GSEC CORRECT EXAMS QUESTIONS AND
ANSWERS SET A+
✔✔false negative - ✔✔IDS fails to detect malicious activity
no alert for real threat
✔✔NIDS - ✔✔Network-based intrusion detection system used to identify events of
interest on the network. It can detect network-based attacks, such as smurf attacks. A
NIDS cannot monitor encrypted traffic, and cannot monitor traffic on individual hosts.
Snort is an example of an open source NIDS
✔✔Cryptology - ✔✔science of interpreting secret writings and codes and encompasses
cryptography and cryptanalaysis
✔✔cryptography - ✔✔the art of protecting information by transforming (plaintext) into an
unreadable format, called cipher text
✔✔Cryptanalysis - ✔✔obtaining the plaintext or key from ciphertext to obtain valuable
information or pass on altered, fake messages to intended recipients
✔✔Cryptosystem - ✔✔Consists of the algorithm (cipher) and cryptovariable (key), as
well as all the possible plaintexts and ciphertexts produced by the cipher and key.
✔✔cryptographic key - ✔✔values used to initialize a particular algorithm must be
protected at all costs uniqueness and length matters protection growth is exponential
not linear
✔✔Keyspace - ✔✔the range of all possible values for a key in a cryptosystem the larger
the better
✔✔key storage - ✔✔A secure repository for key assignment records.
,✔✔crypto (3 components) - ✔✔protect data at rest
protect data in transit
protect keys
✔✔crypto (goals) - ✔✔confidentiality, integrity, authentication, non repudiation
✔✔XOR - ✔✔The truth table for the ____ gate indicates that the output is 1 only when
the inputs are different.
✔✔Rotation Substitution - ✔✔e.g. Caesar cipher, swapping out one character for
another, rotate by n chars | predictable | if one mapping discovered, all is lost
✔✔Caesar Cypher - ✔✔letter-by-letter method to make a cipher. For each letter,
substitute another letter 4 letters ahead. For "a", write "d".
✔✔ROT 13 - ✔✔Monoalphabetic cipher that shifts characters 13 characters. Stands for
Rotate 13. A would become N, B would become O, etc.
✔✔Arbitrary Substitution - ✔✔swap one character for another arbitrarily; cannot derive
key by mapping just one character (as with rotation substitution); vulnerable to freq
analysis
✔✔Frequency Analysis - ✔✔A technique that is based on how frequently certain letters
appear in English versus others.
✔✔mapping function - ✔✔
✔✔permutation - ✔✔aka transposition, use same chars, just change position
✔✔Symmetric Key Encryption - ✔✔aka secret key, single or 1-key encryption, single
key is used for encryption and decryption | fast | PRIVACY | no non repudiation, AES,
Blowfish, IDEA
✔✔Diffie-Hellman - ✔✔allows two users to share a secret key securely over a public
network; asymmetric
✔✔asymmetric key encryption - ✔✔public key crypto | two keys are used: a public key
used only to encrypt data, and a private key used only to decrypt it. key exchange,
authN, non repudiation
✔✔Trapdoor Function - ✔✔A function that is easy to compute in one direction, yet
believed to be difficult to compute in the opposite direction (finding its inverse) without
special information, called the "trapdoor."
,✔✔hash function - ✔✔no key; one-way function (trapdoor); MD2 - 5; aka 'message
digest'; INTEGRITY
✔✔Collision (cryptographic attacks) - ✔✔This type of attack is where two different
inputs yield the same output of a hash function. Through manipulation of data, creating
subtle changes that are not visible to the user yet create different versions of a digital
file and the creation of many different versions, then using the birthday attack to find a
_____ between any two of the many versions, an attacker has a chance to create a file
with changed visible content but identical hashes.
