D340 Cyber Defense and Countermeasures - Set 5 - Part 1

Correct Answer: Rendering data unreadable to anyone without the correct key

Encryption protects confidentiality by making data unintelligible without the key, limiting the value of data an attacker manages to obtain.

Correct Answer: An attacker with access to keys or a running system can still read data

Encrypted data must be decrypted to be used, so attackers who compromise keys, credentials, or a running system can access plaintext regardless of encryption.

Correct Answer: Generating, distributing, storing, rotating, and retiring cryptographic keys securely

Key management covers the full key lifecycle. Weak key management undermines even strong algorithms, making it the most common cryptographic failure point.

Correct Answer: Anyone with access to the code or binary can extract the key

Keys embedded in source or binaries are recoverable through code repositories, decompilation, or artifact inspection, and cannot be rotated without redeployment.

Correct Answer: A tamper-resistant device that generates and protects cryptographic keys

An HSM performs cryptographic operations inside tamper-resistant hardware so private keys never exist in plaintext outside the device.

Correct Answer: Periodically replacing keys to limit exposure from undetected compromise

Rotating keys limits how much data a single compromised key exposes and bounds the window in which an undetected key compromise remains useful.

Correct Answer: Session keys that remain secure even if the long-term private key is later compromised

Forward secrecy uses ephemeral keys per session, so compromise of the long-term key cannot decrypt previously recorded sessions.

Correct Answer: Practical collision attacks undermine their integrity guarantees

Demonstrated collision attacks mean these algorithms can no longer guarantee that different inputs produce different digests, breaking integrity assurances.

Correct Answer: The ability to change cryptographic algorithms without redesigning the system

Crypto-agility allows algorithms to be replaced as they weaken or as standards evolve, avoiding costly redesign when a primitive must be retired.

Correct Answer: Sufficiently capable quantum computers could break widely used public key algorithms

Shor's algorithm on a sufficiently capable quantum computer would break RSA and elliptic curve cryptography, motivating migration to post-quantum algorithms.

Correct Answer: Adversaries recording encrypted data today to decrypt once quantum capability exists

Data with long confidentiality requirements is at risk because adversaries can store intercepted ciphertext now and decrypt it when capability arrives.

Correct Answer: Ensuring the right identities have appropriate access to the right resources

IAM governs the identity lifecycle and access decisions, covering provisioning, authentication, authorization, review, and deprovisioning.

Correct Answer: Authenticating once to gain access to multiple applications

SSO lets users authenticate once with a central identity provider and access multiple applications, improving usability and centralizing authentication control.

Correct Answer: Centralized convenience and control, but a compromised account reaches many systems

SSO centralizes authentication for consistent policy and monitoring, but a compromised SSO account grants broad access, making strong MFA on it essential.

Correct Answer: Trusting identity assertions issued by another organization's identity provider

Federation allows one organization to accept authentication assertions from another's identity provider, enabling access without duplicating credentials.

Correct Answer: Access decisions based on attributes of user, resource, and context

ABAC evaluates attributes such as role, department, device posture, location, and time, enabling fine-grained context-aware policy beyond static roles.

Correct Answer: Granting access only when defined risk and context conditions are satisfied

Conditional access evaluates signals such as device compliance, location, and risk score at each request, requiring additional verification or blocking when risk is elevated.

Correct Answer: Ongoing verification of identity throughout a session rather than only at login

Continuous authentication monitors behavioral and contextual signals during a session, detecting session hijacking or account misuse after initial login.

Correct Answer: Limiting exposure from unattended or hijacked sessions

Automatic timeout ends idle sessions, limiting the window in which an unattended device or stolen session token can be misused.

Correct Answer: Establishing accountability, direction, and oversight for security activities

Governance sets strategy, assigns accountability, allocates resources, and provides oversight, ensuring security aligns with organizational objectives and risk appetite.