Symmetric and Asymmetric Encryption CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   Two Java services communicate over an untrusted network. They need to establish a shared AES session key without pre-sharing a secret. The team has a PKI in place. Which protocol should they use to establish the session key securely?

   • AUse TLS with mutual certificate authentication and negotiate an ephemeral key exchange
   • BUse a static Diffie-Hellman exchange without any authentication
   • CDerive the AES key from a hard-coded password in both services
   • DSend the AES key encrypted with the server's public key in a plaintext message
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company stores sensitive documents in a database. Each document must be encrypted with a unique key so that a compromise of one document's key does not expose others. The system must support auditing which key encrypted which document. Which key management approach should be used?

   • AUse a deterministic AES key derived from the document ID.
   • BGenerate a random AES key for each document, encrypt the document with that key, and wrap the key with a master key stored in a KMS.
   • CEncrypt each document with the same RSA public key and store the private key on the application server.
   • DUse a single AES key for all documents and store it in a configuration file.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which asymmetric algorithm is commonly used for digital signatures and key exchange?

   • ARSA
   • BDES
   • CBlowfish
   • DAES
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Java application must encrypt data in transit between two servers in the same data center. The security team requires a fast algorithm with minimal CPU overhead. The data is not highly sensitive but must be protected from casual interception. Which algorithm is the best fit?

   • AECC with ECDH for each packet
   • BDES with ECB mode
   • CAES-128 in GCM mode
   • DRSA-4096
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Java application needs to encrypt data for storage in a cloud object store. The data will be accessed by multiple services within the same organization. The security team wants to avoid the complexity of managing many keys. Which approach is most appropriate?

   • AUse a different AES key for each service and store them in the application code.
   • BUse a single AES-256 key managed by a central KMS and shared among the services.
   • CUse a separate RSA key pair for each service.
   • DUse ECC to encrypt the data with a shared public key.
   Reveal Solution Discussion Select an answer first