8/16/22, 8:33 AM Exam #2 https://umsystem.instructure.com/courses/118743/assignments/ XXXXXXXXXX/2 CS 5601 XXXXXXXXXXExam 2 Instructions: Read the question carefully. Some can be interpreted in...

can you give me price


8/16/22, 8:33 AM Exam #2 https://umsystem.instructure.com/courses/118743/assignments/1371393 1/2 CS 5601 Exam 2 Instructions: Read the question carefully. Some can be interpreted in different ways and several can have more than one correct answer. Read through the reading material and slides provided in Canvas as all questions have been taken directly from that material. Since some of these can be answered in different ways, if you find two pieces of reference material that provides a different way of answering, pick one and be sure to include the reference. In other words, something like: , Ref. SP 800-12 Chapter 13, page XX. Use another document and be sure to number your answers CORRECTLY! Submit this to Canvas. This exam is over modules 8 through 12 and reading material assigned during these modules. All questions are 5 points each unless otherwise indicated. 1. What is the one symmetric encryption algorithm that is theoretically unbreakable? What are at least two problems with using this algorithm for all encryption purposes? 2. You’ve recommended to your organization that the building needs external security cameras at all entrances and emergency exits. However, the board is concerned with costs and only wants you to put one external camera per door. As the security person you know this isn’t a good idea. What are some arguments against a single camera per entrance? (feel free to think outside of what we discussed in class) 3. What is the best detection tool for dealing with social engineering and how to do make it work for your organization? 4. What are some of the “human attacks” we see in information security? What controls would help reduce or even mitigate EACH of these attacks? 5. Why are electronic emanations such a security concern in a high security environment? What controls would reduce the risks? 6. Which fire detection device is responsible for more false positives than other fire detection devices? 7. Of all the fire suppression choices, describe the best recommended class of fire suppression to use for a data center which is not occupied by staff? 8. What is the paradox of social engineering attacks? 9. If you are required to use a key escrow through a third party, how can you ensure that the vendor cannot use the private keys without your knowledge? (Think separation of duties). 10. Describe one condition of non-repudiation that can never be proven through digital analysis of the message sent and all logs involved. (taken from a lecture) 11. Why is opening a secure https in a new frame from a non-https frame a poor design practice? 12. What are the security goals of cryptography? 8/16/22, 8:33 AM Exam #2 https://umsystem.instructure.com/courses/118743/assignments/1371393 2/2 13. You have been requested by your organization to establish a new physical access control for the main office complex with multiple entrance and exit doors. One particular executive read an article of the strength of biometrics and is insisting that all external doors be outfitted with only a fingerprint scanner. As the Security Officer, what should you explain to the executive about this proposed security solution? (several answers come to my mind, but one will do) 14. When dealing with a large environment of users and systems needing unique encryption keys each, why would the use of purely symmetric encryption be a problem? 15. Why is not advisable for a programmer to create their own cryptographic algorithm for a product they are developing? 16. What type of Symmetric Ciphers are the fastest and easiest to implement in hardware? 17. Why is a large open space a good physical security feature? 18. Why, when implementing a block cipher, is Electronic Codebook (ECB) using the same key on each block a bad design choice? 19. You are in charge of a design team and have been tasked with generating a cryptographic solution for a larger software project. The requirements for your team are: Must be able to exchange the cryptographic keys on the fly yet keep them secure Must able transfer huge amounts of data in reasonable time so the encryption algorithm speed is important. Must be mobile computing compatible. Clearly PKI is the solution for the first requirement , but several members on your team feel that once each side has exchanged their public keys, using asymmetric algorithms only will be sufficient because CPU’s are plenty fast these days. As the team leader you need to decide if this is acceptable or convince your team that PKI only will fail in meeting the requirements. Please give examples to justify your decisions. 20. You have been asked for design elements of a highly secured data center. Think of all the different types of physical security as well as access controls we have discussed to date. (PHYSICAL, not network security).