Network Security Technology and Application Final Exam Question Bank

1. Multiple choice questions (2 points for each question, 20 points in total)

1. The basic attribute of information security is ____. (D)

A. Confidentiality B. Integrity

C. Availability, controllability, reliability D. A, B, and C are all

2. Assuming an encryption algorithm is used, its encryption method is very simple: add 5 to each letter, that is, a is encrypted into f. The key of this algorithm is 5, so it belongs to _____. (A)

A. Symmetric encryption technology B. Block cipher technology

C. Public key encryption technology D. One-way function encryption technology

3. The purpose of cryptography is to ____. (D)

A. Research data encryption B. Research data decryption

C. Research Data Confidentiality D. Research Information Security

4. Party A has a pair of keys (KA is public, KA is secret), Party B has a pair of keys (KB is public, KB is secret), A sends a digital signature M to party B, and encrypts the information M as: M'= KB public (KA SECRET (M)). The decryption scheme for party B to receive the ciphertext is _. (C)

A. KB public (KA secret (M')) B. KA public (KA public (M'))

C. KA public (KB secret (M')) D. KB secret (KA secret (M'))

5. The reason why the digital signature should be processed in advance with a one-way Hash function is ___. (B)

A. One more encryption process makes the ciphertext more difficult to decipher

B. Improve the calculation speed of ciphertext

C. Reduce the length of signature ciphertext and speed up the operation speed of digital signature and verification signature

D. Ensure that the ciphertext can be correctly restored to plaintext

6. Identity authentication is an important part of security services. The following statement about identity authentication is incorrect ___. (A)

A. Identity authentication is the basis of authorization control

B. Identity authentication generally does not need to provide two-way authentication

C. At present, methods based on symmetric key encryption or public key encryption are generally used

D. Digital signature mechanism is an important mechanism for identity authentication

7. A firewall is used to isolate the Internet from the internal network. (B)

A. It is a hardware facility to prevent Internet fires

B. It is a software and hardware facility for network security and information security

C. It is a software and hardware facility that protects the circuit from damage

D. It is a hardware facility for anti-electromagnetic interference

8. Services supported by PKI do not include _____. (D)

A. Asymmetric key technology and certificate management B. Directory service

C. Generation and distribution of symmetric keys D. Access control services

9. Assuming that the hash function H has 128 possible outputs (that is, the output length is 128 bits), if the probability that at least two of the k random inputs of H produce the same output is greater than 0.5, then k is approximately equal to ___. (B)

A．2128 B．264

C．232 D．2256

10. The starting point of the Bell-LaPadula model is to maintain the ___ of the system, while the Biba model is completely opposite to the Bell-LaPadula model. It corrects the ___ problem of the information ignored by the Bell-LaPadula model. They have common disadvantages: direct binding of subject and object, difficult authorization work. (C)

A．Confidentiality Availability b. Availability Confidentiality

C．confidentiality integrity d. Integrity Confidentiality

2. Fill in the blank questions (2 points for each question, 40 points in total)

1. The threats and attacks faced in information security are various, and these attacks are generally divided into two categories: active attack and passive attack. Among them, the passive attack is divided into leakage of message content and business flow analysis .

2. There are many classifications of cryptographic techniques. According to whether the keys used for encryption and decryption are the same, encryption algorithms can be divided into: symmetric cryptosystem and asymmetric cryptosystem . Among them, symmetric cryptosystem can be divided into two types, according to A sequence cipher that encrypts characters bit by bit and a block cipher that encrypts with a fixed block size .

3. Cryptanalysis is the study of the deciphering of cryptographic systems. According to the data resources obtained by cryptanalysts, cryptanalysis (attack) can be divided into: ciphertext-only attack, known plaintext analysis (attack), chosen plaintext attack, and chosen plaintext attack. Ciphertext Analysis (Attack).

4. The classical cryptography system is of great significance to the research and study of modern cryptography. The two basic methods of realizing the classical cryptography system, substitution and permutation , are still the core methods for constructing modern symmetric block ciphers.

5. DES is the first data encryption standard announced by the National Bureau of Standards. Its packet length is (64) bits and the key length is 56 bits.

6. In 1976, two American cryptographers, Diffe and Hellman, submitted a paper at the American Computer Conference of that year, proposing new ideas of public key cryptosystem, asymmetric cryptosystem, and double-key cryptosystem. Many problems in traditional ciphers present a new way of thinking.

7. The security of the Elgamal algorithm is based on the discrete logarithm problem . Its biggest feature is that a random number is introduced in the encryption process, making the encryption result uncertain , and its ciphertext length is twice the plaintext length. Variants of this algorithm are commonly used for data signing.

