Hashing, Digital Signatures, and Certificates CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Java web application stores user passwords in a relational database. The security team requires that passwords be stored in a way that resists rainbow-table attacks and does not require a separate key-management system. Which approach should the developer implement?

   • AHash each password with SHA-256 and store the digest.
   • BGenerate a random salt per user, combine it with the password, and store the salted hash using a slow, adaptive algorithm such as BCrypt.
   • CEncrypt each password with AES-256 using a hard-coded key in the application source.
   • DUse HMAC-SHA256 with a static application-wide key and store the resulting MAC as the password hash.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Java application receives signed software updates. The verification code currently checks the signature using the vendor's public key but does not verify the certificate chain or expiration. An attacker could potentially present a self-signed certificate with the vendor's public key. What is the most important missing step to prevent this attack?

   • AHash the certificate with SHA-256 and compare to a stored hash
   • BEncrypt the certificate with the vendor's public key before verification
   • CVerify that the certificate is signed by a trusted CA and is within its validity period
   • DUse a longer RSA key for the signature verification
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which property of a cryptographic hash function ensures that it is computationally infeasible to find two different inputs that produce the same hash output?

   • APreimage resistance
   • BCollision resistance
   • CSecond preimage resistance
   • DAvalanche effect
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Java service receives software update manifests from a vendor. The vendor signs each manifest with its private key. The service must verify that the manifest was not tampered with and that it truly came from the vendor. Which JCA classes should the developer use in the verification process?

   • ASignature with the vendor's public key to verify the manifest's signature
   • BCipher with the vendor's public key to decrypt the manifest
   • CMac with a shared secret to compute an HMAC over the manifest
   • DMessageDigest to hash the manifest, then compare with a stored digest
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Java application needs to check whether a client certificate has been revoked before granting access. The CA supports both CRL and OCSP. The application runs in an environment with reliable network access. Which approach provides the most up-to-date revocation status?

   • ACheck the certificate's expiration date only
   • BDownload the CRL once at application startup and cache it
   • CUse a static list of revoked serial numbers
   • DPerform an OCSP request for each certificate validation
   Reveal Solution Discussion Select an answer first