ToppyMicroServices

RFC 4949 Quiz

Internet Security Glossary

🇺🇸 🇯🇵
0 / 0

References (URLs)

Scope: RFC 4949 is an Informational glossary. Its definitions help expose category errors in a design review; they do not by themselves prescribe an architecture or prove conformance.

Q1: Which term means verifying a user's claimed identity?

Multiple Choice
**Explanation:** RFC 4949 Section 4 defines authentication as verifying a claim that an entity or resource has a particular attribute value. For a login, that attribute is commonly the user's claimed identity. Authentication is the verification step applied to the claimed identity. Authorization grants or evaluates approval to access a resource after relevant attributes are known. Identification presents the claimed value, such as a user identifier; it does not by itself verify the claim.

Q2: Which term describes deciding whether an authenticated user may delete a record?

Multiple Choice
**Explanation:** RFC 4949 Section 4 defines authorization as an approval, or the process of granting approval, for an entity to access a resource. The requested operation can be evaluated only after the system has an identity and the applicable policy. Authentication verifies an attribute claim; it does not grant deletion permission. Deciding whether this entity may perform this action is an authorization decision. Accounting records or measures activity and is not the permission decision itself.

Q3: Which objective protects data from unauthorized reading?

Multiple Choice
**Explanation:** RFC 4949 Section 4 defines confidentiality in terms of preventing unauthorized information disclosure. It is distinct from preserving correctness and from keeping a service usable. Availability concerns whether an authorized entity can access or use a resource when needed. Integrity concerns unauthorized modification or destruction of data. Preventing unauthorized reading is a confidentiality objective.

Q4: Which objective concerns detecting unauthorized modification in transit?

Multiple Choice
**Explanation:** RFC 4949 Section 4 defines data integrity as the property that data has not been changed or destroyed in an unauthorized manner. An integrity mechanism can let a receiver detect modification during transit. Confidentiality limits disclosure but does not by itself establish that received data is unchanged. Detecting unauthorized modification is an integrity function. Availability concerns access or operation on demand, not whether a message was altered.

Q5: What term names a random or non-repeating value used to detect replay?

Multiple Choice
**Explanation:** RFC 4949 Section 4 defines a nonce as a random or non-repeating value included in protocol data, usually to provide liveness and protect against replay. Its freshness, rather than secrecy, is the key property in this use. A nonce supplies the random or non-repeating value described in the stem. A credential carries evidence or attributes used in security decisions; it is not inherently fresh. A checksum can detect some data changes but does not inherently make a protocol exchange non-repeating.

Q6: What attack maliciously repeats a valid data transmission? (two words)

Short Text
**Explanation:** RFC 4949 Section 4 defines a replay attack as malicious or fraudulent repetition of a valid data transmission, either by its originator or by an interceptor who retransmits it. Freshness mechanisms such as nonces can help a receiver reject previously used protocol data.

Q7: Which terminology review most accurately identifies the missing security boundary?

Multiple Choice

An A2A gateway validates a client certificate and forwards `X-Agent-ID` to a backend. Any workload on the internal network can also create that header. The backend deletes a resource solely because the header names its owner.

**Explanation:** RFC 4949 Section 4 distinguishes the glossary entries for authentication, authorization, and access control. Authentication verifies a claimed identity or attribute; authorization grants permission under a policy; access control enforces that policy. A certificate check at the gateway does not by itself decide whether the authenticated agent may delete this backend resource. The backend also needs a trustworthy binding between `X-Agent-ID` and the gateway's verification result. If untrusted workloads can create the same header, syntax alone supplies neither authentication nor integrity. The design may establish a protected gateway-to-backend trust boundary or let the backend verify evidence directly, but RFC 4949 does not select one architecture. RFC 4949 is an Informational glossary, not a conformance specification. Its value here is to expose a category error in the design review; it does not make every gateway-based design nonconforming.

Q8: Which incident terms are used consistently with the glossary?

Multi-Select

A debug configuration writes reusable identity grants to a shared log. An internal account can read the log, and an operator intentionally copies a grant and reuses it. The profile treats any unauthorized log exposure of a raw grant as a successful attack.

**Explanation:** RFC 4949 Section 4 defines a vulnerability as an exploitable flaw or weakness, a threat as the potential for harm, an attack as an intentional act against policy, a security compromise as exposure or potential exposure to unauthorized access, and risk as expected loss involving a threat, vulnerability, and harmful result. A: Selected. The logging behavior is the weakness; the potential actor or event is the threat. B: Selected. Deliberate exploitation is an attack, and the profile's unauthorized exposure condition is a compromise. C: Selected. It keeps risk distinct from any single threat or flaw. D: Not selected. It reverses the action and weakness categories. E: Not selected. Transport protection does not control a later logging sink.

Q9: What does calling the gateway trusted establish?

Multiple Choice

A backend accepts identity and authorization results only from one gateway. The design document calls the gateway “trusted” but gives no protected channel, isolation argument, review evidence, or recovery plan. A reviewer says the label proves the gateway cannot violate policy.

**Explanation:** RFC 4949 Section 4 describes a trusted component as one responsible for enforcing policy such that system security depends on its correct operation. A trustworthy system not only is trusted but warrants that trust through convincing validation or assurance. A: A dependency label is not evidence of flawless behavior. B: Correct. The trust boundary must be stated, then supported by protection and assurance appropriate to the design. C: Encryption can be one mechanism, but it does not define trusted in this sense. D: The Informational glossary defines terms; it does not ban gateway architectures.

Q10: Which claims survive a terminology-level composition review?

Multi-Select

An Agent Card signature validates, TLS authenticates a gateway, and an identity grant is current. The gateway forwards an Agent ID to a backend, which applies its own delete policy. The document concludes that the request is therefore confidential, authorized, and risk-free at every hop.

**Explanation:** RFC 4949 Section 4 distinguishes security mechanisms from the services they support, authentication from authorization, access control from policy approval, and trusted from trustworthy. The glossary supplies a precise vocabulary for the review but does not prove the composed system secure. A: Selected. A valid signature does not itself authorize a resource operation. B: Not selected. A service at one channel endpoint does not describe post-termination handling. C: Selected. The backend is the stated enforcement point for its delete policy. D: Selected. Functional reliance identifies trust; assurance must justify trustworthiness. E: Not selected. Check count does not analyze gaps or residual risk.