8. The security of the cryptographic system depends on the protection of the key by the user. There are many types of keys in practical applications. From the perspective of key management, they can be divided into initial key , session key , key encryption key and master secret. key .

3. Short answer questions (8 points each, 40 points in total)

1. Short answer methods and prevention strategies for detecting "denial of service attack and defense".

A denial of service attack (DDoS) is an attack designed to consume the resources of the target system so that it cannot provide the function of the service. In order to prevent DDoS attacks, the following methods and defense strategies should be adopted:

Enhance the resilience of the infrastructure, such as using technologies such as load balancing and elastic computing to ensure the scalability and resilience of the infrastructure.
Configure and update the filtering rules of network devices, including using ACL (Access Control List) and router filtering to limit unnecessary traffic from entering the network.
Make sure all software and systems are updated to the latest versions to ensure system security.
Find and patch network vulnerabilities to ensure systems are less vulnerable.
Use a Web Application Firewall (WAF) on the front end of the system to detect and filter potentially attacking traffic.
Make sure to monitor the system so that abnormal traffic can be detected in time and countermeasures can be taken quickly.

2. What is the goal of cybersecurity research?

The goal of network security research is to ensure network information security. Network security includes confidentiality, integrity and availability.

Confidentiality: Ensuring that data is not accessed and overwritten or tampered with by unauthorized persons or entities during transmission, storage and processing. For confidential data, encryption techniques must be used.
Integrity: Ensuring that data is not tampered with or destroyed, whether accidentally or maliciously, while in transit, stored and processed. Data integrity measures include hash checksums and digital signatures, among others.
Availability: ensure the reliability and availability of the network and system, and ensure that users can access and use the network and system safely and in a timely manner.

The goal of network security research is to prevent losses and risks due to network security problems. Cyber attacks and data leaks can lead to major security issues, such as stealing sensitive information, paralyzing business systems, etc., resulting in huge economic losses, political risks, and social instability. Therefore, the main goal of network security research is to ensure the security of information, prevent and control possible network security threats, and ensure the safe, stable and efficient operation of networks and systems through technical means.

3. Clarify the steps and principles of Trojan horse attack.

1) The basic process of using Trojan horse tools for network intrusion can be divided into 6 steps.

(1) Configure the Trojan

(2) Spread Trojan horse

(3) Running the Trojan

(4) Disclosure of information. Collect some software and hardware information of the server, and inform the control user through E-mail or ICQ.

(5) Establish a connection. The Trojan horse program is installed on the server, and both the control terminal and the server must be online. The control end can establish a connection with the server end through the Trojan horse port.

(6) Remote control. The server is remotely controlled through a Trojan horse program. The control rights that the control port can enjoy: Stealing passwords, file operations, modifying the registry and system operations.

2) Trojan horse attack principle

A Trojan horse refers to a section of malicious code with special functions hidden in a normal program. It is a backdoor program with special functions such as destroying and deleting files, sending passwords, recording keyboards, and attacking Dos. A complete Trojan horse system consists of hardware, software and specific connection parts.

4. Describe the security policy of access control.

1. Security Policy Based on Identity Rules

The basis for establishing identity-based security policies and rule-based security policies is authorization behavior.

(1) The identity-based security policy is to filter access to data or resources, and only those subjects who can pass the authentication can use the resources of the object normally. Identity-based security policies include individual-based policies and group-based policies. There are two basic implementation methods, which are capability tables and access control tables.

(2) Individual-based strategies. The individual-based policy refers to a policy established centering on the user and consists of some lists. These lists limit which users can implement the operation behavior of which security policy for specific objects.

Group-based policies. Group-based policy is an extension of individual-based policy, which means that some users are allowed to use the same access control rules to access the same object.

(3) Rule-based security policy. Authorization in rule-based security policies often relies on sensitivity. In a secure system, data or resources should be labeled with security tags. Processes that act on behalf of a user can get security tokens corresponding to their originators. In terms of implementation, the system judges whether to allow the user to access by comparing the user's security level with the security level of the object resource.

2. Comprehensive access control strategy

The goal of access control technology is to prevent unauthorized access to any resource. The access control strategy from the application aspect includes the following aspects.

(1) Network access control

(2) Network authority control

(3) Directory-level security controls

(4) Attribute security control

(5) Network server security control

(6) Network monitoring and lock control

(7) Security control of network ports and nodes

(8) Firewall control

5. Complete the penetration testing project:

5.1 Obtain the shell of the server by exploiting website vulnerabilities; (web page intrusion--bronze medal task) (2 points)