IT Cybersecurity Principles & Protocols 5 — Questions and Answers
Question 1: Which authentication protocol uses a Key Distribution Center to issue time-stamped tickets in Windows domains?
- NTLM
- Kerberos (Correct answer)
- RADIUS
- LDAP
Correct answer: Kerberos
Kerberos uses a KDC to issue ticket-granting tickets and service tickets, and it relies on synchronized clocks.
Question 2: Why might an administrator choose TACACS+ over RADIUS for managing network device logins?
- TACACS+ uses UDP for faster performance
- TACACS+ combines authentication and authorization into one step
- TACACS+ encrypts the entire packet body and separates AAA functions (Correct answer)
- TACACS+ is an open standard while RADIUS is proprietary
Correct answer: TACACS+ encrypts the entire packet body and separates AAA functions
TACACS+ runs over TCP 49, encrypts the whole payload, and handles authentication, authorization, and accounting separately.
Question 3: In IEEE 802.1X port-based authentication, what role does a network switch play?
- Authenticator (Correct answer)
- Supplicant
- Authentication server
- Certificate authority
Correct answer: Authenticator
The switch acts as the authenticator, relaying credentials between the supplicant and the RADIUS authentication server.
Question 4: WPA3-Personal replaces the WPA2 pre-shared key handshake with which method to resist offline dictionary attacks?
- TKIP
- WEP
- EAP-TLS
- SAE (Correct answer)
Correct answer: SAE
Simultaneous Authentication of Equals (SAE) protects against offline password guessing even if the handshake is captured.
Question 5: Which login method qualifies as true multifactor authentication?
- A password and a security question
- A password and a hardware token code (Correct answer)
- A PIN and a password
- Two different passwords
Correct answer: A password and a hardware token code
MFA requires factors from different categories, here something you know plus something you have.
Question 6: An attacker captures a valid authentication message and resends it later to gain access. Which control best prevents this?
- Longer passwords
- Disk encryption
- Timestamps or nonces in the authentication exchange (Correct answer)
- Disabling unused ports
Correct answer: Timestamps or nonces in the authentication exchange
Timestamps and one-time nonces make captured messages invalid when they are replayed.
Question 7: Which mechanism provides non-repudiation, so a sender cannot later deny sending a message?
- Digital signatures (Correct answer)
- Symmetric encryption
- Hashing alone
- Access control lists
Correct answer: Digital signatures
A digital signature ties a message to the sender's private key, which proves origin.
