← Back to 31. Cryptography and Network Security

📝 Entity authentication in networks (18 MCQs)

📖 From Data Communication and Networks • 31. Cryptography and Network Security • 18 questions available

←Previous Topic:Digital signature in cryptography📝 Entity authentication in networksKey management in cryptography:Next Topic→

What is Entity authentication in networks?

Entity authentication in networks is the process of verifying the identity of a user, device, or system before granting access, typically using passwords, tokens, biometrics, or cryptographic protocols to ensure only legitimate entities participate in communication.

Easy

Medium

Hard

📝 All Entity authentication in networks MCQs

Q1. If a protocol uses a challenge‑response mechanism where the server sends a random nonce  $N$ and the client returns $H(N\|K)$ (hash of nonce concatenated with shared secret  $K$ ), which property primarily guarantees entity authentication?

A.Confidentiality

B.Freshness ✅

C.Integrity

D.Non‑repudiation

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: The hash includes the fresh nonce, so only a party that knows the secret  $K$ can produce the correct value. The presence of a fresh, unpredictable nonce prevents replay, thereby establishing that the responder is the legitimate entity. The other options describe different security goals, not the core reason for authentication.

Q2. In a mutual authentication protocol where both parties exchange digitally signed timestamps, how does this design thwart replay attacks?

A.Timestamps are encrypted, making them unreadable to attackers

B.Each timestamp is unique and the signature binds it to the sender, so a previously captured message will fail verification

C.The timestamps are sent over a secure channel, eliminating the need for replay protection

D.Replay attacks are prevented by discarding any message that arrives after a predetermined timeout ✅

💡 Difficulty: medium | ✅ Correct: D

📖 Explanation: A signed timestamp provides both freshness and origin binding. Because the timestamp changes for each session and the signature can be verified with the sender’s public key, an adversary cannot reuse an old message without detection. Encryption alone does not guarantee replay resistance, and time‑outs alone are insufficient without authentication.

Q3. Which statement correctly differentiates Kerberos ticket‑granting tickets (TGT) from X.509 certificate‑based authentication?

A.A TGT is signed by a trusted third‑party, while an X.509 certificate is self‑signed

B.TGTs contain a symmetric session key, whereas X.509 certificates carry a public key and associated attributes

C.Kerberos relies on password‑derived keys; X.509 uses asymmetric keys and a hierarchical trust model ✅

D.Both mechanisms use the same cryptographic primitives and trust assumptions

💡 Difficulty: hard | ✅ Correct: C

📖 Explanation: Kerberos issues TGTs that embed a symmetric key and are validated by a central Key Distribution Center, reflecting a closed‑realm trust model. X.509 certificates, by contrast, bind a public key to an identity using a hierarchical PKI, allowing entities from different administrative domains to authenticate each other. The other options misstate the trust relationships or key types.

Q4. Entity authentication is best described as:

A.Verification that a communicating entity is who it claims to be ✅

B.Ensuring that data remains confidential during transmission

C.Establishing a secure channel for data exchange

D.Providing non‑repudiation for a message

💡 Difficulty: easy | ✅ Correct: A

📖 Explanation: Entity authentication focuses on confirming the identity of the participant in a protocol, typically using credentials such as passwords, certificates, or cryptographic tokens. Confidentiality, secure channel establishment, and non‑repudiation are related but distinct security services.

Q5. An attacker intercepts a message containing a session key encrypted with the server’s public key. Which additional step must the protocol include to assure the client of the server’s identity?

A.The server must sign the encrypted session key with its private key ✅

B.The client must send a nonce that the server encrypts with the session key

C.The server must include a timestamp in the encrypted payload

D.The client must verify a MAC generated with the session key

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: Signing the encrypted session key binds the key to the server’s private key, enabling the client to verify the signature with the server’s public certificate. This cryptographic proof of ownership prevents a man‑in‑the‑middle from substituting its own key, while the other options address freshness or integrity but not identity assurance.

Q6. How does combining a one‑time password (OTP) with a hardware token improve the strength of entity authentication?

A.It adds biometric data to the authentication process

B.The OTP provides a secret that changes each login, while the hardware token supplies a tamper‑resistant secret, creating two independent factors ✅

C.It doubles the length of the password, making brute‑force attacks slower

D.The hardware token encrypts the OTP, ensuring confidentiality

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: An OTP changes for every session, limiting the usefulness of captured credentials. A hardware token stores a secret that is difficult to extract, offering a second, independent factor. Together they satisfy multi‑factor authentication, significantly raising the effort required for an attacker compared to using either factor alone.

Q7. Which statement best compares password‑based authentication with biometric authentication?

A.Passwords are easier to share, while biometrics cannot be transferred between devices

B.Biometrics provide higher entropy than typical passwords, but require specialized sensors

C.Passwords guarantee non‑repudiation, whereas biometrics do not

D.Both methods rely on symmetric cryptography for verification ✅

💡 Difficulty: easy | ✅ Correct: D

📖 Explanation: Both password and biometric schemes ultimately verify a secret (a password or a biometric template) using cryptographic primitives, often symmetric. While biometrics may offer higher entropy, they still need secure storage and processing. The other statements contain inaccuracies regarding shareability, entropy, and non‑repudiation.

Q8. In a protocol where Alice sends $M_1$ encrypted under a shared key, Bob replies with $M_2$ encrypted under a newly generated key, and an attacker modifies $M_2$ before it reaches Alice, what logical deduction reveals a breach of entity authentication?

A.Alice will detect a mismatch in sequence numbers

B.Bob’s response will contain a signature that Alice cannot verify

C.Alice will be unable to decrypt

M_2

with the original shared key, indicating the responder is not the expected party ✅

D.The protocol will abort due to a timeout

💡 Difficulty: medium | ✅ Correct: C

📖 Explanation: If the responder’s message is encrypted with a key that Alice does not possess, decryption will fail, signaling that the entity producing the reply is not the legitimate Bob. This logical consequence directly ties a decryption failure to a loss of authentication, whereas sequence numbers or timeouts alone do not guarantee identity verification.

Q9. Consider an IoT device that authenticates to a cloud service using a pre‑shared key (PSK). Which design modification best enhances authentication while preserving low computational overhead?

A.Replace the PSK with a public‑key certificate chain

B.Introduce a challenge‑response exchange using a nonce and HMAC keyed with the PSK ✅

C.Add a biometric sensor to the device

D.Use a longer PSK without changing the protocol flow

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: A nonce‑based challenge‑response using an HMAC retains the lightweight symmetric‑key operations suitable for constrained devices, while providing freshness and proof of possession of the PSK. Public‑key certificates would increase computational cost, and biometrics are impractical for many IoT nodes. Simply lengthening the PSK does not address replay threats.

Q10. Which international standard primarily defines requirements for entity authentication in network protocols?

A.ISO/IEC 27001

B.ISO/IEC 15408

C.ISO/IEC 9798 ✅

D.ISO/IEC 19790

💡 Difficulty: medium | ✅ Correct: C

📖 Explanation: ISO/IEC 9798 specifies mechanisms for entity authentication, covering both symmetric and asymmetric techniques, and is widely referenced in protocol design. ISO/IEC 27001 addresses information security management, ISO/IEC 15408 defines evaluation criteria (Common Criteria), and ISO/IEC 19790 deals with security requirements for cryptographic modules.

Q11. A protocol uses a fixed session identifier transmitted in clear text. An analyst observes that replaying a previously captured message succeeds. Which vulnerability does this reveal?

A.Lack of confidentiality

B.Absence of integrity protection

C.Missing freshness guarantee ✅

D.Weak key management

💡 Difficulty: medium | ✅ Correct: C

📖 Explanation: Replaying a message succeeds because the protocol provides no mechanism to ensure that each execution is fresh. A fixed identifier does not change between sessions, allowing an attacker to reuse old messages. Confidentiality and integrity protect data, but the core issue here is the lack of a freshness element such as a nonce or timestamp.

Q12. In a system where each login attempt increments a counter stored on the server, what logical inference can be drawn if the counter jumps from 7 to 10 without intermediate values?

A.The server experienced a power failure

B.An attacker performed multiple successful logins in rapid succession ✅

C.The counter was corrupted due to a software bug

D.The server is using a non‑sequential identifier scheme

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: A sudden increase in the counter suggests that several authentication events occurred that were not observed by the client, which is typical of an attacker rapidly issuing login attempts. Power failures or bugs might cause resets or inconsistencies, but they would not produce a clean increment of three steps.

