Major Exam · Semester 181

Source: the instructor's answer sheet (Dr. Gabriela Mogos, 18 November 2018, 70 minutes, 20 marks), laid out like the original paper.
Pick an option and the answer table on page 4 fills itself in. Check paper marks Section A; the essays show the instructor's answers so you can mark yourself.

جامعة الأمير سلطان
PRINCE SULTAN
UNIVERSITY

Major Sem 181

Course instructor: Dr. Gabriela Mogos

Course title: Fundamentals of Cybersecurity

Course code: CYS401

Duration: 70 minutes

Exam date: 18.11.2018

Student Name:

ID:

TOTAL MARKS: ( /20)

SECTION A. Multiple Choice Questions

Note: Answer all the questions and fill the TABLE at the end with appropriate answers.

I. Choose the best answer/choice for the below statements:( /1 marks)

What is layer 4 of the OSI model?

a.Presentationb.Networkc.Data Linkd.Transport

Counting up from the bottom: 1 Physical, 2 Data Link, 3 Network, 4 Transport, 5 Session, 6 Presentation, 7 Application.

What is a TCP wrapper?

a.An encapsulation protocol used by switchesb.An application that can serve as a basic firewall by restricting access based on user IDs or system IDsc.A security protocol used to protect TCP/IP traffic over WAN linksd.A mechanism to tunnel TCP/IP through non-IP networks

A TCP wrapper sits in front of network services and allows or denies connections by user or system ID, which makes it a basic host firewall.

Which of the following is NOT true regarding firewalls?

a.They are able to log traffic information.b.They are able to block viruses.c.They are able to issue alarms based on suspected attacks.d.They are unable to prevent internal attacks.

Firewalls filter traffic by rules; they log, raise alarms and cannot stop insiders. Spotting viruses inside the content is antivirus work.

What is encapsulation?

a.Changing the source and destination addresses of a packetb.Adding a header and footer to data as it moves down the OSI stackc.Verifying a person’s identityd.Protecting evidence until it has been properly collected

Each layer wraps the data from the layer above with its own header (and the data link layer a footer) on the way down.

Which one of the following devices is most susceptible to TEMPEST monitoring of its emanations?

a.Switchb.Monitorc.CD-ROMd.Router

TEMPEST is about reading electromagnetic emanations. Monitors give off the strongest readable signal of these devices.

Which one of the following security modes does not require that all users have a security clearance for the highest level of information processed by the system?

a.Dedicatedb.System highc.Compartmentedd.Multilevel

Dedicated, system-high and compartmented modes all require clearance for the highest level. Multilevel mode lets users with lower clearances work while the system enforces separation.

Which of the following is a problem with symmetric key encryption?

a.Is slower than asymmetric key encryptionb.Most algorithms are kept proprietaryc.Work factor is not a function of the key sized.Secure distribution of the secret key

Both sides need the same secret, so getting it to them securely is the classic problem. Symmetric encryption is faster than asymmetric, not slower.

In public key cryptography

a.Only the private key can encrypt and only the public key can decryptb.Only the public key can encrypt and only the private key can decryptc.The public key used to encrypt and decryptd.If the public key encrypts, then only the private key can decrypt

The two keys are a pair: whatever one encrypts only the other decrypts. Both directions are used (encryption with the public key, signatures with the private key), so the 'only' in (a) and (b) is wrong.

In a block cipher, diffusion

a.Conceals the connection between the ciphertext and plaintextb.Spreads the influence of a plaintext character over many ciphertext charactersc.Is usually implemented by nonlinear S-boxesd.Cannot be accomplished

Diffusion spreads each plaintext bit over many ciphertext bits. Concealing the relationship (a) is confusion, which S-boxes (c) provide.

10.

What is used to create a digital signature?

a.The receiver’s private keyb.The sender’s public keyc.The sender’s private keyd.The receiver’s public key

The sender encrypts the message digest with their own private key; anyone verifies it with the sender's public key.

11.

Why would a certificate authority revoke a certificate?

a.If the user’s public key has become compromisedb.If the user changed over to using the Project Execution Model (PEM) model that uses a web of trustc.If the user’s private key has become compromisedd.If the user moved to a new location

A compromised private key means someone else can sign as the user, so the CA puts the certificate on its revocation list. A public key is public by design.

12.

Which of the following best describes a certificate authority?

a.An organization that issues private keys and the corresponding algorithmsb.An organization that validates encryption processesc.An organization that verifies encryption keysd.An organization that issues certificates

A CA is the trusted third party that issues certificates binding an identity to a public key.

II. State whether these statements are True or False:( /0,5 marks)

CROSS-SITE SCRIPTING (XSS) is a form of malicious code-injection attack in which an attacker is able to compromise a web server.

a.TRUEb.FALSE

Keyed TRUE on the instructor's answer sheet: XSS injects malicious script through a vulnerable web application.

Defense in depth is used to provide a protective multilayer barrier against various forms of attack.

a.TRUEb.FALSE

Layered, independent controls are the definition of defense in depth.

Wired Equivalent Privacy (WEP) uses a predefined shared secret key.

a.TRUEb.FALSE

WEP uses a static pre-shared key configured on the access point and every client.

In Symmetric multiprocessing (SMP) the processors are often operating independently of each other.

a.TRUEb.FALSE

FALSE. In SMP the processors share the OS and memory and work together. The instructor cites the CISSP book (p. 495): it is asymmetric multiprocessing (AMP) where processors often operate independently.

Multiple Choice Questions ( /1 marks)		TRUE/FALSE ( /0,5 marks)
1	7	1
2	8	2
3	9	3
4	10	4
5	11
6	12

This table fills itself in from the options you pick above.

SECTION B. ESSAY Questions

Note: Section B contains Three (3) questions. Answer all THREE (3) questions.

1. Shortly describe the Authoritative Name Server (definition and types).( /2 marks)

Model answer · 2 marks

An Authoritative Name Server holds the actual DNS records for a particular domain / address.

There are two types of Authoritative Name Servers:

Primary authoritative name server hosts the original zone file for the domain.
Secondary authoritative name servers can be used to host read-only copies of the zone file.

2. Shortly describe the Grid Computing.( /2 marks)

Model answer · 2 marks

Grid computing is a form of parallel distributed processing that loosely groups a significant number of processing nodes to work toward a specific processing goal.
The biggest security concern with grid computing is that the content of each work packet is potentially exposed to the world.
Grid computing often uses a central primary core of servers to manage the project, track work packets, and integrate returned work segments.
If the central servers are overloaded or go offline, complete failure or crashing of the grid can occur.

3. Shortly describe the configuration modes of a Wireless access points WAP.( /2 marks)

Model answer · 2 marks

Infrastructure mode — wireless NICs on systems can’t interact directly, and the restrictions of the wireless access point for wireless network access are enforced.
Ad hoc mode — two wireless network interface cards (NICs) can communicate without a centralized control authority.