testexam23 Attention Please: Professional new version ISC CISSP PDF and VCE dumps can now free download on Flydumps.com all are updated timely by our experts covering all new questions and questions.100 percent pass your ISC https://www.leads4pass.com/cissp.html exam.
QUESTION 1
A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:
A. Concern that the laser beam may cause eye damage.
B. The iris pattern changes as a person grows older.
C. There is a relatively high rate of false accepts.
D. The optical unit must be positioned so that the sun does not shine into the aperture.
Correct Answer: D Explanation
Explanation/Reference:
Because the optical unit utilizes a camera and infrared light to create the images, sun light can impact the
aperture so it must not be positioned in direct light of any type. Because the subject does not need to have
direct contact with the optical reader, direct light can impact the reader. An Iris recognition is a form of
biometrics that is based on the uniqueness of a subject’s iris. A camera like device records the patterns of
the iris creating what is known as Iriscode. It is the unique patterns of the iris that allow it to be one of the
most accurate forms of biometric identification of an individual. Unlike other types of biometics, the iris
rarely changes over time. Fingerprints can change over time due to scaring and manual labor, voice
patterns can change due to a variety of causes, hand geometry can also change as well. But barring
surgery or an accident it is not usual for an iris to change. The subject has a high-resoulution image taken
of their iris and this is then converted to Iriscode. The current standard for the Iriscode was developed by
John Daugman. When the subject attempts to be authenticated an infrared light is used to capture the iris
image and this image is then compared to the Iriscode. If there is a match the subject’s identity is
confirmed. The subject does not need to have direct contact with the optical reader so it is a less invasive
means of authentication then retinal scanning would be.
Reference(s) used for this question:
AIO, 3rd edition, Access Control, p 134
AIO, 4th edition, Access Control, p 182
Wikipedia – http://en.wikipedia.org/wiki/Iris_recognition
The following answers are incorrect:
Concern that the laser beam may cause eye damage. The optical readers do not use laser so, concern
that the laser beam may cause eye damage is not an issue.
The iris pattern changes as a person grows older. The question asked about the physical installation of the
scanner, so this was not the best answer. If the question would have been about long term problems then
it could have been the best choice. Recent research has shown that Irises actually do change over time:
http://www.nature.com/news/ageing-eyes-hinder- biometric-scans-110722
There is a relatively high rate of false accepts. Since the advent of the Iriscode there is a very low rate of
false accepts, in fact the algorithm used has never had a false match. This all depends on the quality of the
equipment used but because of the uniqueness of the iris even when comparing identical twins, iris
patterns are unique.
QUESTION 2
In Mandatory Access Control, sensitivity labels attached to object contain what information?
A. The item’s classification
B. The item’s classification and category set
C. The item’s category
D. The items’s need to know
Correct Answer: B Explanation
Explanation/Reference:
The following is the correct answer: the item’s classification and category set.
A Sensitivity label must contain at least one classification and one category set.
Category set and Compartment set are synonyms, they mean the same thing. The sensitivity label must
contain at least one Classification and at least one Category. It is common in some environments for a
single item to belong to multiple categories. The list of all the categories to which an item belongs is called
a compartment set or category set.
The following answers are incorrect:
The item’s classification. Is incorrect because you need a category set as well. The item’s category. Is
incorrect because category set and classification would be both be required.
The item’s need to know. Is incorrect because there is no such thing. The need to know is indicated by the
catergories the object belongs to. This is NOT the best answer.
Reference(s) used for this question:
OIG CBK, Access Control (pages 186 – 188)
AIO, 3rd Edition, Access Control (pages 162 – 163)
AIO, 4th Edition, Access Control, pp 212-214
Wikipedia – http://en.wikipedia.org/wiki/Mandatory_Access_Control
QUESTION 3
Which of the following is true about Kerberos?
