Security+ quiz 2: cryptography and identity

A hash proves data has not changed but does not hide it. Encryption provides confidentiality. Try the free hash tool on FM TecHub.

AES uses the same key to encrypt and decrypt. RSA and ECC are asymmetric; Diffie-Hellman is a key-exchange method.

Encrypt with Bob's public key; only Bob's private key can decrypt it. Signing uses the sender's private key.

A signature is a hash encrypted with the sender's private key. Anyone with the public key can check who signed it and that it was not changed.

A CA verifies identity and signs certificates. Browsers trust certificates that chain back to a trusted root CA.

A unique salt per password defeats precomputed rainbow tables. Key stretching (bcrypt, Argon2, PBKDF2) slows down guessing.

Something you know (password) plus something you have (the phone app) are two different factors.

FIDO2 keys and passkeys check the website's real domain, so they will not work on a fake site. SMS and email codes can be phished.

Role-based access control grants permissions to roles, and users get the roles for their job. ABAC uses attributes; MAC uses labels; DAC lets owners decide.

Single sign-on uses one authentication (often via SAML or OpenID Connect) across many applications.

SHA-256 produces a fixed-length digest. AES is symmetric encryption, RSA asymmetric and Diffie-Hellman a key exchange.

Diffie-Hellman lets two parties derive a shared key without sending it across the network.

PKCS#12 files (.pfx or .p12) bundle a certificate and private key. A .csr is a certificate signing request.

OCSP (Online Certificate Status Protocol) asks the CA about one certificate. CRLs are downloadable lists.

Slow, salted password hashing makes stolen hashes much harder to crack. Encryption can be reversed if the key leaks.

SAML exchanges XML assertions between an identity provider and service providers for single sign-on.

OAuth grants limited access tokens to apps. OpenID Connect adds authentication on top of it.

Discretionary access control (DAC) leaves permissions to the owner, as in normal file sharing.

Just-in-time access, often through a PAM tool, reduces standing admin rights.

With PFS each session uses temporary keys, so stealing the server key later does not decrypt recorded past traffic.