a decentralised application?

A

An application whos backend runs on a decentralised P2P network.
Multiple stakeholders are willing to manage assets of interest accounding to a business logic encoded as smart contracts.

184
Q

What is a permissioned blockchain?

A

A blockchain where the peers are invited.

185
Q

Why are permission blockchains used?

A

Used in buisness, for company to company transactions.

They may not want to make the txns public.

186
Q

What determines the creator of the next block in a permissioned blockchain?

A

Leader election

187
Q

Which performance is better, permissioned or permissionless?

A

Permissioned

188
Q

What does responsible distribution ensure?

A

No single point of failure

No priviledged nodes.

Principles of Cyber Security (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions