Hashing, Digital Signatures, and Certificates CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Java application stores password hashes. The team wants to migrate from unsalted SHA-256 to a salted, adaptive algorithm. The migration must not require users to reset their passwords. Which approach is most secure?

   • AOn next successful login, rehash the password with a new salt and update the stored hash.
   • BRehash the existing SHA-256 hashes with a new salt and store the result.
   • CRequire all users to reset their passwords and store new hashes with a per-user salt.
   • DStore the old SHA-256 hash as the salt for the new hash.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A legacy Java system stores password hashes using unsalted MD5. The system must remain operational while the security team migrates to a stronger scheme. Users cannot be forced to reset passwords immediately. Which migration strategy is the most secure and practical?

   • AImmediately require all users to reset passwords and store new PBKDF2 hashes
   • BRehash all existing MD5 hashes with SHA-256 and store the new hashes
   • CAdd a random salt to each existing MD5 hash and store the salt alongside
   • DOn each successful login, verify the MD5 hash, then rehash the password with a salted PBKDF2 hash and update the record
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Java application connects to an external service over TLS. The service presents an X.509 certificate. Which fields must the application validate to establish trust?

   • AThe certificate's signature algorithm and the server's operating system.
   • BThe certificate's validity period and that it is signed by a trusted CA.
   • CThe certificate's serial number and the CA's email address.
   • DThe certificate's public key and the server's IP address.
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A Java application receives software updates from a vendor. The vendor publishes a public key, and each update file is accompanied by a signature. Which property does verifying the signature provide?

   • AProof that the update was sent by the vendor and was not modified.
   • BAssurance that the update is free from malware.
   • CEncryption of the update so only the vendor can read it.
   • DConfidentiality of the update contents.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Java application must check whether a peer's certificate has been revoked before establishing a TLS connection. Which mechanism should the application use?

   • ACheck the certificate's expiration date.
   • BCheck the certificate's serial number against the application's local database.
   • CVerify the certificate's signature with the CA's public key.
   • DQuery the certificate's CRL distribution point or use OCSP.
   Reveal Solution Discussion Select an answer first