Security Concepts GFACT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software vendor publishes a firmware update for a network appliance. The vendor provides a SHA-256 hash of the update file on its website. Before applying the update, a technician downloads the file and computes its SHA-256 hash. The computed hash matches the published hash. What does this verify?

   • AThe file is encrypted and cannot be read by unauthorized parties.
   • BThe file has been scanned for malware and contains no malicious code.
   • CThe file is exactly the same as the one the vendor hashed and was not corrupted or altered during download.
   • DThe file was definitely created by the vendor and is safe to install.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A developer is implementing a feature that allows users to upload files. The developer wants to ensure that the files have not been tampered with during upload. Which cryptographic technique should be used?

   • AUse a digital signature with the server's private key.
   • BEncrypt the file with a symmetric key.
   • CCompute a hash of the file on the client and server and compare them.
   • DUse a simple checksum like CRC32.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A software company distributes a signed update file. A user verifies the digital signature using the company's public key and confirms that the signature is valid. What can the user conclude?

   • AThe file was created by the company and has not been modified since it was signed.
   • BThe file is encrypted and cannot be read by unauthorized parties.
   • CThe file was hashed with a strong algorithm.
   • DThe file is free of malware and safe to install.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's security policy requires that employees use multi-factor authentication (MFA) to access the corporate VPN. An employee's account credentials are stolen in a phishing attack. The attacker attempts to use the stolen credentials to connect to the VPN but fails because the employee's phone is required for the second factor. Which defensive concept is primarily demonstrated by this outcome?

   • ADefense in depth
   • BLeast privilege
   • CAccess control
   • DEncryption
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is reviewing the encryption methods used for different purposes in the organization. They need to select a method to encrypt a large database backup file for storage. Which method is most appropriate for this task?

   • ADigital signature of the backup file
   • BAsymmetric encryption with the recipient's public key
   • CHashing the backup file
   • DSymmetric encryption with a strong key
   Reveal Solution Discussion Select an answer first