CISSP Practice

42. In the electronic authentication process, which of the following is strongly resistant to man-in-the-middle (MitM) attacks?

a. Encrypted key exchange (EKE)

b. Simple password exponential key exchange (SPEKE)

c. Secure remote password protocol (SRP)

d. Client authenticated transport layer security (TLS)

42. d. A protocol is said to be highly resistant to man-in-the-middle (MitM) attacks if it does not enable the claimant to reveal, to an attacker masquerading as the verifier, information (e.g., token secrets and authenticators) that can be used by the latter to masquerade as the true claimant to the real verifier. For example, in client authenticated transport layer security (TLS), the browser and the Web server authenticate one another using public key infrastructure (PKI) credentials, thus strongly resistant to MitM attacks. The other three choices are incorrect, because they are examples of being weakly resistant to MitM attacks and are examples of zero-knowledge password protocol where the claimant is authenticated to a verifier without disclosing the token secret.

43. In electronic authentication, which of the following controls is effective against cross site scripting (XSS) vulnerabilities?

a. Sanitize inputs to make them nonexecutable.

b. Insert random data into any linked uniform resource locator.

c. Insert random data into a hidden field.

d. Use a per-session shared secret.

43. a. In a cross site scripting (XSS) vulnerability, an attacker may use an extensible markup language (XML) injection to perform the equivalent of an XSS, in which requesters of a valid Web service have their requests transparently rerouted to an attacker-controlled Web service that performs malicious operations. To prevent XSS vulnerabilities, the relying party should sanitize inputs from claimants or subscribers to ensure they are not executable, or at the very least not malicious, before displaying them as content to the subscriber’s browser. The other three choices are incorrect because they are not applicable to the situation here.

44. In electronic authentication, which of the following controls is not effective against a cross site request forgery (CSRF) attack?

a. Sanitize inputs to make them nonexecutable.

b. Insert random data into any linked uniform resource locator.

c. Insert random data into a hidden field.

d. Generate a per-session shared secret.

44. a. A cross site request forgery (CSRF) is a type of session hijacking attack where a malicious website contains a link to the URL of the legitimate relying party. Web applications, even those protected by secure sockets layer/transport layer security (SSL/TLS), can still be vulnerable to the CSRF attack. One control to protect the CSRF attack is by inserting random data, supplied by the relying party, into any linked uniform resource locator with side effects and into a hidden field within any form on the relying party’s website. Generating a per-session shared secret is effective against a session hijacking problem. Sanitizing inputs to make them nonexecutable is effective against cross site scripting (XSS) attacks, not CSRF attacks.

45. In electronic authentication, which of the following can mitigate the threat of assertion manufacture and/or modification?

a. Digital signature and TLS/SSL

b. Timestamp and short lifetime of validity

c. Digital signature with a key supporting nonrepudiation

d. HTTP and TLS

45. a. An assertion is a statement from a verifier to a relying party that contains identity information about a subscriber. To mitigate the threat of assertion manufacture and/or modification, the assertion may be digitally signed by the verifier and the assertion sent over a protected channel such as TLS/SSL. The other three choices are incorrect because they are not applicable to the situation here.

46. In electronic authentication, which of the following can mitigate the threat of assertion reuse?

a. Digital signature and TLS/SSL

b. Timestamp and short lifetime of validity

c. Digital signature with a key supporting nonrepudiation

d. HTTP and TLS