Fundamental Information Technology Engineer Examination (FE) | Subject A Authentication, Cryptography, and Network Defense Questions 01

A per-user salt and a suitable password-hashing scheme produce different stored values even for identical passwords and make reuse of precomputed attack results more difficult. A salt is not a secret value, and a shared salt would again reveal equal passwords through equal hashes. This also differs from storing reversibly encrypted passwords.

A nonce that differs and is not reused binds the response to one authentication attempt. Replaying an old response fails because it does not correspond to the current nonce. A fixed challenge permits the same response to be reused, so merely using a challenge-response format would not provide replay resistance.

A digital signature is generated with the signer's private key and verified with the corresponding public key, supporting signer authenticity and data integrity. Because the plaintext is not encrypted, the signature does not provide confidentiality. A signature alone also provides neither a timestamp nor a nonce and therefore does not guarantee replay prevention.

A MAC uses a shared secret key to verify data authenticity and integrity. An attacker without the key cannot recompute a valid MAC after intentionally changing the data. However, because both X and Y can generate the same MAC, it is unsuitable for proving to a third party that only X created it, and separate encryption is needed for confidentiality.

FRR divides the 20 false rejections by 1,000 genuine attempts, giving 2%. FAR divides the 1 false acceptance by 500 impostor attempts, giving 0.2%. The two rates use different populations as their denominators, so their attempt totals must not be swapped.

DNSSEC verifies signatures on DNS data to establish its origin and integrity. It is suited to detecting forged DNS responses, but it does not encrypt queries or responses to hide their contents. DKIM signs email, while S/MIME encrypts or signs email, so neither addresses validation of DNS responses.

To pass DMARC through SPF, the SPF-authenticated domain must align with the displayed From domain. Here vendor.net does not align with billing.example, and there is no aligned DKIM signature as an alternative, so DMARC fails. DMARC is not an encryption method; it lets a domain owner publish a requested policy for handling authentication failures.

An IPS detects signs of intrusion and can block attack traffic while operating in the traffic path. An IDS focuses on detection, logging, and notification and is not inherently required to block traffic itself. A SIEM collects and correlates logs, while a honeypot attracts attackers for observation, so neither directly satisfies the real-time blocking requirement.

A continuously connected replica may be encrypted or deleted through the same credentials or path as production. Offline or immutable generations that the attacker cannot alter, combined with regular restoration tests, improve recoverability. A successful job record does not prove either data integrity or the effectiveness of the restoration procedure.

The large payload is processed efficiently with symmetric encryption, while encrypting its temporary symmetric key with B's public key ensures that only B can recover it with the private key. Sending the symmetric key in plaintext destroys confidentiality. Applying A's private key is the signature direction and does not keep the data secret from holders of A's public key.