Unit 6: Network Security - Practice Quiz

1 What is a main characteristic of security implemented at the application layer?

2 Which protocol provides application-layer security for web communication?

3 What does PGP stand for?

4 Which security services are commonly provided by PGP?

5 Which type of cryptography does PGP use to encrypt a session key for the recipient?

6 Transport-layer security mainly protects communication between which entities?

7 Which security property prevents transmitted data from being read by unauthorized parties?

8 SSL operates between the application layer and which transport protocol?

9 Which SSL component provides basic protection for higher-level SSL protocols?

10 Which SSL protocol negotiates algorithms and establishes session keys?

11 Which SSL protocol communicates warnings and error conditions?

12 Which SSL protocol signals that newly negotiated security settings will now be used?

13 TLS is the standardized successor to which earlier security protocol?

14 Which protocol commonly uses TLS to secure web browsing?

15 At which layer of the TCP/IP model does IPSec provide security?

16 What are the two operating modes of IPSec?

17 Which IPSec mode encapsulates and protects the entire original IP packet?

18 Which security service is provided by the IPSec Authentication Header?

19 Which IPSec protocol primarily provides confidentiality through encryption?

20 What is a Security Association in IPSec?

21 A company needs end-to-end protection for messages even when they pass through several untrusted mail relays. At which layer should the protection primarily be applied?

22 A web application uses TLS but directly inserts untrusted input into database queries. Which threat can still remain?

23 Alice wants Bob to verify that a PGP email came from her and was not modified. Which key should Alice use to create the digital signature?

24 In PGP, why is a randomly generated session key commonly used to encrypt the email body?

25 A client opens two TLS connections to the same server. What does transport-layer security protect separately for each connection?

26 A TLS connection provides confidentiality and integrity, but the client does not validate the server certificate. Which attack becomes more feasible?

27 In SSL architecture, which component fragments application data, optionally compresses it, adds protection, and passes it to TCP?

28 An SSL session is resumed to avoid a full negotiation. Which item is normally associated with the session rather than one individual connection?

29 Which SSL protocol negotiates algorithms, authenticates peers when required, and establishes shared keying material?

30 During an SSL exchange, which protocol sends a one-byte message indicating that subsequent records will use the newly negotiated cipher state?

31 A TLS receiver obtains a protected record with an invalid authentication tag. What should it conclude?

32 Why are sequence numbers incorporated into TLS record authentication?

33 An organization wants security controls to apply transparently to many IP applications without modifying each application. Why is IPSec suitable?

34 A VPN must hide the original internal source and destination addresses while packets cross the public Internet. Which IPSec approach meets this requirement?

35 Two hosts communicate directly using IPSec, and the original IP header must remain visible to routers. Which mode is most appropriate?

36 In IPSec tunnel mode, what is added to route the encapsulated packet between tunnel endpoints?

37 Why does IPSec AH generally fail when a packet passes through conventional NAT?

38 A security policy requires payload confidentiality and source authentication for selected IP traffic. Which IPSec protocol can provide both?

39 An IPSec host receives a protected packet. Which combination is used to identify the inbound Security Association?

40 An IPSec Security Policy Database rule matches outbound payroll traffic and marks it as "PROTECT." What should the system do next?

41 A distributed application digitally signs JSON objects, but intermediaries may reorder object members and alter insignificant whitespace. Which design best preserves verifiability without requiring byte-for-byte preservation during transit?

42 Alice uses PGP to sign and encrypt a message for Bob. Which processing order provides both signature verification over Alice's original message and efficient encryption?

43 A PGP message containing a 50 MB attachment is encrypted for 100 recipients. Which construction avoids encrypting the attachment 100 times?

44 Bob has verified that a PGP public key belongs to Alice, but the key is later revoked because its private component was compromised. Which conclusion about an old message signed by that key is most defensible without a trusted timestamp?

45 A client establishes TLS to a reverse proxy, which decrypts the request and forwards it to an application server over a separate TLS connection. What security property is absent between the client process and the application server process?

46 An SSL client resumes a previously established session by creating a new connection. Which state is expected to be reused, and which state must be newly derived?

47 An attacker modifies a cipher-suite offer in an SSL Handshake message while relaying the connection. Assuming the attacker cannot compute the master secret, which mechanism is designed to expose the transcript modification before application data is accepted?

48 What is the precise role of the SSL Change Cipher Spec protocol during a full handshake?

49 A TLS-over-TCP application treats an ordinary TCP FIN as a valid end of a protected response even though no authenticated close_notify alert was received. Which attack can this mistake enable?

50 In an SSL/TLS record epoch, an attacker captures an authenticated record and inserts the same bytes again later in the same connection. Why will record authentication normally fail even though the copied MAC bytes are unchanged?

51 A TLS 1.2 implementation uses a CBC cipher suite with MAC-then-encrypt. Which operation order correctly describes protection of a record fragment?

52 A payment API permits TLS 1.3 early data and processes POST /transfer immediately. Even when encryption and server authentication are sound, what additional control is required?

53 An organization configures ESP encryption but disables integrity protection. A block cipher mode hides the plaintext but allows controlled ciphertext modification. Which IPSec objective is consequently not assured?

54 Two security gateways protect traffic between private networks, and internal source and destination addresses must be concealed from the public network. Which IPSec arrangement is appropriate?

55 A host uses AH transport mode, and a conventional NAT device changes the packet's source address while forwarding it. Why does the receiver normally reject the packet?

56 For ESP transport mode with integrity enabled, which portion of an IPv4 packet is outside ESP's integrity-protected region?

57 Host A and Host B require bidirectional ESP protection using the same algorithms. What is the minimum number of IPSec security associations required?

58 An inbound IPSec packet arrives with SPI . Which information is normally used with to identify the applicable security association unambiguously?

59 An ESP SA uses a replay window of size . The highest authenticated sequence number is 500, and every number from 437 through 500 has already been received. A packet with sequence number 436 arrives with a valid ICV. What should the receiver do?

60 An inbound ESP packet passes cryptographic verification under an existing SA, but its decrypted traffic selectors do not match any policy permitting that SA to carry the packet. What is the correct policy action?