Question 1

What type of attack involves an attacker stealing a file containing password digests and comparing the digests with digests created by the attacker?

Accepted Answer

This type of attack is called offline cracking, where the attacker steals a file containing password digests and tries to crack the password by comparing the digests with digests created by the attacker. Online cracking refers to attempting to guess a password while it is being inputted or transmitted. Hash replay and token replay attacks involve intercepting and reusing authentication information, which is different from stealing and cracking password digests.

Question 2

What is the center of the weakness of passwords?

Accepted Answer

The center of weakness of passwords is human memory. People tend to choose weak and easy-to-guess passwords because they are afraid of forgetting them. They also tend to reuse the same password across different accounts, making it easier for hackers to gain access to multiple systems. Moreover, humans are also vulnerable to social engineering attacks, where hackers trick them into revealing their passwords. Therefore, the weakness lies in the human aspect of password creation, management, and usage.

Question 3

​Which hashing algorithm below is used with NTLMv2's Hashed Message Authentication Code?

Accepted Answer

NTLMv2's Hashed Message Authentication Code (HMAC) uses MD5 as its hashing algorithm.

Question 4

Geolocation is the identification of the location of a person or object using technology, and can be used as part of an authentication method.​

Accepted Answer

Geolocation technology can be used to confirm a person's location as part of an authentication process, making it a true statement.

Question 5

Using a rainbow table to crack a password requires three steps: Creation of the table, comparing the table to known hash values, and decrypting the password.

Accepted Answer

Rainbow tables are used to crack passwords by precomputing hash values and comparing them to known hashes, but they do not decrypt passwords. They reverse-engineer the hash to find the original password.

Question 6

​What type of one-time password (OTP) changes after a set time period?

Accepted Answer

The answer of ​What type of one-time password (OTP) changes...

Question 7

Which type of biometrics is based on the perception, thought process, and understanding of the user?

Accepted Answer

Cognitive biometrics are based on the perception, thought process, and understanding of the user, such as their typing rhythm, eye movement, and response time. This distinguishes it from standard biometrics, which are based on physical characteristics like fingerprints and facial recognition, and affective biometrics, which are based on emotion recognition. Reactive biometrics is not a recognized category of biometrics.

Question 8

What type of attack involves using every possible combination of letters, numbers, and characters to create candidate digests that are then matched against those in a stolen digest file?

Accepted Answer

This type of attack is known as a brute force attack, where the attacker tries every possible combination to crack a password or hash function.

Question 9

Token credentials can be revoked at any time by the user without affecting other token credentials issued to other sites.

Accepted Answer

Token credentials are issued to specific sites and can be revoked by the user without affecting the tokens issued to other sites. This allows users to have more control over their security and privacy.

Question 10

The use of a single authentication credential that is shared across multiple networks is called:

Accepted Answer

The use of a single authentication credential that is shared across multiple networks is commonly known as Identity management. It helps in managing and controlling access to protected resources while maximizing usability and security.

Question 11

The use of what item below involves the creation of a large pregenerated data set of candidate digests?

Accepted Answer

Rainbow tables involve the creation of a large pregenerated data set of candidate digests, making them the correct choice for this question. Randomized character lists and word lists may be used in password cracking, but do not involve the creation of a pregenerated data set. Cascade tables is not a common term used in password cracking.

Question 12

OpenID is an example of a web-based federated identity management (FIM) system.​

Accepted Answer

OpenID is a web-based federated identity management system that allows users to use one set of login credentials to access multiple applications and websites.

Question 13

What can be used to increase the strength of hashed passwords?​

Accepted Answer

Salt is a random value that is added to the password before it is hashed. This makes it more difficult for attackers to guess the password, even if they know the hashing algorithm.

Question 14

​Select below the decentralized open-source FIM that does not require specific software to be installed on the desktop:

Accepted Answer

OpenID is a decentralized open-source FIM that does not require any specific software to be installed on the desktop. It is a URL-based authentication system that allows users to authenticate themselves on different websites using a single set of credentials. OAuth also does not require any specific software to be installed on the desktop, but it is not a FIM. Windows Live ID and OpenPass both require specific software to be installed on the desktop.

Question 15

Passwords that are transmitted can be captured by what type of software?

Accepted Answer

Protocol analyzers, also known as network sniffers, are specialized software programs that intercept and analyze network traffic. They can capture and decode passwords and other sensitive information as it travels across the network.

Question 16

​What federated identity management (FIM) relies on token credentials?

Accepted Answer

Federated identity management relies on the exchange of token-based credentials between different systems or services. OAuth is a common protocol used for this purpose, allowing users to grant access to their resources or accounts without sharing passwords or other sensitive information. OpenID and Windows Live also support FIM, but they use different methods for identity verification and authentication. OpenPass is not a recognized FIM protocol.

Question 17

Passwords provide strong protection.

Accepted Answer

While passwords can provide some level of protection, they are not foolproof and can be easily guessed, stolen, or hacked. It is recommended to use strong, unique passwords and implement additional security measures such as two-factor authentication.

Question 18

A secret combination of letters, numbers, and/or characters that only the user should have knowledge of, is known as a:

Accepted Answer

A password is a secret combination of letters, numbers, and/or characters that only the user should have knowledge of. Tokens are physical devices that generate one-time passwords for authentication. Biometric details refer to unique physical characteristics such as fingerprints or facial recognition. Challenge refers to a request for authentication. Therefore, the best choice is B) password.

Question 19

The use of one authentication credential to access multiple accounts or applications is referred to as?

Accepted Answer

Single Sign On (SSO) is a method of authentication that allows users to access multiple accounts or applications with just one set of credentials. This reduces the need for users to remember multiple usernames and passwords and simplifies the login process. Individual Sign On (ISO) and Unilateral Sign On (USO) are not standard terms in the industry. Federated Sign On (FSO) refers to a specific type of SSO where the authentication process is shared between different organizations or domains.

Question 20

​A list of the available nonkeyboard characters can be seen in Windows by opening what utility?

Accepted Answer

The "charmap.exe" utility in Windows allows users to view and select nonkeyboard characters, also known as Unicode characters. This utility can be accessed by searching for "Character Map" in the Windows Start menu or by pressing the Windows key + R and typing "charmap" in the Run dialog box.

Quiz 12: Authentication and Account Management