A. It utilizes public key cryptography.
B. It encrypts data after a ticket is granted, but passwords are exchanged in plain text.
C. It depends upon symmetric ciphers.
D. It is a second party authentication system.
Correct Answer: C Explanation
Explanation/Reference:
Kerberos depends on secret keys (symmetric ciphers). Kerberos is a third party authentication protocol. It
was designed and developed in the mid 1980’s by MIT. It is considered open source but is copyrighted and
owned by MIT. It relies on the user’s secret keys. The password is used to encrypt and decrypt the keys.
The following answers are incorrect:
It utilizes public key cryptography. Is incorrect because Kerberos depends on secret keys (symmetric
ciphers).
It encrypts data after a ticket is granted, but passwords are exchanged in plain text. Is incorrect because
the passwords are not exchanged but used for encryption and decryption of the keys.
It is a second party authentication system. Is incorrect because Kerberos is a third party authentication
system, you authenticate to the third party (Kerberos) and not the system you are accessing.
References:
MIT http://web.mit.edu/kerberos/
Wikipedi http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 OIG CBK Access Control (pages 181 -184)
AIOv3 Access Control (pages 151 – 155)
QUESTION 4
Which of the following is needed for System Accountability?
A. Audit mechanisms.
B. Documented design as laid out in the Common Criteria.
C. Authorization.
D. Formal verification of system design.
Correct Answer: A Explanation
Explanation/Reference:
Is a means of being able to track user actions. Through the use of audit logs and other tools the user
actions are recorded and can be used at a later date to verify what actions were performed.
Accountability is the ability to identify users and to be able to track user actions.
The following answers are incorrect:
Documented design as laid out in the Common Criteria. Is incorrect because the Common Criteria is an
international standard to evaluate trust and would not be a factor in System Accountability.
Authorization. Is incorrect because Authorization is granting access to subjects, just because you have
authorization does not hold the subject accountable for their actions.
Formal verification of system design. Is incorrect because all you have done is to verify the system design
and have not taken any steps toward system accountability.
References:
OIG CBK Glossary (page 778)
QUESTION 5
What is Kerberos?
A. A three-headed dog from the egyptian mythology.
B. A trusted third-party authentication protocol.
C. A security model.
D. A remote authentication dial in user server. Correct Answer: B
Explanation Explanation/Reference:
Is correct because that is exactly what Kerberos is.
The following answers are incorrect:
A three-headed dog from Egyptian mythology. Is incorrect because we are dealing with Information
Security and not the Egyptian mythology but the Greek Mythology.
A security model. Is incorrect because Kerberos is an authentication protocol and not just a security model.
A remote authentication dial in user server. Is incorrect because Kerberos is not a remote authentication
dial in user server that would be called RADIUS.
QUESTION 6
Kerberos depends upon what encryption method?
A. Public Key cryptography.
B. Secret Key cryptography.
C. El Gamal cryptography.
D. Blowfish cryptography. Correct Answer: B
Explanation Explanation/Reference:
Kerberos depends on Secret Keys or Symmetric Key cryptography.
Kerberos a third party authentication protocol. It was designed and developed in the mid 1980’s by MIT. It
is considered open source but is copyrighted and owned by MIT. It relies on the user’s secret keys. The
password is used to encrypt and decrypt the keys.
This question asked specifically about encryption methods. Encryption methods can be SYMMETRIC (or
secret key) in which encryption and decryption keys are the same, or ASYMMETRIC (aka ‘Public Key’) in
which encryption and decryption keys differ.
‘Public Key’ methods must be asymmetric, to the extent that the decryption key CANNOT be easily derived
from the encryption key. Symmetric keys, however, usually encrypt more efficiently, so they lend
themselves to encrypting large amounts of data. Asymmetric encryption is often limited to ONLY
encrypting a symmetric key and other information that is needed in order to decrypt a data stream, and the
remainder of the encrypted data uses the symmetric key method for performance reasons. This does not in
any way diminish the security nor the ability to use a public key to encrypt the data, since the symmetric
key method is likely to be even MORE secure than the asymmetric method.
