Deck 23: Internet Authentication Applications

Question 1

The approach taken by Kerberos is using authentication software tiedto a secure authentication server.

Answer 1

True

Question 2

_______ is important as part of the directory service that it supports and is also a basic building block used in other standards.

A) PKI
B) X.509
C) Kerberos
D) FIM

Answer 2

B

Question 3

CMP, defined in RFC 2510, is designed to be a flexible protocol ableto accommodate a variety of technical, operational, and business models.

Answer 3

True

Question 4

An obvious security risk is that of impersonation.

Question 5

_______ certificates are used in most network security applications, including IP security, secure sockets layer, secure electronic transactions, and S/MIME.

A) X.509
B) PKI
C) FIM
D) SCA

Question 6

The principal objective for developing a PKI is to enable secure,convenient, and efficient acquisition of private keys.

Question 7

The ticket-granting ticket is encrypted with a secret key known only tothe AS and the TGS.

Question 8

The ticket-granting ticket is not reusable.

Question 9

Update is not required when the certificate lifetime expires or as aresult of certificate revocation.

Question 10

Kerberos does not support interrealm authentication.

Question 11

Initialization begins the process of enrolling in a PKI.

Question 12

Kerberos uses the _______ encryption algorithm.

A) AES
B) PKI
C) DES
D) TGS

Question 13

Because serial numbers are unique within a CA, the serial number issufficient to identify the certificate.

Question 14

The authentication server shares a unique secret key with each server.

Question 15

________ requires that a user prove his or her identity for each service invoked and, optionally, requires servers to prove their identity to clients.

A) FIM
B) Kerberos
C) X.509
D) PKI

Question 16

Kerberos is designed to counter only one specific threat to the securityof a client/server dialogue.

Question 17

The overall scheme of Kerberos is that of a trusted third-partyauthentication service.

Question 18

One of the earliest and most widely used services is _________.

A) Kerberos
B) FIM
C) PKI
D) X.509

Question 19

Federated identity management makes use of a number of standardsthat provide the building blocks for secure identity information exchange across different domains or heterogeneous systems.

Question 20

X.509 provides a format for use in revoking a key before it expires.

Question 21

________ is a process where authentication and permission will be passed on from one system to another, usually across multiple enterprises, reducing the number of authentications needed by the user.

A) Integration
B) Registration
C) Synchronization
D) Federation

Question 22

An integer value unique within the issuing CA that is unambiguously associated with the certificate is the ________.

A) issuer name
B) subject's public-key information
C) issuer unique identifier
D) serial number

Question 23

The _________ is an optional bit string field used to identify uniquely the issuing CA in the event the X.500 name has been reused for different entities.

Question 24

_______ is a minimal set of conventions for invoking code using XML over HTTP that enables applications to request services from one another with XML-based requests and receive responses as data formatted with XML.

A) SOAP
B) SAML
C) HTML
D) WS-Security

Question 25

The _______ consists of two dates: the first and last on which the certificate is valid.

A) version
B) period of validity
C) extension
D) unique identifier

Question 26

A _______ is a generic term used to denote any method for storing certificates and CRLs so that they can be retrieved by end entities.

A) RA
B) registration
C) repository
D) CA

Question 27

The focus of _________ is defining an identity for each user, associating attributes with the identity, and enforcing a means by which a user can verify identity.

Question 28

_______ systems are automated methods of verifying or recognizing identity on the basis of some physiological or behavioral characteristic.

Question 29

An alternative to each server being required to confirm identities of clients who request service is to use an _______ that knows the passwords of all users and stores them in a centralized database.

Question 30

A principal element of an identity management system is _______.

A) workflow automation
B) delegated administration
C) authentication
D) all of the above

Question 31

_______ is the process whereby a user first makes itself known to a CA prior to that CA issuing a certificate or certificates for that user.

A) Authorization
B) Registration
C) Certification
D) Initialization

Question 32

______ is the set of hardware, software, people, policies, and procedures needed to create, manage, store, distribute, and revoke digital certificates based on asymmetric cryptography.

Question 33

In a generic identity management architecture a ________ is an identity holder.

Question 34

_____ is a markup language that uses sets of embedded tags or labels to characterize text elements within a document so as to indicate their appearance, function, meaning, or context.

A) HML
B) HTTP
C) XML
D) SOAP

Question 35

A software utility initially developed at MIT and available both in the public domain and in commercially supported versions, ________ is the defacto standard for remote authentication.

Question 36

The certification _________ is the issuer of certificates and certificate revocation lists.

Question 37

________ allows end entities to restore their encryption/decryption key pair from an authorized key backup facility.

Question 38

_______ is the process in which a CA issues a certificate for a user's public key and returns that certificate to the user's client system and/or posts that certificate in a repository.

A) Certification
B) Registration
C) Initialization
D) Authorization

Question 39

_______ is movement of data in a business process.

A) Provisioning
B) Workflow automation
C) Revocation
D) Initialization

Question 40

A full-service Kerberos environment consisting of a Kerberos server that has the user ID and password of all participating users in its database and shares a secret key with each server, all users and servers being registered with the Kerberos server, is referred to as a Kerberos ______.

Question 41

________ is a set of SOAP extensions for implementing message integrity and confidentiality in Web services.

Question 42

The ticket contains the user's ID, the server's ID, a __________, a lifetime after which the ticket is invalid, and a copy of the same session key sent in the outer message to the client.

Question 43

In a generic identity management architecture _______ are entities that obtain and employ data maintained and provided by identity and attribute providers, often to support authorization decisions and to collect audit information.

Question 44

_______ is an XML-based language for the exchange of security information between online business partners.

Question 45

In Kerberos, the ___________ decrypts the ticket and authenticator, verifies the request, and creates ticket for requested server.