SCP Security Certified Program (SCP) : SC0-502

When SCP technologies run your company's stack, certified staff get noticed first. The SC0-502 exam is how you become one of them, and Pass4Test gets you there with 40 practice questions for the SCP Security Certified Program (SCP) exam, verified answers included.

SCP SC0-502 Exam Overview:

SCP SC0-502 Exam Syllabus Topics:

Read Before You Register: SC0-502 Exam Q&A

Who is eligible to sit the SC0-502 exam?

Recommended prerequisite: SAS Certified Base Programmer for SAS 9 (SC0-501) or equivalent experience These conditions come from SCP and can be revised, so confirm the current requirements on the official exam page: https://www.sas.com/en_us/certification.html — better a two-minute check than a wasted SCP Security Certified Program (SCP) registration.

What is the question count and time limit on the SC0-502 exam?

The SCP Security Certified Program (SCP) exam gives you 135 minutes to work through 60-65 questions. Split that down and each question earns only a narrow slice of the clock — lingering too long on one item borrows time from three others. Build the habit now: run timed, full-length sessions in the Pass4Test test engine until finishing early feels normal on the real SC0-502 exam.

What credential is tied to the SC0-502 exam?

The SC0-502 exam is SCP's official assessment leading to the SCP Certification certification, which sits at the Professional level. It validates job-ready, vendor-recognized skills — the kind employers screen for. It also belongs to a wider certification family that includes SAS Certified Base Programmer for SAS 9, so it can anchor a longer credential roadmap.

What happens if I fail the SCP Security Certified Program (SCP) exam, and how do I receive my product?

Delivery takes about a minute: after payment, Pass4Test emails your SC0-502 download instantly — if nothing arrives within 2 hours, check spam and contact support for an immediate resend. Install it on as many computers as you like. On failure: take the corresponding SC0-502 exam within 60 days of purchase, and a fail qualifies you for a full refund. File within 2 days after the exam with a scanned enrollment slip and the official Score Report PDF; claims close within 7 days. Excluded are attempts within 3 days of purchase, exams never actually taken, free materials, and expired orders — and the candidate name must match the payer name. Prefer to keep studying? On request we can exchange your product for two free exam products of equal value, and your original purchase keeps its update service.

What are the main topics on the SC0-502 exam?

The SCP Security Certified Program (SCP) syllabus divides into 5 domains, led by Data Access and Data Management, Macro Processing, SQL Processing in SAS. Heavier domains deserve heavier study time — the complete outline with every domain is listed above on this page.

Can I see sample SC0-502 questions before I pay?

Yes — a free demo is available for the SCP Security Certified Program (SCP) product, so you can review the question style and verified answers yourself first. After purchase, 365 days of free updates are included; once the year ends, the update service renews at a 50% discount from your member zone.

SCP Security Certified Program (SCP) Sample Questions:

Question #1
Things have been running smoothly now at GlobalCorp for the last several weeks. There have been no major attacks, and it seems that the systems in place are performing just as expected. You are putting together some paperwork when you get a call from Blue to meet in the conference room.
When you get there, Blue is wrapping up a meeting with the senior Vice President of Sales, whom you say hello to on your way in.
"I was just talking with our senior VP here, and we're run into a new issue to discuss," Blue tells you.
"Wel Il let you two sort this out. Blue, do let me know when it's all ready to go." With that the VP leaves.
You sit down across from Blue, who starts, "That was an interesting meeting. It seems that even though I have always said no to the request, we are being pressured to implement a wireless network."
"Here?" you ask, "In the executive building?"
"Yes, right here. The sales team wishes to have the ability to be mobile. Instead of running a full scale roll out I have trimmed the request down to running a test implementation on the second floor. The test run on that floor will be used to determine the type of wireless rollout for the rest of the building, and eventually the rest of the campus. So, here is what we need to do. I need you to create the roll out plan, and bring that plan to me. Il review with you and implement as required."
"As always, what is my budget restriction?" you ask.
"In this case, security is the top priority. If we are going to run wireless, it has to be as secure as possible, use whatever you need. That being said, your plan has to use existing technologies, we are not going to fund the development of a new protocol or proprietary encryption system right now."
You begin your work on this problem by pulling out your own wireless networking gear. You have a laptop that uses an ORiNOCO card, and you have a full directional antenna that you can hold or mount on a small tripod. You take your gear to the lobby of the second floor, and you load up NetStumbler quickly to run a quick check that there are no access points in your area.
The immediate area is clear of any signal, so you take you gear and walk the entire second floor, waiting to see if there is any signal, and you find none. With your quick walk through complete, you take your gear back to your office and start working on your plan.
Using your knowledge of the GlobalCorp network, select the best solution to the wireless networking rollout problem:}