For symmetric key ciphers, there are basically two types: BLOCK CIPHERS, in which a fixed length block
is encrypted, and STREAM CIPHERS, in which the data is encrypted one ‘data unit’ (typically 1 byte) at a
time, in the same order it was received in.
The following answers are incorrect:
Public Key cryptography. Is incorrect because Kerberos depends on Secret Keys or Symmetric Key
cryptography and not Public Key or Asymmetric Key cryptography.
El Gamal cryptography. Is incorrect because El Gamal is an Asymmetric Key encryption algorithm.
Blowfish cryptography. Is incorrect because Blowfish is a Symmetric Key encryption algorithm.
References:
OIG CBK Access Control (pages 181 – 184)
AIOv3 Access Control (pages 151 – 155)
Wikipedia http://en.wikipedia.org/wiki/Blowfish_%28cipher%29 ; http://en.wikipedia.org/wiki/El_Gamal
http://www.mrp3com/encrypt.html
QUESTION 7
A confidential number used as an authentication factor to verify a user’s identity is called a:
A. PIN
B. User ID
C. Password
D. Challenge
Correct Answer: A Explanation
Explanation/Reference:
PIN Stands for Personal Identification Number, as the name states it is a combination of numbers.
The following answers are incorrect:
User ID This is incorrect because a Userid is not required to be a number and a Userid is only used to
establish identity not verify it.
Password. This is incorrect because a password is not required to be a number, it could be any
combination of characters.
Challenge. This is incorrect because a challenge is not defined as a number, it could be anything.
QUESTION 8
Individual accountability does not include which of the following?
A. unique identifiers
B. policies & procedures
C. access rules
D. audit trails Correct Answer: B
Explanation Explanation/Reference:
Accountability would not include policies & procedures because while important on an effective security program they cannot be used in determing accountability.
The following answers are incorrect:
Unique identifiers. Is incorrect because Accountability would include unique identifiers so that you can
identify the individual.
Access rules. Is incorrect because Accountability would include access rules to define access violations.
Audit trails. Is incorrect because Accountability would include audit trails to be able to trace violations or
attempted violations.
QUESTION 9
Which of the following exemplifies proper separation of duties?
A. Operators are not permitted modify the system time.
B. Programmers are permitted to use the system console.
C. Console operators are permitted to mount tapes and disks.
D. Tape operators are permitted to use the system console. Correct Answer: A
Explanation Explanation/Reference:
This is an example of Separation of Duties because operators are prevented from modifying the system
time which could lead to fraud. Tasks of this nature should be performed by they system administrators.
AIO defines Separation of Duties as a security principle that splits up a critical task among two or more
individuals to ensure that one person cannot complete a risky task by himself.
The following answers are incorrect:
Programmers are permitted to use the system console. Is incorrect because programmers should not be
permitted to use the system console, this task should be performed by operators. Allowing programmers
access to the system console could allow fraud to occur so this is not an example of Separation of Duties..
Console operators are permitted to mount tapes and disks. Is incorrect because operators should be able
to mount tapes and disks so this is not an example of Separation of Duties.
Tape operators are permitted to use the system console. Is incorrect because operators should be able to
use the system console so this is not an example of Separation of Duties.
References:
OIG CBK Access Control (page 98 – 101)
AIOv3 Access Control (page 182)
QUESTION 10
An access control policy for a bank teller is an example of the implementation of which of the following?
A. Rule-based policy
B. Identity-based policy
C. User-based policy
D. Role-based policy Correct Answer: D
Explanation
Explanation/Reference:
The position of a bank teller is a specific role within the bank, so you would implement a role- based policy.
The following answers are incorrect:
Rule-based policy. Is incorrect because this is based on rules and not the role of a of a bank teller so this would not be applicable for a specific role within an organization.
