IT Certification Exam Questions & Answers

Certificate revocation is the process of revoking a certificate before it expires.
A certificate may need to be revoked because it was stolen, an employee moved to a new
company, or someone has had their access revoked. A certificate revocation is handled either
through a Certificate Revocation List (CRL) or by using the Online Certificate Status Protocol
(OCSP).
A repository is simply a database or database server where the certificates are stored. The
process of revoking a certificate begins when the CA is notified that a particular certificate needs
to be revoked. This must be done whenever the private key becomes known/compromised.
The owner of a certificate can request it be revoked at any time, or the request can be made by
the administrator. The CA marks the certificate as revoked. This information is published in the
CRL. The revocation process is usually very quick; time is based on the publication interval for the
CRL.
Disseminating the revocation information to users may take longer. Once the certificate has been
revoked, it can never be used-or trusted-again. The CA publishes the CRL on a regular basis,
usually either hourly or daily. The CA sends or publishes this list to organizations that have chosen
to receive it; the publishing process occurs automatically in the case of PKI. The time between
when the CRL is issued and when it reaches users may be too long for some applications. This
time gap is referred to as latency.
OCSP solves the latency problem: If the recipient or relaying party uses OCSP for verification, the
answer is available immediately.
The following answers are incorrect:
Registration Authority (RA) A registration authority (RA) is an authority in a network that verifies user requests for a digital certificate and tells the certificate authority (CA) to issue it. RAs are part of a public key infrastructure (PKI), a networked system that enables companies and users to exchange information and money safely and securely. The digital certificate contains a public key that is used to encrypt and decrypt messages and digital signatures.
Recovery agent Sometimes it is necessary to recover a lost key. One of the problems that often arises regarding PKI is the fear that documents will become lost forever-irrecoverable because someone loses or forgets his private key. Let’s say that employees use Smart Cards to hold their private keys. If a user was to leave his Smart Card in his or her wallet that was left in the pants that he or she accidentally threw into the washing machine, then that user might be without his private key and therefore incapable of accessing any documents or e-mails that used his existing private key.
Many corporate environments implement a key recovery server solely for the purpose of backing up and recovering keys. Within an organization, there typically is at least one key recovery agent. A key recovery agent has the authority and capability to restore a user’s lost private key. Some key recovery servers require that two key recovery agents retrieve private user keys together for added security. This is similar to certain bank accounts, which require two signatures on a check for added security. Some key recovery servers also have the ability to function as a key escrow server, thereby adding the ability to split the keys onto two separate recovery servers, further increasing security.
Key escrow (also known as a “fair” cryptosystem) is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys. These third parties may include businesses, who may want access to employees’ private communications, or governments, who may wish to be able to view the contents of encrypted communications.
The following reference(s) were/was used to create this question: Dulaney, Emmett (2011-06-03). CompTIA Security+ Study Guide: Exam SY0-301 (pp. 347-348). John Wiley and Sons. Kindle Edition. and http://en.wikipedia.org/wiki/Key_escrow and http://my.safaribooksonline.com/book/certification/securityplus/9781597494267/public-key
infrastructure/ch12lev1sec5 and http://searchsecurity.techtarget.com/definition/registration-authority

Section: Asset Security

What is a security weakness of the DNS protocol?
DNS data that is provided by name servers lacks support for data origin authentication and data integrity. This makes DNS vulnerable to man in the middle (MITM) attacks, as well as a range of other attacks.

Personal safety goes way above and beyond all other things, unless you’re a rescue worker, and even then safety is still priority #1. Recovering critical functions and down time are not the MOST important concerns; Data can be recovered, a potential life loss cannot be. Making Personal safety of the utmost important.
Topic 7, Cryptography

Least Privilege embodies the concept that users or operators should be granted the lowest level of system access or system rights that allows them to perform their job.
* Answer “An operator does not know more about the system than the minimum required to do the job” is need-to-know
* “The operators’ duties are frequently rotated” is job rotation
* “An operator cannot generate and verify transactions alone” is separation of duties.

DESX was developed by Ron Rivest to increase the resistance of DES to brute force key search attacks; however, the resistance of DESX to differential and linear attacks is equivalent to that of DES with independent subkeys.

The correct answer is 7. Most computer certification and accreditation standards recommend that diskettes be formatted seven times to prevent any possibility of data remanence .

A Public Key is also known as an asymmetric algorithm and the use of a secret key would be a symmetric algorithm.
The following answers are incorrect:
Use of the recipient’s public key for encryption and decryption based on the recipient’s private key. Is incorrect this would be known as an asymmetric algorithm.
Use of software encryption assisted by a hardware encryption accelerator. This is incorrect, it is a distractor.
Use of Elliptic Curve Encryption. Is incorrect this would use an asymmetric algorithm.

The first step to take when designing a networked Information System (IS) where there will be several different types of individual access is to create a user access matrix. A user access matrix is a table that defines the access rights and permissions of each user or user group to each resource or function in the system. A user access matrix helps to ensure that all access control requirements are addressed, such as the principle of least privilege, the principle of separation of duties, and the principle of need to know. A user access matrix also helps to simplify and standardize the implementation and administration of access control policies and mechanisms910. References: 9: Access Control Matrix1110: Access Control Models and Methods12

The correct answer is UTP. UTP stands for unshielded twisted pair wiring.

Substitution is a threat that occurs when an attacker replaces a valid digital signature with an invalid one, or a signature from another document. This can compromise the integrity and non-repudiation of the signed document, as the receiver cannot verify the authenticity and origin of the document. Substitution can be prevented by using secure hash algorithms and encryption to generate and protect the digital signatures.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3: Security Engineering, page 115;
[Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 3: Security Engineering, page 177]

Explanation/Reference:
Explanation:
Employee sabotage can become an issue if an employee is knowledgeable enough about the IT infrastructure of an organization, has sufficient access.
Incorrect Answers:
B: Student hackers are a lesser threat as a disgruntled employee already has access to the system.
C: A disgruntled employee is a larger threat compared to a criminal hacker as the employee already has access to the system.
D: A disgruntled employee is a larger threat compared to a corporate spy as the employee already has access to the system.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 602

The Physical Layer describes the physical properties of the various communications media, as well as the electrical properties and interpretation of the exchanged signals. Ex: this layer defines the size of Ethernet coaxial cable, the type of BNC connector used, and the termination method. You cannot encrypt nothing at this layer because its physical, it is not protocol / software based. Network, Data link and transport layer supports encryption.