Examen:

CISSP - (ISC)2 Certified Information Systems Security Professional - Chapter 06

Ryan is responsible for managing the cryptographic keys used by his organization.

(Choose all that apply.)
1.-Which of the following statements are correct about how he should select and manage those keys?
A. Keys should be sufficiently long to protect against future attacks if the data is expected to remain sensitive.
B. Keys should be chosen using an approach that generates them from a predictable pattern.
C. Keys should be maintained indefinitely.
D. Longer keys provide greater levels of security.

John recently received an email message from Bill.

2.-What cryptographic goal would need to be met to convince John that Bill was actually the sender of the message?
A. Nonrepudiation
B. Confidentiality
C. Availability
D. Integrity

You are implementing AES encryption for files that your organization plans to store in a cloud storage service and wish to have the strongest encryption possible.

3.-What key length should you choose?
A. 192 bits
B. 256 bits
C. 512 bits
D. 1,024 bits

You are creating a security product that must facilitate the exchange of symmetric encryption keys between two parties that have no way to securely exchange keys in person.

4.-What algorithm might you use to facilitate the exchange?
A. Rijndael
B. Blowfish
C. Vernam
D. Diffie–Hellman

(Choose all that apply.)
5.-What occurs when the relationship between the plaintext and the key is complicated enough that an attacker can’t merely continue altering the plaintext and analyzing the resulting ciphertext to determine the key?
A. Confusion
B. Transposition
C. Polymorphism
D. Diffusion

Which of the following goals are achievable with AES?

(Choose all that apply.)
6.-Randy is implementing an AES-based cryptosystem for use within his organization. He would like to better understand how he might use this cryptosystem to achieve his goals.
A. Nonrepudiation
B. Confidentiality
C. Authentication
D. Integrity

Brian encountered encrypted data left on one of his systems by attackers who were communicating with one another. He has tried many cryptanalytic techniques and was unable to decrypt the data. He believes that the data may be protected with an unbreakable system.

7.-When correctly implemented, what is the only cryptosystem known to be unbreakable?
A. Transposition cipher
B. Substitution cipher
C. Advanced Encryption Standard
D. One-time pad

Helen is planning to use a one-time pad to meet a unique cryptographic requirement in her organization. She is trying to identify the requirements for using this cryptosystem.

(Choose all that apply.)
8.-Which of the following are requirements for the use of a one-time pad?
A. The encryption key must be at least one-half the length of the message to be encrypted.
B. The encryption key must be randomly generated.
C. Each one-time pad must be used only once.
D. The one-time pad must be physically protected against disclosure.

Brian administers a symmetric cryptosystem used by 20 users, each of whom has the ability to communicate privately with any other user. One of those users lost control of their account and Brian believes that user’s keys were compromised.

9.-How many keys must he change?
A. 1
B. 2
C. 19
D. 190

10.-Which one of the following cipher types operates on large pieces of a message rather than individual characters or bits of a message?
A. Stream cipher
B. Caesar cipher
C. Block cipher
D. ROT3 cipher

James is the administrator for his organization’s symmetric key cryptographic system. He issues keys to users when the need arises. Mary and Beth recently approached him and presented a need to be able to exchange encrypted files securely.

11.-How many keys must James generate?
A. One
B. Two
C. Three
D. Four

Dave is developing a key escrow system that requires multiple people to retrieve a key but does not depend on every participant being present.

12.-What type of technique is he using?
A. Split knowledge
B. M of N Control
C. Work function
D. Zero-knowledge proof

13.-What is used to increase the strength of cryptography by creating a unique ciphertext every time the same message is encrypted with the same key?
A. Initialization vector
B. Vigenère cipher
C. Steganography
D. Stream cipher

Tammy is choosing a mode of operation for a symmetric cryptosystem that she will be using in her organization. She wants to choose a mode that is capable of providing both confidentiality and data authenticity.

14.-What mode would best meet her needs?
A. ECB
B. GCM
C. OFB
D. CTR

Julie is designing a highly secure system and is concerned about the storage of unencrypted data in RAM.

15.-What use case is she considering?
A. Data in motion
B. Data at rest
C. Data in destruction
D. Data in use

Renee conducted an inventory of encryption algorithms used in her organization and found that they are using all of the algorithms below.

(Choose all that apply.)
16.-Which of these algorithms should be discontinued?
A. AES
B. DES
C. 3DES
D. RC5

17.-Which one of the following encryption algorithm modes suffers from the undesirable characteristic of errors propagating between blocks?
A. Electronic Code Book
B. Cipher Block Chaining
C. Output Feedback
D. Counter

18.-Which one of the following key distribution methods is most cumbersome when users are located in different geographic locations?
A. Diffie–Hellman
B. Public key encryption
C. Offline
D. Escrow

Victoria is choosing an encryption algorithm for use within her organization and would like to choose the most secure symmetric algorithm from a list of those supported by the software package she intends to use.

19.-If the package supports the following algorithms, which would be the best option?
A. AES-256
B. 3DES
C. RC4
D. Skipjack

The Jones Institute has six employees and uses a symmetric key encryption system to ensure confidentiality of communications.

20.-If each employee needs to communicate privately with every other employee, how many keys are necessary?
A. 1
B. 6
C. 15
D. 30