Identity-based policy. Is incorrect because this is based on the identity of an individual and not the role of a bank teller so this would not be applicable for a specific role within an organization. User-based policy. Is incorrect because this would be based on the user and not the role of a bank teller so this would not be not be applicable for a specific role within an organization.
QUESTION 11
Which one of the following authentication mechanisms creates a problem for mobile users?
A. Mechanisms based on IP addresses
B. Mechanism with reusable passwords
C. One-time password mechanism.
D. Challenge response mechanism.
Correct Answer: A Explanation
Explanation/Reference:
Anything based on a fixed IP address would be a problem for mobile users because their location and its associated IP address can change from one time to the next. Many providers will assign a new IP every time the device would be restarted. For example an insurance adjuster using a laptop to file claims online. He goes to a different client each time and the address changes every time he connects to the ISP.
NOTE FROM CLEMENT:
The term MOBILE in this case is synonymous with Road Warriors where a user is constantly traveling and changing location. With smartphone today that may not be an issue but it would be an issue for laptops or WIFI tablets. Within a carrier network the IP will tend to be the same and would change rarely. So this question is more applicable to devices that are not cellular devices but in some cases this issue could affect cellular devices as well.
The following answers are incorrect: Mechanism with reusable password. This is incorrect because reusable password mechanism would not present a problem for mobile users. They are the least secure and change only at specific interval one-time password mechanism. This is incorrect because a one-time password mechanism would not present a problem for mobile users. Many are based on a clock and not on the IP address of the user Challenge response mechanism. This is incorrect because challenge response mechanism would not present a problem for mobile users.
QUESTION 12
Organizations should consider which of the following first before allowing external access to their LANs via the Internet?
A. Plan for implementing workstation locking mechanisms.
B. Plan for protecting the modem pool.
C. Plan for providing the user with his account usage information.
D. Plan for considering proper authentication options.
Correct Answer: D Explanation
Explanation/Reference:
Before a LAN is connected to the Internet, you need to determine what the access controls mechanisms are to be used, this would include how you are going to authenticate individuals that may access your network externally through access control.
The following answers are incorrect:
Plan for implementing workstation locking mechanisms. This is incorrect because locking the workstations have no impact on the LAN or Internet access.
Plan for protecting the modem pool. This is incorrect because protecting the modem pool has no impact on the LAN or Internet access, it just protects the modem.
Plan for providing the user with his account usage information. This is incorrect because the question asks what should be done first. While important your primary concern should be focused on security.
QUESTION 13
Kerberos can prevent which one of the following attacks?
A. Tunneling attack.
B. Playback (replay) attack.
C. Destructive attack.
D. Process attack.
Correct Answer: B Explanation
Explanation/Reference:
Each ticket in Kerberos has a timestamp and are subject to time expiration to help prevent these types of attacks.
The following answers are incorrect:
Tunneling attack. This is incorrect because a tunneling attack is an attempt to bypass security and access low-level systems. Kerberos cannot totally prevent these types of attacks. Destructive attack. This is incorrect because depending on the type of destructive attack, Kerberos cannot prevent someone from physically destroying a server.
Process attack. This is incorrect because with Kerberos cannot prevent an authorized individuals from running processes
QUESTION 14
In discretionary access environments, which of the following entities is authorized to grant information access to other people?
A. Manager
B. Group Leader
C. Security Manager
D. Data Owner
Correct Answer: D Explanation
Explanation/Reference:
In Discretionary Access Control (DAC) environments, the user who creates a file is also considered the owner and has full control over the file including the ability to set permissions for that file.
The following answers are incorrect:
Manager is incorrect because in Discretionary Access Control (DAC) environments it is the owner/user that is authorized to grant information access to other people group leader. Is incorrect because in Discretionary Access Control (DAC) environments it is the owner/user that is authorized to grant information access to other people security manager. Is incorrect because in Discretionary Access Control (DAC) environments it is the owner/user that is authorized to grant information access to other people.
