Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is performing a penetration test on a Java application that uses AES-CBC. They notice that the application's decryption time varies slightly depending on whether the padding is valid. Which type of attack does this enable?

   • ATiming side-channel attack
   • BReplay attack
   • CFrequency analysis
   • DBrute-force attack
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important to validate and sanitize inputs before passing them to cryptographic functions?

   • ATo ensure the output is always in a human-readable format
   • BTo improve the performance of the cryptographic algorithm
   • CTo reduce the size of the ciphertext
   • DTo prevent injection attacks that could alter the cryptographic operation or leak sensitive data
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Java application's decryption method throws a custom exception that includes the algorithm name, key length, and the first 10 bytes of the ciphertext. A security review flags this as a risk. What is the best remediation?

   • AInclude the exception details only in debug builds.
   • BEncrypt the exception message so only authorized users can read it.
   • CRemove the exception entirely and let the application crash.
   • DLog the exception details internally with restricted access, and return a generic error to the caller.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When using the Java Cryptography Extension (JCE), what is the recommended way to specify the transformation for a cipher?

   • AUse only the algorithm name, e.g., "AES"
   • BUse the mode only, e.g., "GCM"
   • CUse the full transformation string, e.g., "AES/GCM/NoPadding"
   • DUse the padding only, e.g., "NoPadding"
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to identify cryptographic vulnerabilities in a Java codebase before release. They run a static analysis tool and also plan a manual code review. Which finding would the static analysis tool most likely flag?

   • AThe exact entropy of a `SecureRandom` instance at runtime.
   • BUse of the `Cipher` class with the transformation `AES/ECB/PKCS5Padding`.
   • CAn attacker successfully performing a padding oracle attack against the live API.
   • DA runtime side-channel leak through timing differences in a specific deployment.
   Reveal Solution Discussion Select an answer first