IT Security and Storage Architecture Fundamentals

All listed techniques are valid methods for compromising password security. Eavesdropping captures passwords during transmission, replay attacks reuse previously captured authentication credentials, social engineering tricks users into revealing passwords, and Trojan horses can capture keystrokes or stored passwords. Since each option represents a legitimate attack vector, 'All of the above' is the correct comprehensive answer.

Retinal scanning falls under 'what we are' (biometrics) because it uses unique physical characteristics of the human body. The three authentication factor types are: what we know (passwords, PINs), what we have (tokens, smart cards), and what we are (biometrics like fingerprints, retina scans). 'What we use' is not a standard authentication category.

Kerberos uses symmetric encryption (secret key cryptography) to authenticate users and services. It relies on a trusted third-party Key Distribution Center (KDC) that shares secret keys with all parties. Asymmetric encryption uses public-private key pairs, digital signatures provide non-repudiation, and block ciphers are symmetric encryption algorithms but not the specific answer for Kerberos authentication.

NAS (Network Attached Storage) provides file-level storage consolidation for multiple servers, while SAN (Storage Area Network) provides block-level storage consolidation. Option A correctly identifies this distinction. Options B, C, and D are reversed: SAN uses block-level protocols (FC, iSCSI), NAS uses file-level protocols (NFS, SMB), NAS uses TCP/IP, SAN uses FC, and both support multipathing capabilities.

This question asks which statement is FALSE (all true except). FC-SW (switched fabric) is analogous to Ethernet switching, not token ring. Options A, B, and C are all true: WWNs are like MAC addresses (unique device IDs), FC port IDs are like IP addresses (assigned addresses for communication), and private FC-AL uses 8-bit addressing (limiting to 126 devices after addressing overhead). The question structure correctly identifies D as the false statement.

One-time passwords (OTPs) are valid for a single login session and then discarded, providing protection against replay attacks. Dynamic passwords change periodically but may not be single-use, static passwords remain constant, and hybrid passwords combine multiple password types. OTP is the specific term for single-session passwords that are immediately invalidated.

Larger biometric data files take longer to process and transmit, directly affecting throughput rates (how many authentication requests can be processed per time unit). Data collection techniques are about capture methods, enrollment time is about initial template creation, and user-system contact is about interaction quality. Throughput is the performance metric most impacted by file size in production environments.

Administrative access control imposes managerial, operational, and accountability policies through procedures, training, and oversight. Physical access control manages physical entry, technical/logical access control uses hardware/software mechanisms, and logical is a subset of technical. Administrative controls are the 'human' policies and procedures layer of security.

The Host Bus Adapter (HBA) is the hardware component that physically and logically connects a host computer's I/O bus (such as PCI) to a Fibre Channel network. It acts as the interface card installed in the server, converting protocol and electrical signals between the host system and the SAN fabric. Fibre cables simply transmit data, switches route traffic, and storage arrays store data - only the HBA provides the actual connection point from the host to the network.

Parity in RAID systems (specifically RAID 5) provides fault tolerance by calculating and storing parity information across multiple drives. If a single drive fails, the parity information allows the data to be reconstructed without requiring a full mirror copy. Mirroring requires 2*n drives (complete duplication), striping provides no fault tolerance, and clustering provides high availability but not drive-level fault tolerance through parity.

One-time passwords (OTP) are the most secure option listed because they are valid only for a single use or short time window. Even if intercepted, they cannot be reused. Static passwords remain the same and are vulnerable to reuse. Dynamic passwords may change but often follow predictable patterns. Hybrid passwords combine methods but still lack the fundamental security property of OTPs - single-use validity.

Single-mode fiber for ISLs (Inter-Switch Links) in Fibre Channel networks can support distances up to approximately 20 kilometers. Single-mode fiber uses a single light path and laser light sources, allowing for longer distances with less signal attenuation compared to multi-mode fiber. The 20 km distance is a standard specification for long-wave laser transceivers in SAN environments.

Multi-mode fiber for ISLs (Inter-Switch Links) in Fibre Channel networks typically supports distances up to 500 meters. Multi-mode fiber uses multiple light paths and LED or laser sources, which causes modal dispersion that limits effective distance. For longer ISL distances, single-mode fiber must be used instead. The 500 meter distance is the standard limit for multi-mode in SAN environments.

When multiple HBAs are zoned to the same storage array port, LUN (Logical Unit Number) masking is the appropriate strategy to restrict which specific storage devices each HBA can access. LUN masking operates at the storage array level, allowing administrators to present only specific LUNs to each HBA's WWN (World Wide Name). WWN zoning operates at the switch level and is too broad. Port zoning also controls connectivity but at a different layer. LUN masking provides the granular device-level control needed.

SHA (Secure Hash Algorithm) is better suited for password storage than AES, 3DES, or RSA because SHA is a cryptographic hash function, not an encryption algorithm. Passwords should never be stored in reversible form - if encrypted, they could potentially be decrypted. Hashing is one-way: even if the hash is compromised, the original password cannot be retrieved. SHA-256 or SHA-512 are commonly used for secure password storage (typically with salt). AES and 3DES are symmetric encryption algorithms, and RSA is asymmetric encryption - all reversible.

Separation of duties is a security principle that prevents any single user from gaining complete control of a critical process. By distributing responsibilities across multiple individuals, no one person can execute all steps of a sensitive operation without collusion. This prevents fraud, errors, and abuse of privilege. The correct option states this precisely - preventing complete control. The other options incorrectly suggest teamwork encouragement or knowledge prevention, which are not the primary goals.

An unattended session occurs when a user leaves a host during an active session. This is a security vulnerability because the session remains authenticated and accessible without the authorized user present. An intruder could then access the session or perform actions under the stolen identity. The other options describe different scenarios: improper termination, intruder session hijacking, and failed login attempts - none of which define an unattended session.