IMPORTANT NOTE:
The term Data Owner is also used within Classifications as well. Under the subject of classification the Data Owner is a person from management who has been entrusted with a data set that belongs to the company. For example it could be the Chief Financial Officer (CFO) who is entrusted with all of the financial data for a company. As such the CFO would determine the classification of the financial data and who can access as well. The Data Owner would then tell the Data Custodian (a technical person) what the classification and need to know is on the specific set of data. The term Data Owner under DAC simply means whoever created the file and as the creator of the file the owner has full access and can grant access to other subjects based on their identity.
QUESTION 15
What is the main concern with single sign-on?
A. Maximum unauthorized access would be possible if a password is disclosed.
B. The security administrator’s workload would increase.
C. The users’ password would be too hard to remember.
D. User access rights would be increased.
Correct Answer: A Explanation
Explanation/Reference:
A major concern with Single Sign-On (SSO) is that if a user’s ID and password are compromised, the intruder would have access to all the systems that the user was authorized for.
The following answers are incorrect:
The security administrator’s workload would increase. Is incorrect because the security administrator’s workload would decrease and not increase. The admin would not be responsible for maintaining multiple user accounts just the one.
The users’ password would be too hard to remember. Is incorrect because the users would have less passwords to remember.
User access rights would be increased. Is incorrect because the user access rights would not be any different than if they had to log into systems manually.
QUESTION 16
Who developed one of the first mathematical models of a multilevel-security computer system?
A. Diffie and Hellman.
B. Clark and Wilson.
C. Bell and LaPadula.
D. Gasser and Lipner.
Correct Answer: C Explanation
Explanation/Reference:
In 1973 Bell and LaPadula created the first mathematical model of a multi-level security system.
The following answers are incorrect: Diffie and Hellman. This is incorrect because Diffie and Hellman was involved with cryptography. Clark and Wilson. This is incorrect because Bell and LaPadula was the first model. The Clark- Wilson model came later, 1987 Gasser and Lipner. This is incorrect, it is a distractor. Bell and LaPadula was the first model
QUESTION 17
Which of the following attacks could capture network user passwords?
A. Data diddling
B. Sniffing
C. IP Spoofing
D. Smurfing
Correct Answer: B Explanation
Explanation/Reference:
A network sniffer captures a copy every packet that traverses the network segment the sniffer is connect
to.
Sniffers are typically devices that can collect information from a communication medium, such as a
network. These devices can range from specialized equipment to basic workstations with customized
software.
A sniffer can collect information about most, if not all, attributes of the communication. The most common
method of sniffing is to plug a sniffer into an existing network device like a hub or switch. A hub (which is
designed to relay all traffic passing through it to all of its ports) will automatically begin sending all the
traffic on that network segment to the sniffing device. On the other hand, a switch (which is designed to
limit what traffic gets sent to which port) will have to be specially configured to send all traffic to the port
where the sniffer is plugged in.
Another method for sniffing is to use a network tap–a device that literally splits a network transmission into
two identical streams; one going to the original network destination and the other going to the sniffing
device. Each of these methods has its advantages and disadvantages, including cost, feasibility, and the
desire to maintain the secrecy of the sniffing activity.
The packets captured by sniffer are decoded and then displayed by the sniffer. Therfore, if the username/
password are contained in a packet or packets traversing the segment the sniffer is connected to, it will
capture and display that information (and any other information on that segment it can see).
Of course, if the information is encrypted via a VPN, SSL, TLS, or similar technology, the information is still
captured and displayed, but it is in an unreadable format.
The following answers are incorrect:
Data diddling involves changing data before, as it is enterred into a computer, or after it is extracted.
Spoofing is forging an address and inserting it into a packet to disguise the origin of the communication – or
causing a system to respond to the wrong address. Smurfing would refer to the smurf attack, where an
attacker sends spoofed packets to the broadcast address on a gateway in order to cause a denial of
service. The following reference(s) were/was used to create this question:
CISA Review manual 2014 Page number 321
Official ISC2 Guide to the CISSP 3rd edition Page Number 153
QUESTION 18
Which of the following would constitute the best example of a password to use for access to a system by a network administrator?