Q13. Explain the relationship between entity authentication and authorization in a secure system.

A.Authentication determines what actions a user may perform, while authorization verifies the user’s identity

B.Authentication verifies identity; authorization decides which resources the authenticated entity may access ✅

C.Both are identical processes performed at different layers of the OSI model

D.Authorization is a subset of authentication that deals with password strength

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: Entity authentication confirms that an entity is who it claims to be, typically using credentials. Authorization, on the other hand, uses that verified identity to enforce policy decisions about what resources or operations the entity is permitted to use. The two are distinct but sequential steps in a security workflow.

Q14. When evaluating a new authentication protocol, which trade‑off most directly impacts its suitability for high‑latency networks?

A.Strength of cryptographic primitives versus key length

B.Number of round‑trip messages versus resistance to replay attacks ✅

C.Size of the authentication token versus storage requirements on the client

D.Complexity of the user interface versus ease of deployment

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: In high‑latency environments, each additional round‑trip adds noticeable delay. Designers must balance the desire for multiple exchanges that improve replay protection against the practical need to limit message exchanges. Stronger primitives or token size affect computational load, not latency, while UI complexity is unrelated to network performance.

Q15. If a client receives a signed authentication token that includes the server’s identifier and a timestamp, but the signature verification fails, what can be logically deduced?

A.The server’s clock is out of sync with the client’s clock

B.The token was tampered with or forged, indicating a possible impersonation attempt ✅

C.The client’s public key is outdated and must be refreshed

D.The network suffered a transient error causing bit flips

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: A failed signature verification signals that the token’s integrity or authenticity cannot be confirmed. This typically means the token was altered or generated by an unauthorized party, pointing to an impersonation risk. Clock drift affects freshness, not signature validity; public‑key updates and transient errors are separate concerns.

Q16. Which factor most improves the resilience of entity authentication against credential‑theft attacks?

A.Increasing password length alone

B.Employing multi‑factor authentication that combines something you know with something you have ✅

C.Using a longer cryptographic hash algorithm

D.Storing credentials in plaintext on the server

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: Multi‑factor authentication adds independent layers (e.g., a password plus a hardware token), so even if one credential is compromised, the attacker still lacks the other factor. Simply lengthening passwords or hashes does not mitigate theft, and storing credentials in plaintext is insecure.

Q17. A protocol requires the client to send a hash of the concatenation of a nonce  $N$ and a secret  $S$ ( $H(N\|S)$ ). An analyst notes that the same hash appears in two separate sessions with different nonces. What deduction can be made?

A.The secret 

S

is being reused across sessions, violating best practices ✅

B.The nonces are not truly random, leading to hash collisions

C.The hash function is insecure and produces collisions easily

D.The protocol is vulnerable to dictionary attacks on 

S

💡 Difficulty: hard | ✅ Correct: A

📖 Explanation: If the hash values are identical despite different nonces, the only plausible explanation is that the secret  $S$ is constant across sessions, and the nonce contribution is being overwritten or ignored. Proper use of a fresh nonce should yield distinct hashes each time, assuming a secure hash function.

Q18. In a scenario where a server authenticates a client using a password‑derived key, why might adding a server‑generated nonce improve security?

A.It allows the server to encrypt the password for storage

B.It introduces freshness, preventing replay of captured authentication messages ✅

C.It reduces the computational cost of the key‑derivation function

D.It eliminates the need for secure channels

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: A server‑generated nonce ensures that each authentication exchange incorporates a fresh, unpredictable value. An attacker who records a prior authentication exchange cannot simply replay it because the server will expect a response tied to the new nonce. The nonce does not directly affect storage or computational cost, nor does it replace the need for confidentiality.

🔗 Related Topics (MCQs)

📝 Network security introduction and basics MCQs 📝 Network Security goals confidentiality integrity availability MCQs 📝 Network security attacks types MCQs 📝 Security services and techniques in networks MCQs 📝 Confidentiality in network security MCQs

←Previous Topic:Digital signature in cryptography📝 Entity authentication in networksKey management in cryptography:Next Topic→