Advanced Cryptography CAS-005 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's VPN server uses a static pre-shared key (PSK) for IKEv2 authentication. The security team is concerned that if the PSK is compromised, all past VPN sessions could be decrypted. Which change should be made to mitigate this risk?

   • ARotate the pre-shared key on a monthly basis.
   • BStore the pre-shared key in a hardware security module (HSM).
   • CIncrease the key length of the pre-shared key to 256 bits.
   • DUse certificate-based authentication with ephemeral Diffie-Hellman (DHE) for the key exchange.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A secure messaging application wants to ensure that if a user's device is lost and the long-term private key is extracted, the attacker cannot read past messages. The application currently uses a static RSA key for end-to-end encryption. Which protocol change should be made?

   • AImplement the Signal Protocol, which uses the Double Ratchet algorithm for forward secrecy.
   • BStore the private key in a hardware security module (HSM) on the device.
   • CUse a longer RSA key (e.g., 4096 bits) for message encryption.
   • DEncrypt each message with a new symmetric key and send the key using the same RSA key.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A national PKI is planning to migrate to post-quantum cryptography. The migration must ensure that existing certificates remain valid during the transition and that the new system is resistant to quantum attacks. Which migration strategy best balances security and compatibility?

   • AImmediately replace all classical algorithms with post-quantum algorithms and require all clients to upgrade.
   • BUse a single post-quantum algorithm for all certificates and rely on forward secrecy to protect past sessions.
   • CIssue dual certificates: one with a classical algorithm and one with a post-quantum algorithm, and use hybrid key exchange during the transition.
   • DContinue using classical algorithms but increase key sizes to provide quantum resistance.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A messaging platform wants to ensure that if a user's long-term private key is compromised in the future, past session keys and messages cannot be decrypted. The platform currently uses a static RSA key for key exchange. Which change should the platform implement to achieve forward secrecy?

   • AEncrypt all messages with a symmetric key derived from the user's password.
   • BSwitch to ephemeral Diffie-Hellman key exchange (DHE) for each session.
   • CUse a longer RSA key (e.g., 4096 bits) for key exchange.
   • DStore session keys in a hardware security module (HSM) to protect them from compromise.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the defining characteristic of homomorphic encryption?

   • AIt uses the same key for encryption and decryption
   • BIt splits the plaintext into multiple shares for secure storage
   • CIt allows computations to be performed directly on ciphertext without decrypting it
   • DIt encrypts data multiple times with different keys
   Reveal Solution Discussion Select an answer first