A. holiday
B. Christmas12
C. Jenny
D. GyN19Za!
Correct Answer: D Explanation
Explanation/Reference:
GyN19Za! would be the best answer because it contains a mixture of upper and lower case characters, alphabetic and numeric characters, and a special character making it less vulnerable to password attacks.
All of the other answers are incorrect because they are vulnerable to brute force or dictionary attacks.
Passwords should not be common words or names. The addition of a number to the end of a common
word only marginally strengthens it because a common password attack would also check combinations of
words:
Christmas23
Christmas123 etc…
QUESTION 19
What physical characteristic does a retinal scan biometric device measure?
A. The amount of light reaching the retina
B. The amount of light reflected by the retina
C. The pattern of light receptors at the back of the eye
D. The pattern of blood vessels at the back of the eye
Correct Answer: D Explanation
Explanation/Reference:
The retina, a thin nerve (1/50th of an inch) on the back of the eye, is the part of the eye which senses light
and transmits impulses through the optic nerve to the brain – the equivalent of film in a camera. Blood
vessels used for biometric identification are located along the neural retina, the outermost of retina’s four
cell layers.
The following answers are incorrect:
The amount of light reaching the retina
The amount of light reaching the retina is not used in the biometric scan of the retina.
The amount of light reflected by the retina
The amount of light reflected by the retina is not used in the biometric scan of the retina.
The pattern of light receptors at the back of the eye
This is a distractor
The following reference(s) were/was used to create this question:
Reference: Retina Scan Technology.
ISC2 Official Guide to the CBK, 2007 (Page 161)
QUESTION 20
The Computer Security Policy Model the Orange Book is based on is which of the following?
A. Bell-LaPadula
B. Data Encryption Standard
C. Kerberos
D. Tempest
Correct Answer: A Explanation
Explanation/Reference:
The Computer Security Policy Model Orange Book is based is the Bell-LaPadula Model. Orange Book
Glossary.
The Data Encryption Standard (DES) is a cryptographic algorithm. National Information Security Glossary.
TEMPEST is related to limiting the electromagnetic emanations from electronic equipment. Reference:
U.S. Department of Defense, Trusted Computer System Evaluation Criteria (Orange Book), DOD 520028-STD. December 1985 (also available here).
QUESTION 21
The end result of implementing the principle of least privilege means which of the following?
A. Users would get access to only the info for which they have a need to know
B. Users can access all systems.
C. Users get new privileges added when they change positions.
D. Authorization creep.
Correct Answer: A Explanation
Explanation/Reference:
The principle of least privilege refers to allowing users to have only the access they need and not anything more. Thus, certain users may have no need to access any of the files on specific systems.
The following answers are incorrect:
Users can access all systems. Although the principle of least privilege limits what access and systems users have authorization to, not all users would have a need to know to access all of the systems. The best answer is still Users would get access to only the info for which they have a need to know as some of the users may not have a need to access a system.
Users get new privileges when they change positions. Although true that a user may indeed require new privileges, this is not a given fact and in actuality a user may require less privileges for a new position. The principle of least privilege would require that the rights required for the position be closely evaluated and where possible rights revoked.
Authorization creep. Authorization creep occurs when users are given additional rights with new positions and responsibilities. The principle of least privilege should actually prevent authorization creep.
The following reference(s) were/was used to create this question:
ISC2 OIG 2007 p.101,123
Shon Harris AIO v3 p148, 902-903
QUESTION 22
Which of the following is the most reliable authentication method for remote access?
A. Variable callback system
B. Synchronous token
C. Fixed callback system
D. Combination of callback and caller ID
Correct Answer: B Explanation
Explanation/Reference:
A Synchronous token generates a one-time password that is only valid for a short period of time. Once the
password is used it is no longer valid, and it expires if not entered in the acceptable time frame.
The following answers are incorrect:
Variable callback system. Although variable callback systems are more flexible than fixed callback
systems, the system assumes the identity of the individual unless two-factor authentication is also
implemented. By itself, this method might allow an attacker access as a trusted user.
Fixed callback system. Authentication provides assurance that someone or something is who or what he/it
is supposed to be. Callback systems authenticate a person, but anyone can pretend to be that person.
They are tied to a specific place and phone number, which can be spoofed by implementing call-
forwarding.
Combination of callback and Caller ID. The caller ID and callback functionality provides greater confidence
and auditability of the caller’s identity. By disconnecting and calling back only authorized phone numbers,
the system has a greater confidence in the location of the call. However, unless combined with strong
authentication, any individual at the location could obtain access.
The following reference(s) were/was used to create this question:
Shon Harris AIO v3 p. 140, 548 ISC2 OIG 2007 p. 152-153, 126-127
QUESTION 23
Which of the following is true of two-factor authentication?
A. It uses the RSA public-key signature based on integers with large prime factors.
B. It requires two measurements of hand geometry.
C. It does not use single sign-on technology.
D. It relies on two independent proofs of identity. Correct Answer: D
Explanation Explanation/Reference:
It relies on two independent proofs of identity. Two-factor authentication refers to using two independent proofs of identity, such as something the user has (e.g. a token card) and something the user knows (a password). Two-factor authentication may be used with single sign-on. The following answers are incorrect: It requires two measurements of hand geometry. Measuring hand geometry twice does not yield two independent proofs.
It uses the RSA public-key signature based on integers with large prime factors. RSA encryption uses integers with exactly two prime factors, but the term “two-factor authentication” is not used in that context.
It does not use single sign-on technology. This is a detractor.
The following reference(s) were/was used to create this question: Shon Harris AIO v.3 p.129
ISC2 OIG, 2007 p. 126
QUESTION 24
The primary service provided by Kerberos is which of the following?
A. non-repudiation
B. confidentiality
C. authentication
D. authorization Correct Answer: C
Explanation Explanation/Reference:
non-repudiation. Since Kerberos deals primarily with symmetric cryptography, it does not help with non-repudiation.
confidentiality. Once the client is authenticated by Kerberos and obtains its session key and ticket, it may use them to assure confidentiality of its communication with a server; however, that is not a Kerberos service as such.
authorization. Although Kerberos tickets may include some authorization information, the meaning of the authorization fields is not standardized in the Kerberos specifications, and authorization is not a primary Kerberos service.
The following reference(s) were/was used to create this question:
ISC2 OIG,2007 p. 179-184
Shon Harris AIO v.3 152-155
QUESTION 25
There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI). When we compare them side by side, Kerberos tickets correspond most closely to which of the following?
A. public keys
B. private keys
C. public-key certificates
D. private-key certificates
Correct Answer: C Explanation
Explanation/Reference:
A Kerberos ticket is issued by a trusted third party. It is an encrypted data structure that includes the service encryption key. In that sense it is similar to a public-key certificate. However, the ticket is not the key.
The following answers are incorrect:
public keys. Kerberos tickets are not shared out publicly, so they are not like a PKI public key.
private keys. Although a Kerberos ticket is not shared publicly, it is not a private key. Private keys are associated with Asymmetric crypto system which is not used by Kerberos. Kerberos uses only the Symmetric crypto system.
private key certificates. This is a detractor. There is no such thing as a private key certificate.
Flydumps.com takes in the latest ISC CISSP questions in the ISC CISSP exam materials so that our material should be always the latest and the most relevant. We know that ISC CISSP examination wouldn’t repeat the same set of questions all the time. Microsoft certification examinations are stringent and focus is often kept on updated technology trends. The ISC https://www.leads4pass.com/cissp.html exam questions organized by the professionals will help to condition your mind to promptly grasp what you could be facing in the ISC CISSP cert examination.