Cryptographic Hash Functions and Their Uses BDC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security auditor is reviewing a proof-of-work blockchain that uses SHA-256. The auditor notes that the mining difficulty is low and the block time is short. Which attack becomes more feasible under these conditions?

   • AA preimage attack to recover the private key from the block hash.
   • BA brute-force attack to find a nonce that produces a hash below the target, allowing an attacker to mine blocks faster than the rest of the network.
   • CA birthday attack to find two blocks with the same hash and create a fork.
   • DA length-extension attack to modify a block header without changing its hash.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a Merkle tree used for in blockchain?

   • AEfficiently verifying that a transaction is included in a block without downloading the entire block
   • BStoring the full transaction data in a compressed form
   • CEncrypting transactions to keep them private
   • DGenerating the private keys for users
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A legal tech company needs to sign contracts digitally. They plan to use ECDSA. According to best practices, what should be signed?

   • AThe SHA-256 hash of the contract document.
   • BA random number generated at signing time.
   • CThe raw contract document in its entirety.
   • DThe contract's file name and creation date.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A cryptography consultant is evaluating a hash function for use in a digital signature scheme. The function has a 128-bit output. The consultant is concerned about the birthday attack. What is the effective security level against collision attacks?

   • A64 bits
   • B256 bits
   • C32 bits
   • D128 bits
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A software company distributes a large installer file. They want users to verify that the downloaded file is exactly the one published, without requiring a secure channel. What is the standard approach?

   • AUse a hash that is not cryptographic, such as CRC32.
   • BProvide the hash in a separate text file hosted on the same CDN.
   • CEmbed the hash in the file name of the installer.
   • DPublish the SHA-256 hash of the installer on the official website over HTTPS.
   Reveal Solution Discussion Select an answer first