Symmetric Cryptography and Key Algorithms BDC Practice Questions (Page 1)

Questions 1–5

1. 1application · hard

   A developer needs to encrypt a database column that will be queried for exact matches. The application must be able to look up a value without decrypting all rows. Which mode of operation is most appropriate?

   • AAES-CBC
   • BAES-GCM
   • CAES-CTR
   • DAES-ECB
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A developer is implementing a file encryption tool that must support random access to encrypted files (e.g., reading a specific chunk without decrypting the whole file). The tool also needs to detect tampering. Which approach is best?

   • AUse AES-GCM with a single IV for the entire file
   • BUse AES-CTR with a per-chunk nonce and a per-chunk MAC
   • CUse AES-CBC with a per-chunk IV and a separate MAC over the entire file
   • DUse AES-ECB with a global MAC
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is designing a system to encrypt a large database backup file (several terabytes) before storing it in a cloud bucket. The file is too large to fit in memory, and the team needs to encrypt it in a streaming fashion. They also need to ensure that the encryption is parallelizable to speed up the process. Which mode of operation should they select?

   • ACTR mode, because it allows parallel encryption of blocks and supports random access.
   • BECB mode, because it is the simplest and fastest mode for large files.
   • CCBC mode, because it is the most widely supported and provides good security.
   • DGCM mode, because it provides both encryption and authentication in a single pass.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is encrypting data in a database using AES-256 in CBC mode. They want to add integrity protection to detect unauthorized modifications. The team is considering using a separate HMAC. Which of the following is the best approach?

   • AUse the same key for both encryption and HMAC to simplify key management.
   • BEncrypt the data with CBC, then compute the HMAC over the ciphertext and store it alongside the ciphertext.
   • CCompute the HMAC over the plaintext, then encrypt both the plaintext and the HMAC together.
   • DSkip the HMAC and rely on CBC mode's built-in integrity protection.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services company needs to distribute a new symmetric key to a remote branch office. The key will be used to encrypt data at rest on a local server. The company wants to avoid the cost and complexity of a full PKI infrastructure. Which approach is the most secure and practical option among the following?

   • ASend the key via an FTP server that requires a username and password.
   • BUse a pre-shared key that was physically delivered to the branch office by a trusted courier and stored in a hardware security module (HSM).
   • CEncrypt the key with the branch office's public key from their self-signed certificate and send it over the internet.
   • DEmail the key to the branch IT manager in a password-protected ZIP file, with the password sent in a separate email.
   Reveal Solution Discussion Select an answer first