Hashing, Digital Signatures, and Certificates CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Java application is configured with a truststore that contains only root CA certificates. During TLS handshake, the server presents a certificate chain that includes an intermediate CA certificate. The application fails to validate the server's certificate. What is the most likely cause?

   • AThe server's certificate is self-signed
   • BThe server's certificate has expired
   • CThe truststore password is incorrect
   • DThe intermediate CA certificate is not in the truststore
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A Java application verifies a certificate chain. The leaf certificate is valid, but the intermediate CA certificate has expired. The root CA is trusted. What is the outcome of the verification?

   • AVerification fails only if the leaf certificate is expired.
   • BVerification fails because the intermediate CA certificate is expired.
   • CVerification succeeds because the leaf is still valid.
   • DVerification succeeds if the root CA is trusted and the leaf's signature is valid.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer is updating a legacy Java module that uses MD5 to compute checksums for downloaded files. The module must detect accidental corruption, not resist malicious tampering. The team wants to modernize the algorithm while minimizing performance impact. Which choice is most appropriate?

   • AKeep MD5 because it is faster and sufficient for accidental corruption.
   • BSwitch to a custom hash function that is faster than MD5.
   • CUse HMAC-MD5 with a secret key.
   • DReplace MD5 with SHA-256.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Java web application stores user passwords in a database. The security team mandates that each password must be stored with a unique per-user transformation that prevents rainbow-table attacks, and that the transformation must be computationally expensive to brute-force. Which approach should the developer implement?

   • AUse PBKDF2WithHmacSHA256 with a randomly generated salt per user and a high iteration count.
   • BEncrypt each password with AES-256 using a key stored in the application configuration.
   • CHash each password with MD5 and a fixed application-wide salt.
   • DHash each password with SHA-256 and store the digest.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Java service receives JSON payloads over HTTP and must ensure that they have not been altered in transit. The service and its clients share a symmetric key that is already distributed securely. Which mechanism should the service use to verify payload integrity?

   • ACompute an HMAC-SHA256 of the payload using the shared key and include it in a header.
   • BEncrypt the payload with AES and rely on encryption to detect tampering.
   • CSign the payload with the client's private RSA key.
   • DCompute a SHA-256 hash of the payload and compare it with a hash sent in a header.
   Reveal Solution Discussion Select an answer first