A. You determine that for the test network, you will run the network in infrastructure mode, using a SSID of FLOOR2. During the test, you will create one single Basic Service Set (BSS), running through one access point. All test nodes will be configured to participate in the BSS, using the SSID of FLOOR2, and the access point will be configured with MAC address filtering of the test nodes.
You will configure the access point to use EAP, specifically EAP-TLS. You will configure a Microsoft RADIUS Server as the authentication server. You will configure the RADIUS server with a digital certificate. Using EAP-TLS, both the server and the client will be required to authenticate using their digital certificates before full network access will be granted. Clients will have supplicant software configured where required.
You will next make a physical map of the office, using the tool Ekahau. Working with this tool, you will map out and track the positioning of each wireless device once the network is active.
When the network is up and running, you take your gear (which is not an authorized client of the network) and every few days will walk the office again, checking for access. You will continue the test by running checks from the parking lot, ensuring that you cannot gain access.
B. You have figured out that since the network is a test roll out, you have some flexibility in its configuration. After your walk through test, you begin by configuring the wireless nodes in the network to run in Ad Hoc mode, creating an Extended Basic Service Set (EBSS).
You will use a complex SSID of 5cN@4M3! on all wireless nodes. You will next configure every node to no longer broadcast any beacon packets. You will configure all the nodes to not use the default channel, and instead move them all to channel six.
You will configure every node to use MAC address filtering, to avoid unauthorized nodes from attempting to gain access to the network. Finally, you will configure each node to use WEP in the strong 128-bit mode, along with a complex 16-character passphrase for generating four keys. You will manually input the WEP Keys into each node. You will divide the test nodes into quarters, and configure each quarter to startup on the network using a different default WEP key.
Once the network is up and running, you take your gear (which is not an authorized client of the network) and every few days will walk the office again, checking for access.
C. You determine that for the test network, you will run in infrastructure mode, using a SSID of FLOOR2. During the test, you will create one single Independent Basic Service Set (IBSS), running through one access point. All test nodes will be configured to participate in the IBSS, using the SSID of FLOOR2.
You will configure the access point to use WPA, with an algorithm of TKIP. You will configure WPA to utilize the full 128-bit key option, with the pre-shared WPA key option. The client computers will need supplicants, so you will configure the Funk Software Odyssey Client on the clients, matching the key settings and TKIP settings.
You will disable the access point from broadcasting its SSID, and you will configure MAC address filtering.
Once the network is up and running, you take your gear (which is not an authorized client of the network) and every few days will walk the office again, checking for access.
D. You figure out that you will run the test network in infrastructure mode, using a SSID of GlobalCorp. You will create one single Basic Service Set (BSS), all running through one access point. All test nodes will be configured to participate in the BSS, using the SSID of GlobalCorp, and the access point will be configured with MAC address filtering of the test nodes.
You will configure the access point to utilize a combination of 802.1x and WPA. The WPA settings will be fully secured with TKIP, and 128-bit keys, which change on a per session basis. The 802.1x settings will be to use Lightweight EAP (LEAP). The clients will be configured to use LEAP, with a fallback to TKIP at 128-bits.
When the network is up and running, you take your gear (which is not an authorized client of the network) and every few days will walk the office again, checking for access. You will continue the test by running checks from the parking lot, ensuring that you cannot gain access.
E. You have figured out that since the network is a test roll out, you have some flexibility in its configuration. After your walk through test, you begin by configuring the wireless nodes in the network to run in Ad Hoc mode, creating an Independent Basic Service Set (IBSS).
You will use a complex SSID of 5cN@4M3! on all wireless nodes. You will next configure every node to no longer broadcast any beacon packets. You will configure all the nodes to not use the default channel, and instead move them all to channel six.
You will configure every node to use MAC address filtering, to avoid unauthorized nodes from attempting to gain access to the network. Finally, you will configure each node to use WEP in the strong 128-bit mode, along with a complex 16-character passphrase.
Once the network is up and running, you take your gear (which is not an authorized client of the network) and every few days will walk the office again, checking for access.