✔✔digital signature - ✔✔electronically signing a document with data that cannot be
forged; NON REPUDIATION INTEGRITY
sender signs with private key for non repudiation
recipient decrypts with sender public key
✔✔Steganography - ✔✔hide data in a 'carrier' file or medium; disguise encrypted data;
SECRECY
✔✔histogram - ✔✔graphical representation of the number of occurrences of data in a
given distribution of such data
✔✔Steganography (3 types) - ✔✔provides secrecy by hiding data within data | injection;
substitution; file generation
✔✔carrier file - ✔✔aka host file | the file in which the data is hidden | message is the
hidden data
✔✔injection (steganography) - ✔✔file size can tip off; adding hidden data to carrier file
✔✔substitution (steganography) - ✔✔most popular; file size remains same
✔✔File generation (steganography) - ✔✔generate from hidden data; carrier not needed
before; produced by stego program; each new input produces new output
✔✔detection (stego) - ✔✔histogram; high entropy = encryption; no universal method to
detect stego
✔✔LSB - ✔✔Least Significant Bit graphics color tables | the bits that have the list
impact on shifting color and can accommodate the message
✔✔tractable - ✔✔easy crypto problem
✔✔intractable - ✔✔hard crypto problem (factor large integers into two prime factors)
also encompasses discrete logarithm problem (el gamal)
, ✔✔ECC - ✔✔Elliptic curve cryptography. An asymmetric encryption algorithm
commonly used with smaller wireless devices. It uses smaller key sizes and requires
less processing power than many other encryption methods
✔✔DES - ✔✔symmetric; 64 bit block cipher (56 key + 8 for parity) vulnerable due to
small key size
✔✔algorithm group - ✔✔if cipher is in a 'group' multiple rounds of encryption does not
increase security
✔✔Double DES - ✔✔A DES version that uses a 112-bit key length; encipher message;
then encipher encrypted message
✔✔Triple DES (3DES) - ✔✔A more-secure variant of DES that
repeatedly encodes the message using three separate DES keys; 16 rounds per pass
✔✔AES - ✔✔advanced encryption standard, a symmetric 128-bit block data encryption
technique; also 192 or 256 bit keys
✔✔RSA Algorithm - ✔✔Named after inventors Rivest, Shamir, and Adelman, RSA is a
system for encrypting and decrypting a message using a pair of keys, both of which
contain the product of two prime numbers. SSL; asymmetric
✔✔MD5 - ✔✔Message Digest 5. A hashing function used to provide integrity. MD5 uses
128 bits. A hash is simply a number created by applying the algorithm to a file or
message at different times. The hashes are compared to each other to verify that
integrity has been maintained.
✔✔SHA - ✔✔Secure Hashing Algorithm
✔✔SHA-1 - ✔✔160 bit hash 20-byte key length
✔✔SHA-2 - ✔✔The second revision of SHA, also designed by the NSA, which supports
a variety of hash sizes, the most popular of which are SHA-256 and SHA-512.
✔✔Analytic Cryptanalysis - ✔✔Uses algorithms and mathematics to deduce key or
reduce key space to be searched
✔✔Statistical Cryptanalysis - ✔✔Uses statistical characteristics of langauges or
weaknesses in keys
ANSWERS SET A+
✔✔false negative - ✔✔IDS fails to detect malicious activity
no alert for real threat
✔✔NIDS - ✔✔Network-based intrusion detection system used to identify events of
interest on the network. It can detect network-based attacks, such as smurf attacks. A
NIDS cannot monitor encrypted traffic, and cannot monitor traffic on individual hosts.
Snort is an example of an open source NIDS
✔✔Cryptology - ✔✔science of interpreting secret writings and codes and encompasses
cryptography and cryptanalaysis
✔✔cryptography - ✔✔the art of protecting information by transforming (plaintext) into an
unreadable format, called cipher text
✔✔Cryptanalysis - ✔✔obtaining the plaintext or key from ciphertext to obtain valuable
information or pass on altered, fake messages to intended recipients
✔✔Cryptosystem - ✔✔Consists of the algorithm (cipher) and cryptovariable (key), as
well as all the possible plaintexts and ciphertexts produced by the cipher and key.
✔✔cryptographic key - ✔✔values used to initialize a particular algorithm must be
protected at all costs uniqueness and length matters protection growth is exponential
not linear
✔✔Keyspace - ✔✔the range of all possible values for a key in a cryptosystem the larger
the better
✔✔key storage - ✔✔A secure repository for key assignment records.
,✔✔crypto (3 components) - ✔✔protect data at rest
protect data in transit
protect keys
✔✔crypto (goals) - ✔✔confidentiality, integrity, authentication, non repudiation
✔✔XOR - ✔✔The truth table for the ____ gate indicates that the output is 1 only when
the inputs are different.
✔✔Rotation Substitution - ✔✔e.g. Caesar cipher, swapping out one character for
another, rotate by n chars | predictable | if one mapping discovered, all is lost
✔✔Caesar Cypher - ✔✔letter-by-letter method to make a cipher. For each letter,
substitute another letter 4 letters ahead. For "a", write "d".
✔✔ROT 13 - ✔✔Monoalphabetic cipher that shifts characters 13 characters. Stands for
Rotate 13. A would become N, B would become O, etc.
✔✔Arbitrary Substitution - ✔✔swap one character for another arbitrarily; cannot derive
key by mapping just one character (as with rotation substitution); vulnerable to freq
analysis
✔✔Frequency Analysis - ✔✔A technique that is based on how frequently certain letters
appear in English versus others.
