Free ISC2-CC flashcards

Which CIA triad property stops information being disclosed to people or systems that lack authorisation to see it?

Confidentiality. It restricts who can view data, so its whole purpose is to keep information from being disclosed to parties that lack authorisation. This is what distinguishes it from integrity (accuracy) and availability (access).

Is preventing unauthorised parties from disclosing information the job of integrity?

No. Unauthorised change is a real concern, but integrity is about accuracy and preventing alteration, not about preventing disclosure. Restricting who may see data is confidentiality.

Which OSI layer lets a packet reach a host on a different subnet, and why?

The network layer (Layer 3). Routing between subnets needs logical addresses that are independent of hardware, which Layer 3 supplies through IP addressing and forwarding decisions, while lower layers only move data within one segment.

The data link layer (Layer 2) does addressing, so it can move data between separate networks.

Layer 2 does address, but only with hardware MAC addresses that move frames within a single local segment. It cannot forward between separate networks, which requires Layer 3 logical addressing.

What two defining traits identify discretionary access control (DAC)?

The object owner assigns permissions at their discretion, and a subject holding access may pass it onward to others. That owner-set-and-delegate behaviour is why uncontrolled propagation is a known DAC weakness.

An owner deciding who reads a file, with users able to pass access on, describes mandatory access control.

Tempting because MAC also governs who may read a resource, but MAC forbids owners and users from granting access. The described ability of an owner to decide and of a user to pass access on contradicts MAC entirely.

What is the essential difference in key structure between symmetric and asymmetric cryptography?

Symmetric algorithms use one identical secret key at both ends for encryption and decryption. Asymmetric algorithms use a mathematically linked pair: a public key encrypts and the matching private key decrypts, which also underpins digital signatures.

Symmetric cryptography uses a public and private key pair, while asymmetric uses a single shared secret key.

This uses the right vocabulary but reverses the two definitions. Symmetric uses the single shared key; asymmetric uses the public and private pair, so each model is described incorrectly.