Symmetric encryption algorithms are known to be fast but present great challenges on the key
management side. Asymmetric encryption algorithms are slow but allow communication with a
remote host without having to transfer a key out of band or in person. If we combine the strength
of both crypto systems where we use the symmetric algorithm to encrypt the bulk of the data and
then use the asymmetric encryption system to encrypt the symmetric key, what would this type of
usage be known as?

Steven the hacker realizes that the network administrator of XYZ is using syskey to protect
organization resources in the Windows 2000 Server. Syskey independently encrypts the hashes
so that physical access to the server, tapes, or ERDs is only first step to cracking the passwords.
Steven must break through the encryption used by syskey before he can attempt to brute force
dictionary attacks on the hashes. Steven runs a program called “SysCracker” targeting the
Windows 2000 Server machine in attempting to crack the hash used by Syskey. He needs to
configure the encryption level before he can launch attach.

How many bits does Syskey use for encryption?

In the context of using PKI, when Sven wishes to send a secret message to Bob, he looks up
Bob’s public key in a directory, uses it to encrypt the message before sending it off. Bob then uses
his private key to decrypt the message and reads it. No one listening on can decrypt the message.
Anyone can send an encrypted message to Bob but only Bob can read it. Thus, although many
people may know Bob’s public key and use it to verify Bob’s signature, they cannot discover Bob’s
private key and use it to forge digital signatures.
What does this principle refer to?

What is SYSKEY # of bits used for encryption?

Which of the following is NOT true of cryptography?

Which of the following best describes session key creation in SSL?

How many bits encryption does SHA-1 use?

There is some dispute between two network administrators at your company. Your boss asks you
to come and meet with the administrators to set the record straight. Which of these are true about
PKI and encryption?
Select the best answers.

A client has approached you with a penetration test requirements. They are concerned with the
possibility of external threat, and have invested considerable resources in protecting their Internet
exposure. However, their main concern is the possibility of an employee elevating his/her
privileges and gaining access to information outside of their respective department.
What kind of penetration test would you recommend that would best address the client’s concern?

In which of the following should be performed first in any penetration test?