Which of the following BEST describes a function relying on a shared secret key that is used along with a hashing algorithm to verify the integrity of the communication content as well as the sender?
Correct Answer: A
The purpose of a message authentication code - MAC is to verify both the source and message integrity without the need for additional processes. A MAC algorithm, sometimes called a keyed (cryptographic) hash function (however, cryptographic hash function is only one of the possible ways to generate MACs), accepts as input a secret key and an arbitrary-length message to be authenticated, and outputs a MAC (sometimes known as a tag). The MAC value protects both a message's data integrity as well as its authenticity, by allowing verifiers (who also possess the secret key) to detect any changes to the message content. MACs differ from digital signatures as MAC values are both generated and verified using the same secret key. This implies that the sender and receiver of a message must agree on the same key before initiating communications, as is the case with symmetric encryption. For the same reason, MACs do not provide the property of non-repudiation offered by signatures specifically in the case of a network-wide shared secret key: any user who can verify a MAC is also capable of generating MACs for other messages. In contrast, a digital signature is generated using the private key of a key pair, which is asymmetric encryption. Since this private key is only accessible to its holder, a digital signature proves that a document was signed by none other than that holder. Thus, digital signatures do offer non-repudiation. The following answers are incorrect: -PAM - Pluggable Authentication Module: This isn't the right answer. There is no known message authentication function called a PAM. However, a pluggable authentication module (PAM) is a mechanism to integrate multiple low-level authentication schemes and commonly used within the Linux Operating System. -NAM - Negative Acknowledgement Message: This isn't the right answer. There is no known message authentication function called a NAM. The proper term for a negative acknowledgement is NAK, it is a signal used in digital communications to ensure that data is received with a minimum of errors. -Digital Signature Certificate: This isn't right. As it is explained and contrasted in the explanations provided above. The following reference(s) was used to create this question: http://en.wikipedia.org/wiki/Message_authentication_code
Question 107
In software engineering, the term verification is defined as:
Correct Answer: D
In the Waterfall model (W.W. Royce, Managing the Development of Large Software Systems: Concepts and Techniques, Proceedings, WESCON, August 1970). * answer "A complete, validated specification of the required functions, interfaces, and performance for the software product" defines the term requirements. *Similarly, answer "To establish the fitness or worth of a software product for its operational mission", defines the term validation, and answer d is the definition of product design. In summary, the steps of the Waterfall model are: System feasibility Software plans and requirements Product design Detailed design Code Integration Implementation Operations and maintenance In this model, each phase finishes with a verification and validation (V&V) task that is designed to eliminate as many problems as possible in the results of that phase.
Question 108
What is the MOST appropriate hierarchy of documents when implementing a security program?
Correct Answer: D
Question 109
Which of the following is an example of least privilege?
Correct Answer: B
Least Privilege embodies the concept that users or operators should be granted the lowest level of system access or system rights that allows them to perform their job. *Answer "An operator does not know more about the system than the minimum required to do the job" is need-to-know *"The operators' duties are frequently rotated" is job rotation *"An operator cannot generate and verify transactions alone" is separation of duties.
Question 110
What fire suppression system can be used in computer rooms that will not damage computers and is safe for humans?
Correct Answer: B
Reference: http://www.fireline.com/fl_fm200firesuppression.html FM-200 Systems FM-200 Fire Suppression Systems - Halon Alternatives Fire Protection Systems FM200 is a fire suppression system agent manufactured by Great Lakes Chemical. How FM200 Suppresses Fire FM200 suppresses fire by discharging as a gas onto the surface of combusting materials. Large amounts of heat energy are absorbed from the surface of the burning material, lowering it's temperature below the ignition point. FM200 Fire Suppression Systems and the Environment FM200 fire suppression systems have low atmospheric lifetimes, global warming, and ozone depletion potentials. Unlike Halon 1301 fire suppression systems, FM200 systems are environmentally friendly. They provide an effective, safe method of special hazards fire suppression where a non-residue producing clean agent is essential.