✔✔mapping function - ✔✔
✔✔permutation - ✔✔aka transposition, use same chars, just change position
✔✔Symmetric Key Encryption - ✔✔aka secret key, single or 1-key encryption, single
key is used for encryption and decryption | fast | PRIVACY | no non repudiation, AES,
Blowfish, IDEA
✔✔Diffie-Hellman - ✔✔allows two users to share a secret key securely over a public
network; asymmetric
✔✔asymmetric key encryption - ✔✔public key crypto | two keys are used: a public key
used only to encrypt data, and a private key used only to decrypt it. key exchange,
authN, non repudiation
✔✔Trapdoor Function - ✔✔A function that is easy to compute in one direction, yet
believed to be difficult to compute in the opposite direction (finding its inverse) without
special information, called the "trapdoor."
,✔✔hash function - ✔✔no key; one-way function (trapdoor); MD2 - 5; aka 'message
digest'; INTEGRITY
✔✔Collision (cryptographic attacks) - ✔✔This type of attack is where two different
inputs yield the same output of a hash function. Through manipulation of data, creating
subtle changes that are not visible to the user yet create different versions of a digital
file and the creation of many different versions, then using the birthday attack to find a
_____ between any two of the many versions, an attacker has a chance to create a file
with changed visible content but identical hashes.
✔✔digital signature - ✔✔electronically signing a document with data that cannot be
forged; NON REPUDIATION INTEGRITY
sender signs with private key for non repudiation
recipient decrypts with sender public key
✔✔Steganography - ✔✔hide data in a 'carrier' file or medium; disguise encrypted data;
SECRECY
✔✔histogram - ✔✔graphical representation of the number of occurrences of data in a
given distribution of such data
✔✔Steganography (3 types) - ✔✔provides secrecy by hiding data within data | injection;
substitution; file generation
✔✔carrier file - ✔✔aka host file | the file in which the data is hidden | message is the
hidden data
✔✔injection (steganography) - ✔✔file size can tip off; adding hidden data to carrier file
✔✔substitution (steganography) - ✔✔most popular; file size remains same
✔✔File generation (steganography) - ✔✔generate from hidden data; carrier not needed
before; produced by stego program; each new input produces new output
✔✔detection (stego) - ✔✔histogram; high entropy = encryption; no universal method to
detect stego
✔✔LSB - ✔✔Least Significant Bit graphics color tables | the bits that have the list
impact on shifting color and can accommodate the message
✔✔tractable - ✔✔easy crypto problem
✔✔intractable - ✔✔hard crypto problem (factor large integers into two prime factors)
also encompasses discrete logarithm problem (el gamal)
, ✔✔ECC - ✔✔Elliptic curve cryptography. An asymmetric encryption algorithm
commonly used with smaller wireless devices. It uses smaller key sizes and requires
less processing power than many other encryption methods
✔✔DES - ✔✔symmetric; 64 bit block cipher (56 key + 8 for parity) vulnerable due to
small key size
✔✔algorithm group - ✔✔if cipher is in a 'group' multiple rounds of encryption does not
increase security
✔✔Double DES - ✔✔A DES version that uses a 112-bit key length; encipher message;
then encipher encrypted message
✔✔Triple DES (3DES) - ✔✔A more-secure variant of DES that
repeatedly encodes the message using three separate DES keys; 16 rounds per pass
✔✔AES - ✔✔advanced encryption standard, a symmetric 128-bit block data encryption
technique; also 192 or 256 bit keys
✔✔RSA Algorithm - ✔✔Named after inventors Rivest, Shamir, and Adelman, RSA is a
system for encrypting and decrypting a message using a pair of keys, both of which
contain the product of two prime numbers. SSL; asymmetric
✔✔MD5 - ✔✔Message Digest 5. A hashing function used to provide integrity. MD5 uses
128 bits. A hash is simply a number created by applying the algorithm to a file or
message at different times. The hashes are compared to each other to verify that
integrity has been maintained.
✔✔SHA - ✔✔Secure Hashing Algorithm
✔✔SHA-1 - ✔✔160 bit hash 20-byte key length
✔✔SHA-2 - ✔✔The second revision of SHA, also designed by the NSA, which supports
a variety of hash sizes, the most popular of which are SHA-256 and SHA-512.
✔✔Analytic Cryptanalysis - ✔✔Uses algorithms and mathematics to deduce key or
reduce key space to be searched
✔✔Statistical Cryptanalysis - ✔✔Uses statistical characteristics of langauges or
weaknesses in keys