Question #2
The network has been receiving quite a lot of inbound traffic, and although you have been given instructions to keep the network open, you want to know what is going on. You have decided to implement an Intrusion Detection System. You bring this up at the next meeting.
"After looking at our current network security, and the network traffic we are dealing with, I recommend that we implement an Intrusion Detection System," you begin.
"We don't have any more budget for security equipment, it will have to wait until next year." This is the reply from the CEO that you were anticipating.
"I realize that the budget is tight, but this is an important part of setting up security." You continue, "If I cannot properly identify all the network traffic, and have a system in place to respond to it, we might not know about an incident until after our information is found for sale on the open market." As expected, your last comment got the group thinking.
"What about false alarms?" asks the VP of sales, "I hear those things are always going off, and just end up wasting everyone" time."
"Tha's a fair concern, but it is my concern. When we implement the system, I will fine tune it and adjust it until the alarms it generates are appropriate, and are generated when there is legitimately something to be concerned about. We are concerned with traffic that would indicate an attack; only then will the system send me an alert."
For a few minutes there was talk back and forth in the room, and then the CEO responds again to your inquiry, "I agree that this type of thing could be helpful. But, we simply don have any more budget for it. Since it is a good idea, go ahead and find a way to implement this, but don't spend any money on it."
With this information, and your knowledge of MegaCorp, choose the answer that will provide the best solution for the IDS needs of MegaCorp:}

A. You install Snort on a dedicated machine just outside the router. The machine is designed to send alerts to you when appropriate. You implement the following rule set:
Alert udp any any -> 10.10.0.0\16 (msg: "O\S Fingerprint Detected"; flags: S12;) Alert tcp any any -> 10.10.0.0\16 (msg: "Syn\Fin Scan Detected"; flags: SF;) Alert tcp any any -> 10.10.0.0\16 (msg: "Null Scan Detected"; flags: 0;) Log tcp any any -> 10.10.0.0\16 any
You then install Snort on the web and ftp server, also with this system designed to send you alerts when appropriate. You implement the built-in scan.rules ruleset on the server.
B. You install Snort on a dedicated machine just inside the router. The machine is designed to send alerts to you when appropriate. You do have some concern that the system will have too many rules to operate efficiently. To address this, you decide to pull the critical rules out of the built-in rule sets, and create one simple rule set that is short and will cover all of the serious incidents that the network might experience.
alert udp any 19 <> $HOME_NET 7 (msg:"DOS UDP Bomb"; classtype:attempted-dos; sid:271;
rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Teardrop attack"; id:242;
fragbits:M;
classtype:attempted-dos; sid:270; rev:1;) alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN Probe"; id: 678; itype: 8; content: "1234";
classtype:attempted-recon; sid:221; rev:1;) alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8;
classtype:attempted-recon; sid:469; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN XMAS";flags:SRAFPU; classtype:attempted-recon; sid:625; rev:1;) alert tcp $HOME_NET 31337 -> $EXTERNAL_NET 80 (msg:"SCAN synscan microsoft"; id: 39426; flags: SF; classtype:attempted-recon; sid:633; rev:1;)
C. You configure a new dedicated machine just outside the router and install Snort on that machine. The machine logs all intrusions locally, and you will connect to the machine remotely once each morning to pull the log files to your local machine for analysis.
You run snort with the following command: Snort ev \snort\log snort.conf and using the following rule base:
Alert tcp any any <> any 80 Alert tcp any any <> 10.10.0.0\16 any (content: "Password"; msg:"Password transfer Possible";) Log tcp any any <- 10.10.0.0\16 23 Log tcp any any <> 10.10.0.0\16 1:1024
D. You install your IDS on a dedicated machine just inside the router. The machine is designed to send alerts to you when appropriate. You begin the install by performing a new install of Windows on a clean hard drive.
You install ISS Internet Scanner and ISS System Scanner on the new system. System Scanner is configured to do full backdoor testing, full baseline testing, and full password testing. Internet Scanner is configured with a custom policy you made to scan for all vulnerabilities. You configure both scanners to generate automatic weekly reports and to send you alerts when an incident of note takes place on the network.
E. You install two computers to run your IDS. One will be a dedicated machine that is on the outside of the router, and the second will be on the inside of the router. You configure the machine on the outside of the router to run Snort, and you combine the default rules of several of the built-in rule sets. You combine the ddos.rules, dos.rules, exploit.rules, icmp.rules, and scan.rules.
On the system that is inside the router, running Snort, you also combine several of the built-in rule sets. You combine the scan.rules, web-cgi.rules, ftp.rules, web-misc.rules, and web-iis.rules. You configure the alerts on the two systems to send you email messages when events are identified. After you implement the two systems, you run some external scans and tests using vulnerability checkers and exploit testing software. You modify your rules based on your tests.

Question #3
You got the router configured just as you wish, and it is time to get the team together for a meeting. You have the advantage of knowing several of these people for quite some time through your contracting, but this will be your first full meeting with them.
The next day, you sit down with the CEO, HR Director, and other management people in MegaCorp. You wish for the meeting to be as short as possible, so in this initial meeting, you open with a short summary and project what you feel is a serious problem with the company.
"Thanks for coming. I will try to keep this as brief as possible. As you all know, Purple was let go under difficult circumstances, and for the last week I have been working non-stop to get the network and security under control here. Very good progress has been made, but we are missing a fundamental component. There is no security policy here at MegaCorp." To this, you see some heads nod in agreement, others have no reaction whatsoever, and a few people let go disappointing sighs.
"I agree that we need a security policy," adds the HR Director, "as long as it doesn become too restrictive."
"Policies are only used to document the posture of the organization, and to provide some guidance in the direction of the network and, in this case, the security of the network." You add, "Without a written policy, how is any employee supposed to know what is acceptable, what is not acceptable, and so on."
"Our employees have common sense, we do not want the company to become overly regulated," says a middle manager who you have not spoken with before.
"Common sense is great, the more the employees have, and the easier it is to implement the policies. But, there is no guarantee for the human element. A simple review of what just took place with Purple is a quick reminder of this." With that comment, the middle manager relaxed a bit, and hesitantly agreed.
"So, what I would like to do is to lead the development of the policy here, and work with each of you to get it implemented. In the next few days, I will be requesting a bit of your time, so we can talk one on one about your needs and issues surrounding the policy."
The next week, you meet with the management team, and you have a list of questions for them, designed to help you in drafting the security policy. You have decided to break up the creation of the policy into pieces, spending shorter blocks of time on the policy. This allows the management to be able to keep most of their days open for running the company.
During the meeting, you focus solely on the Acceptable Use statement for the users of the network. You ask the following questions to the group, and the consensus answer (after taking your suggestions into account) is listed after each question.
1.Are users allowed to share user accounts? No.
2.Are users allowed to install software without approval? No. Approval must come through you, or the current Chief Security Officer (CSO).
3.Are users allowed to copy software for archive or other purpose? No, archives can only be made by the network administration staff.
4.Are users allowed to read and\or copy files that they do not own, but have access to? Yes.
5.Are users allowed to make copies of any operating system files (such as the Windows directory or the SAM file)? No.
6.Are users allowed to modify files they do not own, but for which they have write abilities? Yes, if they have write abilities, they are allowed to modify the file.
Using the provided information from the meeting, you draft the Acceptable Use Statement. The statement reads as follows: This Acceptable Use Statement document covers MegaCorp, networks, computers, and computing resources. Network, computer, and computing resources are defined as physical personal computers, server systems, routers, switches, and network cabling. Also included in the definition are software (media) elements such as floppy disks, CD-ROMs (including writeable and re-writeable), DVD-ROMs, and tape backup systems. A user is defined as the individual account with authorization to access MegaCorp, resources. All users of the MegaCorp network are expected to conduct themselves in a respectful and legal manner.
The MegaCorp, general computing systems are unclassified systems. As such, top-level secret information is not to be processed or stored on any general unclassified computer system.
In the event that a user has identified a security breech, weakness, or system misuse in a MegaCorp, system, they are required to contact the on-duty Security staff immediately. Users are to use a completed MegaCorp-TPS Report for their notice to the Security staff. Initial contact with the Security staff about the incident might be conducted via email or telephone.
Individual users are not granted access to systems and resources they have not been given explicit authority to access. In the event access to a resource is required, and access has not been granted, the user is to make a request to the on-duty Security staff.
Individual users shall not make unauthorized copies of copyrighted software, except as permitted by law or by the owner of the copyright.
Individual users are not permitted to make copies of system configuration files for their own, unauthorized personal use or to provide to other people or users for unauthorized uses.
Individual users are not permitted to share, loan, or otherwise allow access to a MegaCorp resource via the user's assigned account.
Individual users are not permitted to engage in any online or offline activity with the intent or harass other users; degrade the performance of any MegaCorp, system or resource; impede the ability of an authorized user to access an authorized resource; or attempt to gain access to an unauthorized resource.
Electronic mail resources are for authorized use only. Messages that might be deemed fraudulent, harassing, or obscene shall not be sent from, to, or stored on MegaCorp, systems.
Individual users are not permitted to download, install, or run any unauthorized programs or utilities, including those which reveal weaknesses in the security of a system. This includes, but is not limited to network sniffing tools and password cracking utilities.
Users who are found to be in violation of this policy will be reported to the on-duty Security staff and the MegaCorp CEO. The CEO will determine if the violation will result in the loss of MegaCorp, network privileges. In he event the violation warrants, the CEO may press civil or criminal charges against the user.
I have read and understand the MegaCorp, Acceptable Use Statement, and agree to abide by it.
With this information, and your knowledge of MegaCorp, choose the answer that will provide the best solution for implementing the Acceptable Use statement policy needs of MegaCorp:}

A. You present the draft statement to the team at the next meeting. There is some discussion as to the wording in the clause regarding the internal TPS Report. Some in the group feel the TPS Report will be to tedious to use, others think with a distributed memo about the Report, everything will be fine. After further discussion all agree on the wording of the policy.
The employees meet with the HR director over the next week, and are all presented with a copy of
the policy and discuss how to it is to be implemented. There is some resistance, some of the
employees are not happy about having a new procedure to follow.
While walking back to your office, you see the CEO, and motion that you have a quick question,
"How does the new policy seem to be going with HR?" you ask.
"So far so good, there are a few folks not that happy, but I think wel be fine."
"Ie got to get over there tomorrow to sign mine, when are you meeting with HR?"
"Me Ie got too much going on right now. I have to oversee everything; whatever happens and
goes on here has to go through me anyway. I don't have time to bother with that myself, I just
wanted to be sure we had something legally binding to protect us and to assist the employees."
"Fair enough. Listen, I need to talk with you soon about our firewall situation," you reply.
"OK, stop by anytime. You know my door is always open."
You walk away, and are pretty happy with how things are going here. You know you have more
work to do, but so far your suggestions are being taken well and appreciated.
B. You present the draft statement to the team at the next meeting. There is some discussion as to the wording in the clause regarding the internal TPS Report. Some in the group feel the TPS Report will be to tedious to use, others think with a distributed memo about the Report, everything will be fine. After further discussion all agree on the wording of the policy.
The team finishes the discussion, and the meeting ends with approval of the document. Once the document is approved, you move the discussion towards getting everyone in the company aware of and agreeing to it. "I suggest that we tie it into our paychecks, and have the document go through HR." "We could do that, I guess. I can present the document to all the employees over the rest of the month." the HR Director responds. Following that, the CEO brings up that there is going to be a company dinner next month, and that at the dinner the CEO will declare the policy in place, and that "As all of us become comfortable with this, we all should appreciate this step forward for our company." The next day, you post the policy on the company intranet site, so everyone has an electronic copy to go with their copy from the HR meeting. Once that is done, you move on to your next project.
C. You present the current draft to the team at the next meeting. There is some discussion now on the language of the different clauses, and it seems that no one can agree on the points. What you thought was close to being done, now seems to be at risk of never getting done.
As the meeting escalates, and opinions start to get louder, the CEO interrupts the group, "Enough.
We are a small group, we have enough in common, we know what we need out of this. We will
bring in three contractors who specialize in policy writing.
Wel give them our thoughts, they will work with our tireless Security Guru, and get this thing
done."
You are not all that thrilled about three consultants coming down on your territory, but realize the
frustration of the CEO. You agree, "That fine by me. Il meet with them, and we will draft the
document."
There is other business on the agenda for the meeting, but it is not related to you, so you excuse
yourself and go back to your office.
After working with the three consultants for a month, you have the document, approved by
MegaCorp. You organize a company wide meeting, where the consultants describe the policy and
what it is for to all the employees. The employees are told where they can find the policy to review
for themselves, and after a question and answer session everyone gets back to their work.
D. Once the meeting ends, you make the changes that were discussed during the meeting. They are not too extensive, but you make them and present the document to the team again on Friday. Now that you have made the changes, the policy is accepted, and the discussion moves towards getting every employee to sign and agree to the policy.
"Well, it's Friday afternoon. Everyone needs their paychecks today." Comments the HR director.
"Good point, let's just print out 100 of these, and tell everyone to sign them in order to get their
check." Agrees one of the managers.
After some discussion, it is agreed that this will be the fastest way to get all the employees to sign
the policy document. The meeting wraps up around 2:00, and the printing and stapling of the
policy documents ends around 4:00.
Over the next hour, the HD director, with the help of the manager, hand our checks, making all the
employees sign the document in order to get their check. You think to yourself that the efficiency
of a small operation like this is nice to see in action. You go to get your check, sign your
document, and are actually able to end your day at 5:00pm on a Friday.
E. After the review of the policy it is decided that some of the bullet points in the document need to be changed. You make the requested changes, and the team reviews the document once more.
"It all looks good to me now," says a manager in the meeting.
"OK, how should we present this to the employees?" you ask.
"I could take a copy to each employee and discuss it with them," offers the HR director.
"No, that would be too time-consuming. That not a good use of your time," responds the CEO.
"We need to get this done, obviously. What is our most cost-effective way of doing this?"
"Well, I could post the policy on our intranet site, and we could have the employees go and
download it themselves. During lunch, perhaps?" you suggest.
"That sounds good, let take that approach," the CEO answers.
Later that day, you create a quick intranet site, called MegaCorp policy and documents. You draft
a quick email, which will be sent to all the employees in the company:
"Dear _____,
At MegaCorp we have just finished work on a security policy that will clearly define the use of the
computers and other issues. This document will answer the questions that many of you have had
recently on what you are allowed to do with the computer and when online.
At your earliest convenience, please connect to the new site I have linked here, to download and
read the new policy. Thanks and have a great day.
-MegaCorp Security Staff."
You verify the site is working, send the email out to all the employees, and go home for the day.

Question #4
You have now been involved in several major changes in the security of GlobalCorp, and specifically the Testbed campus. You have worked on the planning and design of the trusted network, you have worked on the initial rollout of the CA hierarchy, you have worked on assigning certificates to the end users and computers in the Executive building of the Testbed campus, and you have managed the implementation of secure email a critical service for GlobalCorp.
Blue has asked you to meet with the other administrative staff of the Testbed campus and discuss how the certificates will impact the organization. There are a total of about 40 people in the meeting, and you have decided that your primary focus during this meeting will be on encryption\cryptography.
Choose the best solution for providing the correct information to your administrative staff on how encryption\cryptography and digital certificates will be properly used in the network:}

A. You gather the administrative staff together in the conference room to discuss cryptography in the network. You begin your talk with the function of cryptography, in general, and then you move towards specific implementations in the GlobalCorp network.
You explain that public key cryptography is founded on math, and that the big picture fundamental point is that UserA and UserB have a set of mathematically linked keys. You explain that one key of each key pair is made available to the other users in the network. You illustrate this with an example of sending an encrypted message from UserA to UserB.
"We know, for example, that UserA wishes to send a message to UserB and wants that message to be secure. UserA will use the private key that UserB has made available to encrypt the message. Once encrypted, UserA will send the message over the network to UserB. UserB will then use the other key of the pair, the public key to decrypt the message," you explain to the group.
You further explain some of the common algorithms used in the network. You tell them that RSA was the first widely used private key algorithm, and that RSA itself is not used to secure messages, rather to exchange a symmetric key. You explain that Diffie-Hellman was another breakthrough in that it was a private key algorithm that was able to secure messages.
You then describe digital certificates and some of their features. You tell the group that digital certificates can be assigned to different entities, including users and computers. You state that these digital certificates include many options, for example an Issuer Field that holds the distinguished name of the entity that issued the certificate, and a Subject Field that holds the distinguished name of the person who has the private key that corresponds to the public key in the certificate.
B. You gather the administrative staff together in the conference room to discuss cryptography in the network. You begin your talk with the function of cryptography, in general, and then you move towards specific implementations in the GlobalCorp network.
You explain that public key cryptography is founded on math, and that the big picture fundamental point is that UserA has a pair of keys and UserB has a pair of keys. You explain that one key of each key pair is made available to the other users in the network. You illustrate this with an example of sending an encrypted message from UserA to UserB.
"We know, for example, that UserA wishes to send a message to UserB and wants that message to be secure. UserB will use the public key that UserA has made available to encrypt the message. Once encrypted, UserB will send the message over the network to UserA. UserA will then use the other key of the pair, the private key to decrypt the message," you explain to the group.
You further explain some of the common algorithms used in the network. You tell them that Diffie-Hellman was the first widely used private key algorithm, and that Diffie-Hellman itself is not used to secure messages, rather to exchange a symmetric key. You explain that RSA was another breakthrough in that it was a private key algorithm that was able to secure messages.
You then describe digital certificates and some of their features. You tell the group that digital certificates can be assigned to different entities, including users and computers. You state that these digital certificates include many options, for example an Issuer Field that holds the distinguished name of the entity that issued the certificate, and a Subject Field that holds the distinguished name of the person who has the private key that corresponds to the public key in the certificate.
C. You gather the administrative staff together in the conference room to discuss cryptography in the network. You begin your talk with the function of cryptography, in general, and then you move towards specific implementations in the GlobalCorp network.
You explain that public key cryptography is founded on math, and that the big picture fundamental point is that UserA has a pair of keys and UserB has a pair of keys. You explain that one key of each key pair is made available to the other users in the network. You illustrate this with an example of sending an encrypted message from UserA to UserB.
"We know, for example, that UserA wishes to send a message to UserB and wants that message to be secure. UserA will use the public key that UserB has made available to encrypt the message. Once encrypted, UserA will send the message over the network to UserB. UserB will then use the other key of the pair, called the private key, to decrypt the message," you explain to the group.
You further explain some of the common algorithms used in the network. You tell them that Diffie-Hellman was the first widely used public key algorithm, and that Diffie-Hellman itself is not used to secure messages, rather to exchange a symmetric key. You explain that RSA was another breakthrough in that it was a public key algorithm that was able to secure messages.
You then describe digital certificates and some of their features. You tell the group that digital certificates can be assigned to different entities, including users and computers. You state that these digital certificates include many options, for example an Issuer Field that holds the distinguished name of the entity that issued the certificate, and a Subject Field that holds the distinguished name of the person who has the private key that corresponds to the public key in the certificate.
D. You gather the administrative staff together in the conference room to discuss cryptography in the network. You begin your talk with the function of cryptography, in general, and then you move towards specific implementations in the GlobalCorp network.
You explain that public key cryptography is founded on math, and that the big picture fundamental point is that UserA and UserB have a set of mathematically linked keys. You explain that one key of each key pair is made available to the other users in the network. You illustrate this with an example of sending an encrypted message from UserA to UserB.
"We know, for example, that UserA wishes to send a message to UserB and wants that message to be secure. UserA will use the public key that UserB has made available to encrypt the message. Once encrypted, UserA will send the message over the network to UserB. UserB will then use the other key of the pair, the private key to decrypt the message," you explain to the group.
You further explain some of the common algorithms used in the network. You tell them that RSA was the first widely used private key algorithm, and that RSA itself is not used to secure messages, rather to exchange a symmetric key. You explain that Diffie-Hellman was another breakthrough in that it was a private key algorithm that was able to secure messages.
You then describe digital certificates and some of their features. You tell the group that digital certificates can be assigned to different entities, including users and computers. You state that these digital certificates include many options, for example an Issuer Field that holds the distinguished name of the entity that issued the certificate, and a Subject Field that holds the distinguished name of the person who has the private key that corresponds to the public key in the certificate.
E. You gather the administrative staff together in the conference room to discuss cryptography in the network. You begin your talk with the function of cryptography, in general, and then you move towards specific implementations in the GlobalCorp network.
You explain that public key cryptography is founded on math, and that the big picture fundamental point is that UserA and UserB have a set of mathematically linked keys. You explain that one key of each key pair is made available to the other users in the network. You illustrate this with an example of sending an encrypted message from UserA to UserB.
"We know, for example, that UserA wishes to send a message to UserB and wants that message to be secure. UserA will use the private key that UserB has made available to encrypt the message. Once encrypted, UserA will send the message over the network to UserB. UserB will then use the other key of the pair, the public key to decrypt the message," you explain to the group.
You further explain some of the common algorithms used in the network. You tell them that RSA was the first widely used private key algorithm, and that RSA itself is not used to secure messages, rather to exchange a symmetric key. You explain that Diffie-Hellman was another breakthrough in that it was a private key algorithm that was able to secure messages.
You then describe digital certificates and some of their features. You tell the group that digital certificates can be assigned to different entities, including users and computers. You state that these digital certificates include many options, for example an Issuer Field that holds the distinguished name of the person who issued the certificate, and a Subject Field that holds the full OIDs describing the use of the certificate by the holder of the certificate.

Solutions: