Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which testing method is most effective for identifying hardcoded cryptographic keys in source code?

   • AFuzz testing
   • BStatic analysis
   • CLoad testing
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Java REST API returns detailed error messages during decryption failures. An attacker notices that the API returns 'Invalid padding' for some ciphertexts and 'Authentication failed' for others. Which defensive coding change best mitigates the padding oracle attack?

   • AUse a custom error code for each cryptographic failure type.
   • BReturn the exception class name and stack trace to help clients debug.
   • CReturn a generic 'Decryption failed' message for all decryption errors and log detailed reasons server-side.
   • DLog the decryption error to the client's console for transparency.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A Java developer is implementing a file encryption feature. They need to choose a cipher transformation string for the `Cipher.getInstance()` call. The requirement is to provide both confidentiality and integrity. Which transformation string is the most appropriate?

   • AAES/CTR/NoPadding
   • BAES/ECB/PKCS5Padding
   • CAES/GCM/NoPadding
   • DAES/CBC/PKCS5Padding
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Java application needs to encrypt data at rest. The team is choosing between implementing AES manually with a custom algorithm and using the Java Cryptography Extension (JCE) with a standard provider. What is the primary security advantage of using JCE?

   • AJCE automatically rotates encryption keys.
   • BJCE is faster than any custom implementation.
   • CJCE guarantees that the ciphertext is tamper-proof.
   • DJCE provides well-tested, standardized implementations that reduce the risk of implementation flaws.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A Java application accepts encrypted data from users and decrypts it using a symmetric key. The application currently does not validate the ciphertext length before decryption. An attacker sends a very short ciphertext that causes an exception revealing the key length. Which defensive coding practice is most effective?

   • ABase64-encode the ciphertext before decryption to prevent exceptions.
   • BUse a larger key size to make the exception less informative.
   • CCatch all exceptions and log the full stack trace for debugging.
   • DValidate that the ciphertext length matches the expected block size and catch exceptions with a generic error.
   Reveal Solution Discussion Select an answer first