Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An attacker observes that a server returns different error messages when ciphertext padding is valid versus invalid. Which cryptographic attack is the attacker most likely attempting?

   • AFrequency analysis
   • BBrute force attack
   • CPadding oracle attack
   • DSide-channel attack
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Java application needs to store API keys in a configuration file. The team wants to protect the keys at rest. Which approach is most secure?

   • AEncrypt the configuration file using AES-GCM with a key stored in an HSM.
   • BUse a hard-coded key in the source code to encrypt the file.
   • CStore the keys in plaintext but restrict file permissions to the application user.
   • DObfuscate the keys by reversing the string.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Java application uses RSA-OAEP to encrypt sensitive data. During decryption, the application catches exceptions and returns different HTTP status codes for 'invalid ciphertext' versus 'invalid padding'. A security auditor warns that this behavior enables a padding oracle attack. What is the most effective remediation?

   • AReturn the same generic error for all decryption failures and log detailed errors only internally.
   • BUse a different HTTP status code for each exception type to improve monitoring.
   • CSwitch to RSA PKCS#1 v1.5 padding and keep the distinct error messages.
   • DDistinguish errors only for authenticated users to help them debug.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A Java application uses a stream cipher to encrypt messages between two servers. An attacker captures a ciphertext and knows the corresponding plaintext for one message. Using this known plaintext, the attacker can recover the keystream and then decrypt other messages encrypted with the same key. Which security property is most directly compromised?

   • AIntegrity of the captured message.
   • BAuthenticity of the sender.
   • CNon-repudiation of the message origin.
   • DConfidentiality of other messages encrypted with the same key.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which testing approach involves actively attempting to exploit cryptographic weaknesses in a running application?

   • ACode review
   • BStatic analysis
   • CPenetration testing
   • DUnit testing
   Reveal Solution Discussion Select an answer first