During which of the following processes is least privilege implemented for a user account?
Correct Answer: B
Question 12
The goal of software assurance in application development is to
Correct Answer: A
Question 13
What type of key would you find within a browser's list of trusted root CA?
Correct Answer: D
The public key would be found. The public key is used to validate the Digital Signature contained within the Digital Certificate. As you well know the private key would never be distributed and only the owner of the certificate would have a copy of the private key. In cryptography and computer security, a root certificate is either an unsigned public key certificate or a self-signed certificate that identifies the Root Certificate Authority (CA). A root certificate is part of a public key infrastructure scheme. The most common commercial variety is based on the ITU-T X.509 standard, which normally includes a digital signature from a certificate authority (CA). Digital certificates are verified using a chain of trust. The trust anchor for the digital certificate is the Root Certificate Authority (CA). A certificate authority can issue multiple certificates in the form of a tree structure. A root certificate is the top-most certificate of the tree, the private key of which is used to "sign" other certificates. All certificates immediately below the root certificate inherit the trustworthiness of the root certificate a signature by a root certificate is somewhat analogous to "notarizing" an identity in the physical world. Certificates further down the tree also depend on the trustworthiness of the intermediates (often known as "subordinate certification authorities"). Many software applications assume these root certificates are trustworthy on the user's behalf. For example, a web browser uses them to verify identities within SSL/TLS secure connections. However, this implies that the user trusts their browser's publisher, the certificate authorities it trusts, and any intermediates the certificate authority may have issued a certificate-issuingcertificate, to faithfully verify the identity and intentions of all parties that own the certificates. This (transitive) trust in a root certificate is the usual case and is integral to the X.509 certificate chain model. The root certificate is usually made trustworthy by some mechanism other than a certificate, such as by secure physical distribution. For example, some of the most well-known root certificates are distributed in the Internet browsers by their manufacturers The following answers are incorrect: The Private Key is never distributed, only the owner would have a copy of the private key. Symmetric keys have no direct relation to Public Key cryptosystems. A recovery key is usually used with full drive encryption tool when a user has lost or damage his key. The following reference(s) were/was used to create this question: http://en.wikipedia.org/wiki/Root_certificate and Getting a root CA accepted within browsers
Question 14
One-way hash provides:
Correct Answer: C
"Hash Functions ....how cryptosystems implement digital signatures to provide proof that a message originated from a particular user of a cryptosystem and to ensure that the message was not modified while in transit between the two parties." Pg. 292 Tittel: CISSP Study Guide Second Edition "integrity A state characterized by the assurance that modifications are not made by unauthorized users and authorized users do not make unauthorized modifications." Pg. 616 Tittel: CISSP Study Guide Second Edition
Question 15
Which choice below is the BEST description of a Protection Profile (PP), as defined by the Common Criteria (CC)?
Correct Answer: A
The Common Criteria (CC) is used in two ways: As a standardized way to describe security requirements for IT products and systems As a sound technical basis for evaluating the security features of these products and systems The CC defines three useful constructs for building IT security requirements: the Protection Profile (PP), the Security Target (ST), and the PackagE. The PP is an implementation-independent statement of security needs for a set of IT security products. The PP contains a set of security requirements and is intended to be a reusable definition of product security requirements that are known to be useful and effectivE. APP gives consumers a means of referring to a specific set of security needs and communicating them to manufacturers and helps future product evaluation against those needs. Answer a defines the Security Target (ST). The ST is a statement of security claims for a particular IT security product or system. The ST parallels the structure of the PP, though it has additional elements that include product-specific detailed information. An ST is the basis for agreement among all parties as to what security the product or system offers, and therefore the basis for its security evaluation. *Answer "An intermediate combination of security requirement components" describes the PackagE. The Package is an intermediate combination of security requirements components. The package permits the expression of a set of either functional or assurance requirements that meet some particular need, expressed as a set of security objectives. *Answer "The IT product or system to be evaluated" describes the Target of Evaluation (TOE). The TOE is an IT product or system to be evaluated, the security characteristics of which are described in specific terms by a corresponding ST, or in more general terms by a PP. This evaluation consists of rigorous analysis and testing performed by an accredited, independent laboratory. The scope of a TOE evaluation is set by the Evaluation Assurance Level (EAL) and other requirements specified in the ST. Part of this process is an evaluation of the ST itself, to ensure that it is correct, complete, and internally consistent and can be used as the baseline for the TOE evaluation. Source: Common Criteria Project.