Symmetric and Asymmetric Encryption CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Java application must encrypt a large database backup file. The file will be stored in a cloud storage bucket. The security team requires that the encryption key be rotated annually without re-encrypting the data. Which approach should be used?

   • AUse a static AES key that never changes.
   • BUse RSA to encrypt the backup file directly.
   • CUse a single AES key and rotate it by re-encrypting the entire backup file each year.
   • DUse envelope encryption: encrypt the backup with a data encryption key (DEK), then encrypt the DEK with a key encryption key (KEK) that can be rotated.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Java client and server need to establish a secure communication channel over an untrusted network. They have no pre-shared secret. The requirement is to agree on a symmetric session key while preventing eavesdroppers from learning the key. Which mechanism should be used?

   • AUse a pre-shared key that is hard-coded in both client and server code.
   • BSend the AES key encrypted with the server's RSA public key.
   • CUse Diffie-Hellman key exchange to derive a shared secret, then use a KDF to generate an AES session key.
   • DUse RSA to encrypt the entire session data directly.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Java application must encrypt data for storage in a multi-tenant cloud database. Each tenant's data must be encrypted with a different key. The application uses a KMS. Which approach should the developer use to minimize the number of KMS API calls while maintaining tenant isolation?

   • AUse a single master key for all tenants and encrypt all data with that key.
   • BUse the tenant ID as the encryption key.
   • CGenerate a unique data key for each tenant, encrypt tenant data with that key, and wrap the data key with a master key in the KMS.
   • DCall the KMS to encrypt each record individually with the master key.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement best describes symmetric encryption?

   • AIt uses a public key to encrypt and a private key to decrypt.
   • BIt uses two different keys, one for encryption and one for decryption.
   • CIt uses the same key for both encryption and decryption.
   • DIt uses a key that is derived from the data being encrypted.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team is designing a system where a central server must send encrypted configuration files to thousands of IoT devices. Each device has a unique public/private key pair, and the server knows each device's public key. The files are about 10 KB each. The team wants to minimize the number of encryption operations on the server while ensuring that only a specific device can decrypt its file. What should the team do?

   • AUse the server's private key to encrypt each file, and have devices decrypt with the server's public key.
   • BEncrypt each file with AES using a per-device random key, then encrypt that key with the device's RSA public key and send both.
   • CEncrypt each file directly with the device's RSA public key.
   • DEncrypt all files with a single shared AES key and send the same key to every device.
   Reveal Solution Discussion Select an answer first