Hashing, Digital Signatures, and Certificates CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Java developer needs to compute a SHA-256 hash of a file without loading the entire file into memory. Which JCA approach should be used?

   • ARead the file into a byte array and call MessageDigest.digest(byte[]).
   • BUse Cipher.getInstance("AES") to encrypt the file and then hash the ciphertext.
   • CUse MessageDigest.update(byte[]) repeatedly in a loop while reading the file in chunks.
   • DUse Signature.getInstance("SHA256withRSA") and call update() with the file bytes.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A Java application validates client certificates for mutual TLS. The application currently checks the certificate chain and expiration date but does not check revocation. A security auditor requires revocation checking, but the environment has limited network access and the CA publishes only a CRL that is updated daily. What is the most appropriate way to implement revocation checking?

   • ADownload the CRL once per day and cache it locally, then check each certificate against the cached CRL
   • BPerform an OCSP request for every certificate validation
   • CUse a hardcoded list of revoked serial numbers updated manually
   • DDisable revocation checking because the certificates are short-lived
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   A Java developer needs to verify a digitally signed message received from a partner. Which sequence of steps correctly describes the verification process?

   • ADecrypt the received message with the signer's private key, then compare the decrypted message to the original plaintext.
   • BHash the received message, decrypt the received signature with the signer's public key, and compare the resulting hash to the locally computed hash.
   • CEncrypt the received message with the signer's public key and check that the resulting ciphertext matches the signature.
   • DHash the received signature, encrypt the hash with the signer's public key, and compare it to the received message.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Java application receives a signed message and a signature. The application has the sender's public key. Which step is essential to verify the signature?

   • ADecrypt the message with the sender's private key.
   • BDecrypt the signature with the sender's public key and compare it to the message hash.
   • CEncrypt the message with the sender's public key and compare it to the signature.
   • DHash the signature and compare it to the message.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A Java application signs data with a private key that is stored in a PKCS#12 keystore protected by a password. Which practice is most important for protecting the private key?

   • AUse a short, memorable password for the keystore.
   • BSet the keystore file permissions to read-only for all users.
   • CStore the keystore password in the application's configuration file.
   • DUse a hardware security module (HSM) or a dedicated key-management service to store the key.
   Reveal Solution Discussion Select an answer first