Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber > Section 2: Implementing Public Key Infrastructure > Flashcards

Section 2: Implementing Public Key Infrastructure Flashcards

1
Q

What type of certificate does a CA have?

A

Root certificate, which it uses to sign keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

If you are going to use a CA internally, what type of CA should you choose?

A

Private CA for internal use; these certificates will not be accepted outside the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

If you want to carry out B2B activity with third-party companies or sell products on the web, what type of CA should you use?

A

Public CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why should you take your CA offline when not in use?

A

To prevent it from being compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of encryption does PKI use?

A

Asymmetric encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who signs X509 certificates?

A

The CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What can you use to prevent your CA from being compromised and fraudulent certificates from being issued?

A

Certificate pinning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If two entities want to set up a cross-certification, what must they set up first?

A

The root CAs would set up a trust model between themselves, known as a bridge trust model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What type of trust model does PGP use?

A

Web of trust.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can you tell whether your certificate is valid?

A

Certificate Revocation List (CRL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

If the CRL is going slowly, what should you implement?

A

Online Certificate Status Protocol (OCSP), as it provides faster validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Explain certificate stapling/OCSP stapling.

A

A web server uses an OCSP for faster certificate authentication, bypassing the CRL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the process of obtaining a new certificate?

A

Submit a Certificate Signing Request (CSR) to request a new certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the purpose of the key escrow?

A

Stores and manages private keys for third parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the purpose of the HSM?

A

A Hardware Security Module (HSM) is used by the key escrow to securely store and manage certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the purpose of the DRA, and what does it need to complete its role effectively?

A

The Data Recovery Agent (DRA) is to recover data when a user’s private key becomes corrupt. To do this, it must first obtain a copy of the private key from the key escrow.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can you identify each certificate?

A

The OID, which is similar to a serial number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What format (PKCS) is a private certificate, and what file extension does it have?

A

P12 format, .pfx extension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What format (PKCS) is a public certificate, and what file extension does it have?

A

P7B format, .cer extension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What format is a PEM certificate?

A

Base64 format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What type of certificate can be used on multiple servers in the same domain?

A

Wildcard certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What type of certificate can be used on multiple domains?

A

Subject Alternative Name (SAN) certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What should you do with your software to verify that it is original and not a fake copy?

A

Code-sign the software - similar to a digital signature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the purpose of extended validation of an X509?

A

Normally used by financial institutions to provide a higher level of trust for the X509.

25
Q

What type of cipher is the Caesar cipher, and how does it work if it uses ROT 4?

A

Substitution cipher, each letter would be substituted by a letter four characters along in the alphabet.

26
Q

What is encryption, and what are the inputs and outputs called?

A

When plain text (input) is taken and turned into ciphertext (output).

27
Q

What type of of encryption will be used to encrypt large amounts of data?

A

Symmetric encryption, since it uses one key.

28
Q

What is the purpose of Diffie-Hellman?

A

An asymmetric technique that creates a secure tunnel. During a VPN connection, it is used during the IKE phase and uses UDP port 500 to create the VPN tunnel.

29
Q

What is the first stage in asymmetric encryption?

A

Key exchange. During asymmetric encryption, each entity will will give the other entity its public key. The private key is secure and never given away.

30
Q

If Carol is encrypting data to send to Bob, what key will each of them use?

A

Carol uses Bob’s public key to encrypt the data. Bob will use his private key to decrypt the data. Encryption and decryption are always done by the same key pair.

31
Q

If George encrypted data four years ago with an old CAC card, can he decrypt the data with his new CAC card?

A

No. George must obtain the old private key to decrypt the data. Encryption was done with a different key pair.

32
Q

If Janet is digitally signing an email to send to John to prove that it has not been tampered with in transit, what key will they each use?

A

Janet will digitally sign the email with her private key. John will check it’s validity with Janet’s public key, which he would have received in advance.

33
Q

What two things does a digital email signature provide?

A

Integrity
Non-repudiation

34
Q

What asymmetric encryption algorithm should you use to encrypt data on a smartphone?

A

Elliptic Curve Cryptography (ECC) will be used. It is small, fast, and uses the Diffie-Hellman (DH) handshake.

35
Q

What should you use to encrypt a military mobile telephone?

A

AES-256.

36
Q

Name two key-stretching algorithms.

A

bcrypt and PBKDF2.

37
Q

Explain how key stretching works.

A

Key stretching salts the password being stored to prevent duplicate passwords. Also increases the length of the keys to make brute-force attacks harder.

38
Q

What is the difference between stream and block cipher modes, and which one will you use to encrypt large blocks of data?

A

Stream ciphers encrypt one bit at a time. Block ciphers take blocks of data, such as 128-bit modes. You would use a block cipher for large amounts of data.

39
Q

What happens with cipher block chaining if you don’t have all the blocks?

A

CBC needs all blocks of data to decrypt the data.

40
Q

If you want to ensure the integrity of data, what should you use? Name two algorithms.

A

SHA-1 (160-bit)
MD5 (128-bit)

41
Q

If you want to ensure the protection of data, what should you use?

A

Encryption.

42
Q

Is a hash a one-way or two-way function, and is it reversible?

A

One-way, non-reversible.

43
Q

What type of man-in-the-middle attack is SSL 3.0 (CBC) vulnerable to?

A

POODLE.

44
Q

Define Diffie Hellman Ephemeral (DHE) and Elliptic Curve Diffie Hellman Ephemeral (ECDHE).

A

DHE and ECDHE are both ephemeral keys that are short lived, one-time keys.

45
Q

What are the strongest and weakest methods of encryption with an L2TP/IPSec VPN tunnel?

A

Strongest: AES
Weakest: DES

46
Q

What is the name of the key used to ensure the security of communication between a computer and a server or a computer to another computer?

A

Session key.

47
Q

What should you do to protect data-at-rest on a laptop?

A

Full Disk Encryption (FDE).

48
Q

What should you do to protect data-at-rest on a tablet or smartphone?

A

Full Disk Encryption (FDE).

49
Q

What should you do to protect data-at-rest on a backend server?

A

Data-at-rest on a backend server is stored in a database. You would need to encrypt the database.

50
Q

What should you do to protect data-at-rest on a removable device, such as a USB flash drive or an external hard drive?

A

Full Disk Encryption (FDE).

51
Q

What protocols could you use to protect data in transit?

A

TLS
SSL
HTTPS
L2TP/IPSec tunnel

52
Q

How can you protect data-in-use?

A

Full Memory Encryption.

53
Q

What is the purpose of obfuscation?

A

Make source code look obscure so that if it is stolen, it cannot be understood. It masks data using either XOR or ROT13.

54
Q

What is the purpose of perfect forward secrecy?

A

PFS ensures no link between the server’s private key and the session key. If a VPN server’s key was compromised, it could not decrypt the session. Great for voting machines.

55
Q

What type of attack tries to find two hash values that match?

A

Collision attack.

56
Q

What is the purpose of rainbow tables?

A

Lists precomputed words showing their hash value used to crack the hash value of passwords. Different tables are used for MD5 and SHA-1.

57
Q

Explain the concept of steganography.

A

Used to conceal data inside another form of data.

58
Q

What are the two purposes of Data Loss Prevention (DLP)?

A

Prevents sensitive or PII from being emailed out of a company.
Prevents sensitive or PII from being stolen from a file server using a USB device.

59
Q

What is the purpose of salting a password?

A

Ensures that duplicate passwords are never stored and makes things more difficult for brute-force attacks by increasing the key size (key stretching).

Cyber (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions