CSLB General Building (B) — All Questions

Which type of encryption uses the same key to encrypt and decrypt data?

• a.Asymmetric
• b.Hashing
• c.Symmetric✓
• d.Steganographic

Symmetric encryption uses a single shared secret key for both encryption and decryption, such as AES. It is fast and suited to bulk data. The main challenge is securely distributing the shared key.

Which cryptographic method uses a public and private key pair?

• a.Asymmetric encryption✓
• b.Symmetric encryption
• c.Hashing
• d.Salting

Asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, or the reverse for signatures. It solves the key distribution problem of symmetric systems. RSA and elliptic curve are common examples.

Which one-way function produces a fixed-length value that cannot be reversed to the original input?

• a.Symmetric cipher
• b.Hashing✓
• c.Tokenization
• d.Steganography

Hashing transforms input into a fixed-length digest that cannot be feasibly reversed. It verifies integrity because any change to the input changes the hash. SHA-256 is a widely used secure hashing algorithm.

Adding a unique random value to each password before hashing to defeat precomputed attacks is called:

• a.Peppering
• b.Stretching
• c.Encoding
• d.Salting✓

Salting prepends or appends a unique random value to each password before hashing. This ensures identical passwords produce different hashes and defeats rainbow tables. Each salt must be unique and stored alongside the hash.

Which entity in a PKI issues and signs digital certificates?

• a.Certificate authority✓
• b.Registration authority
• c.Key escrow agent
• d.Certificate holder

A certificate authority (CA) issues, signs, and vouches for digital certificates, binding a public key to an identity. Trust in the CA underpins the entire PKI. A compromised CA can undermine trust for all certificates it issued.

Which mechanism lets a client quickly check whether a single certificate has been revoked?

• a.Certificate signing request
• b.Online Certificate Status Protocol✓
• c.Key stretching
• d.Certificate pinning

The Online Certificate Status Protocol (OCSP) queries a responder in real time to check a certificate's revocation status. It is faster and more current than downloading a full certificate revocation list. OCSP stapling improves performance and privacy.

What does a digital signature primarily provide?

• a.Confidentiality only
• b.Availability
• c.Integrity and non-repudiation✓
• d.Faster encryption

A digital signature proves the message came from the holder of the private key and was not altered, giving integrity, authentication, and non-repudiation. It does not by itself keep the content secret. It is created by encrypting a hash with the signer's private key.

Which authentication factor category does a fingerprint belong to?

• a.Something you know
• b.Something you have
• c.Somewhere you are
• d.Something you are✓

A fingerprint is a biometric, which is the 'something you are' factor based on physical characteristics. Combining it with a different factor, such as a password, creates multifactor authentication. Biometrics resist sharing but raise privacy and revocation concerns.

Requiring a password plus a one-time code from a phone app is an example of:

• a.Multifactor authentication✓
• b.Single sign-on
• c.Federation
• d.Role-based access

Multifactor authentication combines two or more independent factor categories, here something you know and something you have. This greatly reduces the risk from a stolen password alone. An attacker would need to defeat both factors.

Which access control model grants permissions based on a user's assigned job function?

• a.Discretionary access control
• b.Role-based access control✓
• c.Mandatory access control
• d.Rule-based access control

Role-based access control (RBAC) assigns permissions to roles, and users inherit access by being placed in a role. It simplifies administration and enforces consistency. Changing a role updates access for everyone assigned to it.

Which model uses security labels and clearances, common in government, where the system enforces access centrally?

• a.Discretionary access control
• b.Role-based access control
• c.Mandatory access control✓
• d.Attribute-based access control

Mandatory access control (MAC) enforces access based on classification labels and clearances set by a central authority. Users cannot change permissions on resources they own. It is used where strict, non-discretionary control is required.

Which secure protocol replaces Telnet for encrypted remote command-line access?

• a.FTP
• b.HTTP
• c.SNMPv1
• d.SSH✓

Secure Shell (SSH) provides encrypted remote administration, replacing the plaintext Telnet protocol. It protects credentials and session data in transit. SSH also underpins secure file transfer and tunneling.

Which protocol secures web traffic by encrypting HTTP with TLS?

• a.HTTPS✓
• b.SFTP
• c.LDAP
• d.SMTP

HTTPS layers HTTP over TLS to encrypt web traffic, protecting confidentiality and integrity between browser and server. It also authenticates the server through its certificate. Modern sites should use TLS 1.2 or 1.3 with strong ciphers.

Which protocol provides secure file transfer by running over an SSH connection?

• a.FTPS
• b.SFTP✓
• c.TFTP
• d.HTTP

SFTP transfers files over an SSH channel, encrypting both credentials and data. It differs from FTPS, which is FTP secured with TLS. SFTP uses a single connection, simplifying firewall configuration.

Which technology creates an encrypted tunnel for remote users to access a private network over the internet?

• a.DMZ
• b.Proxy
• c.VPN✓
• d.NAT

A virtual private network (VPN) establishes an encrypted tunnel over an untrusted network, protecting traffic between the remote user and the corporate network. It preserves confidentiality and integrity in transit. IPsec and TLS are common VPN foundations.

Which single sign-on standard is widely used to exchange authentication data between identity providers and web applications?

• a.RADIUS
• b.TACACS+
• c.Kerberos
• d.SAML✓

Security Assertion Markup Language (SAML) exchanges authentication and authorization assertions between an identity provider and service providers, enabling web single sign-on. The identity provider vouches for the user so each application does not manage passwords. It is common in enterprise federation.

Replacing sensitive data such as a credit card number with a non-sensitive substitute value is called:

• a.Tokenization✓
• b.Hashing
• c.Salting
• d.Compression

Tokenization swaps sensitive data for a meaningless token, keeping the real value in a secure vault. The token has no exploitable value if stolen. It is widely used to reduce the scope of payment card data handling.

A dedicated hardware device that securely generates and stores cryptographic keys is a:

• a.TPM
• b.Hardware security module✓
• c.Smart card
• d.Proximity token

A hardware security module (HSM) is a tamper-resistant device that generates, stores, and manages cryptographic keys and performs crypto operations. It keeps keys isolated from general-purpose systems. HSMs are common in PKI and high-assurance environments.

Which chip on a motherboard stores keys and supports features like full-disk encryption and secure boot?

• a.HSM
• b.Smart card
• c.Trusted Platform Module✓
• d.CPU cache

The Trusted Platform Module (TPM) is a chip integrated into a device that securely stores keys and measurements for boot integrity and disk encryption. It binds encryption to specific hardware. It underpins features like BitLocker and secure boot.

Which property ensures a sender cannot later deny having sent a signed message?

• a.Confidentiality
• b.Availability
• c.Anonymity
• d.Non-repudiation✓

Non-repudiation prevents a party from convincingly denying an action, such as sending a digitally signed message. It relies on the private key being unique to the signer. Digital signatures and reliable logs provide non-repudiation.