Information Security

Symmetric encryption uses the same secret key for both encryption and decryption, which is why it's called private key or secret key encryption. Public key encryption (asymmetric) uses different keys for encryption and decryption. Option A correctly identifies symmetric encryption.

AES (Advanced Encryption Standard) is the strongest encryption algorithm listed and is currently the standard adopted by the US Government. DES and Triple DES are older, less secure algorithms that have been largely replaced by AES due to vulnerabilities and insufficient key lengths.

A public key server (or Certificate Authority) is needed to support encryption on a server by providing public keys and certificates to clients. This enables asymmetric encryption and secure key exchange. Firewalls filter traffic, and private keys must be kept secret on the server itself, not exposed.

Unsecured LANs pose a threat to data confidentiality because data is accessible at each network node as packets travel through switches and routers. Any device on the network can potentially capture traffic using packet sniffing tools. This is different from spoofing or authentication issues.

Structured threats come from highly motivated and technically competent hackers (often organized crime or state-sponsored). They use sophisticated methods and significant resources. Unstructured threats are from opportunistic attackers with limited skills. Internal and external refer to the source location, not the attacker's capability level.

Group mechanisms reduce the size of access control matrices by assigning permissions to groups rather than individuals - users inherit group permissions, dramatically reducing the matrix size. Function values and effective storage are not standard access control techniques. Suspended programs are unrelated to access control.

The reference monitor is the security concept that mediates all accesses to objects by subjects, making access control decisions. It enforces security policies by checking each access request against authorization rules. Resource managers handle resource allocation, suspended programs are inactive processes, and access control matrix is a model for organizing permissions, not the decision mechanism itself.

The user who initiated the session is held accountable because they authenticated and established the session. Security accountability is tied to the authenticated identity, not the actual actor who may have hijacked the session. The network administrator manages the system, and the intruder is the attacker, not the accountable party. Resource managers handle storage allocation.

All listed techniques are valid methods for compromising password security. Eavesdropping captures passwords during transmission, replay attacks reuse previously captured authentication credentials, social engineering tricks users into revealing passwords, and Trojan horses can capture keystrokes or stored passwords. Since each option represents a legitimate attack vector, 'All of the above' is the correct comprehensive answer.

Kerberos uses symmetric encryption (secret key cryptography) to authenticate users and services. It relies on a trusted third-party Key Distribution Center (KDC) that shares secret keys with all parties. Asymmetric encryption uses public-private key pairs, digital signatures provide non-repudiation, and block ciphers are symmetric encryption algorithms but not the specific answer for Kerberos authentication.

One-time passwords (OTPs) are valid for a single login session and then discarded, providing protection against replay attacks. Dynamic passwords change periodically but may not be single-use, static passwords remain constant, and hybrid passwords combine multiple password types. OTP is the specific term for single-session passwords that are immediately invalidated.

Larger biometric data files take longer to process and transmit, directly affecting throughput rates (how many authentication requests can be processed per time unit). Data collection techniques are about capture methods, enrollment time is about initial template creation, and user-system contact is about interaction quality. Throughput is the performance metric most impacted by file size in production environments.

Administrative access control imposes managerial, operational, and accountability policies through procedures, training, and oversight. Physical access control manages physical entry, technical/logical access control uses hardware/software mechanisms, and logical is a subset of technical. Administrative controls are the 'human' policies and procedures layer of security.