Question 1

Which of the following is used to associate a public key with an identity?
A) Encryption
B) Digital hash
C) Digital certificate
D) Digital signature

Accepted Answer

Digital certificates are used to associate a public key with an identity, ensuring that a public key belongs to the individual, organization, server, or device it claims to be associated with.

Question 2

Which of the following statements about asymmetric key cryptography is true?
A) Asymmetric key cryptography uses one shared key.
B) Asymmetric key cryptography is also called private key cryptography.
C) Asymmetric key cryptography uses two keys called public keys.
D) Asymmetric key cryptography is also called public key cryptography.

Accepted Answer

Asymmetric key cryptography, unlike symmetric key cryptography that uses one shared key, utilizes a pair of keys for encryption and decryption processes. These keys are known as the public key and the private key. The public key is shared with anyone who wants to send an encrypted message, while the private key is kept secret and used to decrypt the message. This method is also referred to as public key cryptography, making option D correct.

Question 3

Which of the following issues and maintains digital certificates?
A) Registration authority
B) Certification authority
C) Public key infrastructure
D) Client nodes

Accepted Answer

Certification authorities (CAs) are responsible for issuing and managing digital certificates, which are used to verify the identity of entities and to secure communications.

Question 4

Which of the following tasks is part of the disposal phase of the SDLC?
A) Authorization
B) Conducting risk assessment
C) Archiving information and sanitization of media
D) Adding hardware and software

Accepted Answer

During the disposal phase of the System Development Life Cycle (SDLC), it is crucial to properly archive information and sanitize media to ensure that sensitive data is securely erased and cannot be recovered. This step is essential for maintaining data security even after a system is no longer in use.

Question 5

Identification of compliance requirements is done during which of the following phases of the SDLC?
A) Initiation
B) Development/acquisition
C) Implementation/assessment
D) Operations/maintenance

Accepted Answer

During the Initiation phase of the System Development Life Cycle (SDLC), identification of compliance requirements is crucial. This early phase involves defining the system's objectives, scope, and constraints, which includes understanding and incorporating any relevant compliance requirements to ensure the system will meet legal and regulatory standards from the outset.

Question 6

Which of the following is the most common web application security flaw?
A) Failure to validate output
B) Failure to validate input
C) Dynamic data validation
D) Static data validation

Accepted Answer

Failure to validate input is the most common web application security flaw. It can lead to various security issues, such as SQL injection, cross-site scripting (XSS), and other vulnerabilities, by allowing attackers to manipulate the inputs in a way that was not intended by the application developers.

Question 7

Symmetric key cryptography uses which of the following?
A) One public key
B) One shared key
C) Two public keys
D) One public and one private key

Accepted Answer

Symmetric key cryptography uses one shared key for both encryption and decryption. This key must be known to both the sender and the receiver.

Question 8

Which of the following is one of the most popular symmetric algorithms of recent years?
A) AES
B) RSA
C) DES
D) IPsec

Accepted Answer

AES (Advanced Encryption Standard) is one of the most popular symmetric encryption algorithms in recent years, widely used across various security protocols and systems for its robustness and efficiency. RSA and IPsec are not symmetric algorithms; RSA is an asymmetric algorithm, and IPsec is a suite of protocols. DES, while historically significant, has been largely superseded by AES due to its stronger security features.

Question 9

Which of the following statements about symmetric key cryptography is not true?
A) Symmetric key cryptography uses one shared key.
B) Symmetric algorithms can provide confidentiality.
C) Symmetric algorithms can provide nonrepudiation and authenticity.
D) Symmetric key cryptography uses a single secret key.

Accepted Answer

Symmetric algorithms primarily provide confidentiality through encryption and decryption using a shared secret key. Nonrepudiation and authenticity are typically provided by asymmetric cryptography, not symmetric, because symmetric keys are shared and do not inherently link an action to a specific user's identity.

Question 10

Which of the following is a component of PKI?
A) Certification authority
B) Registration authority
C) Client nodes
D) All of the above

Accepted Answer

All of the options listed are components of a Public Key Infrastructure (PKI). The Certification Authority (CA) issues digital certificates, the Registration Authority (RA) verifies the identity of entities requesting certificates, and client nodes use these certificates for secure communication.

