Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CS 2413 > Study > Flashcards

Study Flashcards

(64 cards)

Start Studying
1
Q

Give an example where increased security reduces usability, and suggest a balanced solution.

A

2FA with very complex password requirements. A solution is to have 2FA with normal requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does the CIA triad stand for?

A

Confidentiality, integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

These tables store precomputed hash values and are used to speed up the process of reversing a hash to reveal a password?

A

Rainbow Tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three RBAC extensions beyond RBAC0 (RBAC1, RBAC2, RBAC3), and how do they enhance access control?

A

RBAC1 - Hierarchy

RBAC2 - Constraints

RBAC3- Combined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Bloom filter, and how is it used in password security?

A

A Bloom filter is a data structure used to test whether an element is a member of a set. It is used in password security to efficiently check if a password is weak. However, it can produce false positives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the ciphertext of:

01000001 01001001 (Plaintext)

XOR

01000100 01000001 (Key)

A

00000101 00001000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In Unix control what are the three types of user categories ?

A

Owner, group, world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the Weakness of ECB mode in block cipher encryption ?

A

ECB (Electronic Codebook) mode is insecure because identical plaintext blocks are encrypted to the same ciphertext, revealing patterns that can be exploited. Large inputs are potentially more vulnerable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the difference between a threat and an attack?

A

A threat is a potential cause of harm, while an attack is an actual attempt to exploit a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the formula for risk analysis?

A

Likelihood * Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does “psychological acceptability “ refer to in security design?

A

Psychological acceptability means designing security measures that do not unduly interfere with the user’s work.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an attack tree, and what are the different parts of it.

A

An attack tree is a diagram used to model the different ways an attack can occur. It has a root (objective), leaf nodes (comprise the attack), sub nodes (attack events)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the main difference between symmetric and asymmetric encryption?

A

Symmetric encryption uses the same key for both encryption and decryption, while asymmetric encryption uses a pair of keys (public and private)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a hash function in cryptography and what is it’s main purpose?

A

A hash function takes an input and returns a fixed-size string of characters, typically used for integrity verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This code is used to verify the integrity and authenticity of a message.

A

What is a message authentication code (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the purpose of access control in security?

A

Access control determines who can access what resources and ensures that only authorized individuals can perform certain actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are problems with passwords?

A

Passwords can be hard to remember, and can be cracked easier than other means.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are biometric authentication methods, how do they enhance security, and what is a problem with it.

A

Biometric authentication uses unique physiological characteristics (e.g., fingerprints, facial recognition) to verify identity, providing a higher level of security and convenience. Problems could be if someone lacks the biometric, and it is hard to change if compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In UNIX-based systems, this user has unrestricted access to all resources and can perform any administrative task.

A

Who is the superuser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of an access control list (ACL)?

A

It defines permissions for users or groups on specific resources, determining who can read, write, or execute files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Explain the difference between identification, authentication, authorization, and auditing.

A

Identification is claiming an identity, authentication is verifying it, authorization determines what the authenticated user can do, and auditing tracks actions to ensure compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the key differences between DAC, MAC, and RBAC?

A

DAC (Discretionary Access Control) allows owners to set permissions, MAC (Mandatory Access Control) is based on predefined policies(often security clearances), and RBAC (Role-Based Access Control) grants access based on user roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the difference between an insider and an outsider threat?

A

An insider threat comes from someone within the organization, while an outsider threat originates from someone external.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the ciphertext of hello, caesar cipher with a shift of 7.

A

Olssv

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is a digital envelope in the context of encryption, and what is its benefit.
A digital envelope is a cryptographic concept that combines the benefits of both symmetric and asymmetric encryption to securely transmit data. Usually the secret key is encrypted using asymmetric encryption, and the message is encrypted with the secret key.
26
Give an example of a passive attack and an active attack.
A passive attack is eavesdropping on network traffic; an active attack is modifying or injecting data(DDOS).
27
What is the difference between fail-safe and fail-secure mechanisms?
Fail-safe defaults to allowing access during failures, while fail-secure defaults to denying access.
28
What is salting in password hashing, and why is it important?
Salting is the process of adding a random value (called a salt) to a password before hashing it. This ensures that even if two users have the same password, their hashed values will be different.
29
You are designing a secure system for storing passwords. You have the option of using either a fast cryptographic hash function or a slower function. Which should you choose and why?
A slower hash function will produce a safer hash function for passwords.
30
Given n = 45, e = 3, d= 11, m = 4 What is the ciphertext and what is the formula?
c= m^e mod n c = 19
31
What is Confidentiality?
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
32
What is Integrity?
Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity.
33
What is Availability?
Ensuring timely and reliable access to and use of information. Assures that systems work promptly and service is not denied to authorized users.
34
What is Authenticity?
The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator.
35
What is Accountability?
The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity.
36
What is an Adversary?
Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.
37
What is a Countermeasure?
A device or techniques that has as its objective the impairment of the operational effectiveness of undesirable or adversarial activity, or the prevention of espionage, sabotage, theft, or unauthorized access to or use of sensitive information or information systems.
37
What is a Vulnerability?
Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
38
Why should encryption algorithms be open to the public?
Open algorithms allow security experts worldwide to analyze and find vulnerabilities, leading to stronger, more resilient systems.
39
What is Separation of Privilege?
When multiple privilege attributes are required to achieve access to a restricted resource.
40
What is an example of Separation of Privilege?
Multifactor User Authentication.
41
What is the Rule of Least Privilege?
Every user of the system should operate using the least set of privileges necessary to perform the task.
42
What is the Rule of Layering?
Using multiple overlapping protection approaches to protect information.
43
What is the Rule of Least Astonishment?
A program or user interface should always respond in the way that is least likely to astonish the user.
44
What is an example of an Attack Surface?
Unpatched Software Open Ports & Exposed Services Stolen or Unsecured Devices Phishing Attacks
45
For a ATM machine, what is the degree of importance of each CIA requirement?
1. Confidentiality 2. Integrity 3. Availability.
46
What is Symmetric Encryption?
The universal technique for providing confidentiality for transmitted or stored data.
47
What are the approaches to attacking a symmetric encryption?
Cryptanalysis and Brute-force attack.
48
What is Cryptanalysis?
Analyzing only the encrypted text to find patterns or weaknesses.
49
What is a Brute-force Attack?
Trying all possible keys until the correct one is found.
50
On average, how many possible keys must be tried to achieve success?
Half of all possible keys.
51
What are examples of Symmetric Block Encryption Algorithms?
* Data Encryption Standard (DES) * Advanced Encryption Standard (AES) * Triple DES
52
How is a One-Way Hash Function used for message authentication?
Well the receiver can compare the message's hash to the original hash that was given with the message, and if they match, then we know that the message is authentic.
53
Why are Hash Functions secure?
Because they cannot be decrypted or reversed.
54
What are some examples of Secure Hash Algorithms?
SHA-1 SHA-2, SHA-256 SHA-3
55
What are some other applications of Hash Functions?
- Storing hashed versions of passwords. - Intrusion Detection
56
What is Public Key Encryption?
Public Key (🔓) – Used for encryption; can be shared with anyone. Private Key (🔑) – Used for decryption; must be kept secret.
57
What are some examples of Public-Key Algorithm?
RSA, Diffie-Hellman, DSS, Elliptic Curve.
58
What is the RSA decryption algorithm?
M=C^d mod n
59
What are the 4 general means of authenticating a user's identity?
Something the individual knows, possesses, is (static biometrics) and does (dynamic biometrics)
60
What are the levels of impact for risk analysis?
Low (limited adverse effects), Moderate (serious adverse affects) and High risk (severe/catastrophic effects)
61
What is an offline dictionary attack?
Comparing password hashes from an obtained password file against hashes of commonly used passwords that are part of a dictionary
62
What are the three types of memory that smart cards may contain?
Read-only memory (ROM), Electrically erasable programmable ROM (EEPROM) and Random Access Memory (RAM)
63
What are the four countermeasures to remote user authentication threats?
Password Protocol, Token Protocol, Static Biometric Protocol, and Dynamic Biometric Protocol

CS 2413 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions