ITPEC FE Subject B October 2024 Question 19
From the answer group below, select the correct combination of answers to be inserted into A and B in the description.
Company X is an investment company. Recently, one of their database servers was attacked by an attacker.
Mr. L, the security team leader of company X, decided to ask Ms. A, a security analyst working for the same company, to analyze the logs. Mr. L will extract log entries related to database access from the log file of the attacked database server and send the extracted log entries to Ms. A.
When sending access log data from Mr. L to Ms. A, the following conditions were agreed upon in advance:
They each have an RSA key pair and have already exchanged their public keys with each other. They sign, verify, encrypt, and decrypt using those keys and a previously shared cryptographic processing software.
This time, the log entries must be A and then B.
Answer group
Explanation
A: signed using Mr. L's private key, B: encrypted using Ms. A's public key — the signature proves who sent the file, and the encryption decides who can read it.
- •Sender check: only Mr. L holds his private key, so a signature made with it can come only from him; Ms. A verifies it with Mr. L's public key, which she already has.
- •Only Ms. A can read: data encrypted with Ms. A's public key can be decrypted only with her private key, which no one else holds.
Mr. L signs the log entries first and then encrypts the signed file for Ms. A. She decrypts it with her private key and verifies the signature with his public key.
Answer (d)
Why not others:
- •(e), (f), (g) and (h) — a signature made with Mr. L's public key proves nothing: that key has been handed out, so anyone could have made it
- •(a) and (c) — data encrypted with a private key can be decrypted by anyone holding the matching public key, so it is not confidential; in (c) Mr. L could not even do it, since only Ms. A has her private key
- •(b) — data encrypted with Mr. L's public key can be decrypted only with Mr. L's private key, so Ms. A cannot open it
Key rule: Sign with the sender's private key for authenticity; encrypt with the recipient's public key for confidentiality.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.