Question 11

Which of the following is the process of creating a numeric value that represents the original text?
A) Encryption
B) Decryption
C) Hashing
D) Key management

Accepted Answer

Hashing is the process of converting input (like a password or any data) into a fixed-size string of characters, which usually appears to be random. This is used for integrity checks, password storage, and other security measures. Unlike encryption, hashing is a one-way process, meaning you cannot retrieve the original input from the hash.

Question 12

Which of the following provides confidentiality?
A) Encryption
B) Decryption
C) Hashing
D) Key management

Accepted Answer

Encryption is the process of converting data into a code to prevent unauthorized access, thus providing confidentiality.

Question 13

Public key cryptography uses which of the following?
A) A shared key
B) A public key
C) A private key
D) Both a public and a private key

Accepted Answer

Public key cryptography, also known as asymmetric cryptography, utilizes both a public key for encryption and a private key for decryption. The public key is shared openly, while the private key is kept secret.

Question 14

Which of the following provides a standardized process for all phases of any system development or acquisition effort?
A) COTS
B) SDLC
C) NIST
D) CIA

Accepted Answer

SDLC (Systems Development Life Cycle) provides a standardized process for all phases of any system development or acquisition effort.

Question 15

In which phase of the SDLC are systems and products in place and operating, enhancements and/or modifications to the system are being developed and tested, and hardware and software components are added or replaced?
A) Initiation
B) Development/acquisition
C) Operations/maintenance
D) Implementation/assessment

Accepted Answer

During the Operations/maintenance phase of the SDLC, systems and products are in place and operating. This phase involves the development and testing of enhancements or modifications, as well as the addition or replacement of hardware and software components.

Question 16

Which of the following is a hybrid of a beta and a final release version of a software product?
A) Release candidate
B) Alpha phase
C) General availability
D) Go live

Accepted Answer

A release candidate (RC) is a beta version with potential to be a final product, which is ready to release unless significant bugs emerge. This stage comes after the beta phase and before the final release, making it a hybrid of both.

Question 17

Which of the following is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted?
A) NIST
B) GLBA
C) MITRE
D) OWASP

Accepted Answer

OWASP (Open Web Application Security Project) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. It provides free tools, documentation, and forums to assist with application security.

Question 18

Which of the following components of PKI performs the administrative functions, including verifying the identity of users and organizations requesting a digital certificate?
A) Certification authority
B) Registration authority
C) Client nodes
D) Digital certificate

Accepted Answer

The Registration Authority (RA) is responsible for verifying the identity of users and organizations before a digital certificate is issued by the Certification Authority (CA).

Question 19

Which of the following is not a best practice for cryptographic key management?
A) Keys should be transmitted and stored by secure means.
B) Keys should be properly destroyed when their lifetime ends.
C) Keys should be presented in clear text.
D) Key values should be random, and the full spectrum of the keyspace should be used.

Accepted Answer

Presenting keys in clear text is not a best practice for cryptographic key management because it exposes the keys to potential interception and misuse. Keys should always be protected and handled securely to maintain the confidentiality and integrity of the cryptographic system.

Question 20

Which of the following is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization?
A) ISO
B) SAMM
C) OWASP
D) SDLC

Accepted Answer

SAMM (Software Assurance Maturity Model) is an open framework designed to help organizations formulate and implement a strategy for software security that is specifically tailored to the risks facing the organization.

Quiz 10: Information Systems Acquisition, Development, and Maintenance

Which of the following is used to associate a public key with an identity?

Which of the following statements about asymmetric key cryptography is true?

Which of the following issues and maintains digital certificates?

Which of the following tasks is part of the disposal phase of the SDLC?

Identification of compliance requirements is done during which of the following phases of the SDLC?

Which of the following is the most common web application security flaw?

Symmetric key cryptography uses which of the following?

Which of the following is one of the most popular symmetric algorithms of recent years?

Which of the following statements about symmetric key cryptography is not true?

Which of the following is a component of PKI?

Which of the following is the process of creating a numeric value that represents the original text?

Which of the following provides confidentiality?

Public key cryptography uses which of the following?

Which of the following provides a standardized process for all phases of any system development or acquisition effort?

In which phase of the SDLC are systems and products in place and operating, enhancements and/or modifications to the system are being developed and tested, and hardware and software components are added or replaced?

Which of the following is a hybrid of a beta and a final release version of a software product?

Which of the following is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted?

Which of the following components of PKI performs the administrative functions, including verifying the identity of users and organizations requesting a digital certificate?

Which of the following is not a best practice for cryptographic key management?

Which of the following is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization?