CSS CSS Cryptography & Data Protection 1 — Questions and Answers
Question 1: Which encryption mode of AES is considered most secure for bulk data encryption due to its use of an initialization vector and chaining?
- AES-CBC (Cipher Block Chaining) (Correct answer)
- AES-ECB (Electronic Codebook)
- AES-OFB without IV
- DES-CBC
Correct answer: AES-CBC (Cipher Block Chaining)
AES-CBC uses an initialization vector and chains each block to the previous ciphertext, preventing identical plaintext blocks from producing identical ciphertext.
Question 2: What is the primary advantage of asymmetric encryption over symmetric encryption?
- It eliminates the need to securely share a secret key between parties (Correct answer)
- It is faster than symmetric encryption
- It requires less computational power
- It uses shorter key lengths for equivalent security
Correct answer: It eliminates the need to securely share a secret key between parties
Asymmetric encryption uses a public/private key pair, so parties can exchange encrypted data without first sharing a secret key.
Question 3: What is a digital signature's primary function in data security?
- Verifies the authenticity and integrity of a message or document (Correct answer)
- Encrypts data in transit
- Generates a symmetric session key
- Compresses data for transmission
Correct answer: Verifies the authenticity and integrity of a message or document
A digital signature uses asymmetric cryptography to prove the message originated from a specific sender and was not altered in transit.
Question 4: Which hashing algorithm is currently recommended by NIST for secure cryptographic applications?
- SHA-256 (Correct answer)
- MD5
- SHA-1
- CRC32
Correct answer: SHA-256
SHA-256 (part of the SHA-2 family) is NIST-recommended for cryptographic use, as MD5 and SHA-1 are vulnerable to collision attacks.
Question 5: What is the purpose of a Public Key Infrastructure (PKI) in enterprise environments?
- Manages the lifecycle of digital certificates to enable trusted encrypted communications (Correct answer)
- Stores plaintext passwords securely
- Provides network access control
- Monitors endpoint behavior
Correct answer: Manages the lifecycle of digital certificates to enable trusted encrypted communications
PKI provides the framework for issuing, managing, distributing, and revoking digital certificates used for authentication and encryption.
Question 6: What does 'perfect forward secrecy' (PFS) ensure in TLS connections?
- Compromise of the server's private key does not expose past session keys (Correct answer)
- All traffic is encrypted with the same session key indefinitely
- Certificates are automatically renewed before expiry
- Sessions are never terminated by the server
Correct answer: Compromise of the server's private key does not expose past session keys
PFS uses ephemeral key exchanges (like Diffie-Hellman) so each session generates a unique key that is discarded afterward, protecting past sessions.
CSS CSS Cryptography & Data Protection 1
Which encryption mode of AES is considered most secure for bulk data encryption due to its use of an initialization vector and chaining?