QUESTION: 49

Which of the following encryption methods does the SSL protocol use in order to provide communication privacy, authentication, and message integrity? Each correct answer represents a part of the solution. Choose two.

Public key
IPsec
MS-CHAP
Symmetric

Answer(s): A,D

Explanation:

SSL uses a combination of public key and symmetric encryption to provide communication privacy, authentication, and message integrity. Symmetric encryption is a type of encryption that uses a single key to encrypt and decrypt data.
Symmetric encryption algorithms are faster than public key encryption. Therefore, it is commonly used when a message sender needs to encrypt a large amount of data. Data Encryption Standard (DES) uses symmetric encryption key algorithm to encrypt data. The Public Key Encryption also called asymmetric encryption was first publicly proposed by Diffie and Hellman in 1976. Public Key Encryption is more secure than non-public key encryption. It is based on the mathematical functionality rather than on the simple operations on bit patterns. It uses two separate keys. It has five stages as follows:
Plain Text: It is the original message.
Encryption Algorithm: It performs different transformations on plain text. Public and Private Key: It is the input to the encryption algorithm.
Cipher Text: It is the scrambled message as an output.
Decryption Algorithm: It performs on cipher text and gives the original message as an output. Answer option B is incorrect. Internet Protocol Security (IPSec) is a method of securing data. It secures traffic by using encryption and digital signing. It enhances the security of data as if an IPSec packet is captured, its contents cannot be read.
IPSec also provides sender verification that ensures the certainty of the datagram's origin to the receiver. Answer option C is incorrect. Microsoft created the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) to authenticate remote Windows workstations. It is designed especially for Windows 95, Windows 98, Windows NT, and Windows 2000 networking products. This protocol provides data encryption along with password encryption.

Reveal Solution Next Question

QUESTION: 51

You work as a Network Consultant. A company named Tech Perfect Inc. hires you for security reasons. The manager of the company tells you to establish connectivity between clients and servers of the network which prevents eavesdropping and tampering of data on the Internet.
Which of the following will you configure on the network to perform the given task?

WEP
IPsec
VPN
SSL

Answer(s): D

Explanation:

In order to perform the given task, you will have to configure the SSL protocol on the network. Secure Sockets Layer (SSL) is a protocol used to transmit private documents via the Internet. SSL uses a combination of public key and symmetric encryption to provide communication privacy, authentication, and message integrity. Using the SSL protocol, clients and servers can communicate in a way that prevents eavesdropping and tampering of data on the Internet. Many Web sites use the SSL protocol to obtain confidential user information, such as credit card numbers. By convention, URLs that require an SSL connection start with https: instead of http:. By default, SSL uses port 443 for secured communication.
Answer option B is incorrect. Internet Protocol Security (IPSec) is a method of securing data. It secures traffic by using encryption and digital signing. It enhances the security of data as if an IPSec packet is captured, its contents cannot be read.
IPSec also provides sender verification that ensures the certainty of the datagram's origin to the receiver. Answer option A is incorrect. Wired Equivalent Privacy (WEP) is a security protocol for wireless local area networks (WLANs). It has two components, authentication and encryption. It provides security, which is equivalent to wired networks, for wireless networks. WEP encrypts data on a wireless network by using a fixed secret key. WEP incorporates a checksum in each frame to provide protection against the attacks that attempt to reveal the key stream.
Answer option C is incorrect. VPN stands for virtual private network. It allows users to use the Internet as a secure pipeline to their corporate local area networks (LANs). Remote users can dial-in to any local Internet Service Provider (ISP) and initiate a VPN session to connect to their corporate LAN over the Internet. Companies using VPNs significantly reduce long-distance dial-up charges. VPNs also provide remote employees with an inexpensive way of remaining connected to their company's LAN for extended periods.

Reveal Solution Next Question

QUESTION: 52

John used to work as a Network Administrator for We-are-secure Inc. Now he has resigned from the company for personal reasons. He wants to send out some secret information of the company. To do so, he takes an image file and simply uses a tool image hide and embeds the secret file within an image file of the famous actress, Jennifer Lopez, and sends it to his Yahoo mail id. Since he is using the image file to send the data, the mail server of his company is unable to filter this mail.
Which of the following techniques is he performing to accomplish his task?

Email spoofing
Social engineering
Web ripping
Steganography

Answer(s): D

Explanation:

According to the scenario, John is performing the Steganography technique for sending malicious data. Steganography is an art and science of hiding information by embedding harmful messages within other seemingly harmless messages. It works by replacing bits of unused data, such as graphics, sound, text, and HTML, with bits of invisible information in regular computer files.
This hidden information can be in the form of plain text, cipher text, or even in the form of images. Answer option C is incorrect. Web ripping is a technique in which the attacker copies the whole structure of a Web site to the local disk and obtains all files of the Web site. Web ripping helps an attacker to trace the loopholes of the Web site. Answer option B is incorrect. Social engineering is the art of convincing people and making them disclose useful information such as account names and passwords. This information is further exploited by hackers to gain access to a user's computer or network. This method involves mental ability of the people to trick someone rather than their technical skills. A user should always distrust people who ask him for his account name or password, computer name, IP address, employee ID, or other information that can be misused.
Answer option A is incorrect. John is not performing email spoofing. In email spoofing, an attacker sends emails after writing another person's mailing address in the from field of the email id.

Reveal Solution Next Question

QUESTION: 53

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

Network-based
Anomaly-based
File-based
Signature-based

Answer(s): B

Explanation:

The anomaly-based intrusion detection system (IDS) monitors network traffic and compares it against an established baseline. This type of IDS monitors traffic and system activity for unusual behavior based on statistics. In order to identify a malicious activity, it learns normal behavior from the baseline. The anomaly-based intrusion detection is also known as behavior-based or statistical-based intrusion detection.
Answer option D is incorrect. Signature-based IDS uses a database with signatures to identify possible attacks and malicious activity.
Answer option A is incorrect. A network-based IDS can be a dedicated hardware appliance, or an application running on a computer, attached to the network. It monitors all traffic in a network or traffic coming through an entry-point such as an Internet connection.
Answer option C is incorrect. There is no such intrusion detection system (IDS) that is file-based.

Reveal Solution Next Question

Free ISSAP Exam Braindumps (page: 13)

QUESTION: 49

Explanation:

QUESTION: 51

Explanation:

QUESTION: 52

Explanation:

QUESTION: 53

Explanation: