Symmetric and Asymmetric Encryption CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A Java application must establish a secure session with a server. The server's public key is known, but the client does not have a certificate. The security team requires that the session key be protected even if the server's private key is compromised in the future. Which key exchange method should be used?

   • AUse a pre-shared key that is stored in the client.
   • BUse ephemeral Diffie-Hellman (DHE) with the server's public key used for authentication.
   • CUse a static Diffie-Hellman key pair.
   • DUse RSA to encrypt the session key with the server's public key.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A Java application must establish a secure channel with a remote server. The server's public key is not yet known to the client. The security team requires forward secrecy and resistance to man-in-the-middle attacks. Which approach should be used?

   • AUse a pre-shared key that is distributed via email.
   • BUse RSA to encrypt a symmetric key and send it to the server.
   • CUse TLS with an ephemeral Diffie-Hellman key exchange (DHE) and authenticate the server using a certificate.
   • DUse a static Diffie-Hellman key pair that is hard-coded in the client.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A Java application stores user session data in a database. The data must be encrypted so that only the application server can read it. The application runs in a single cluster with a shared configuration. Which approach is most appropriate?

   • AUse RSA-2048 to encrypt each session record with the server's public key.
   • BUse ECC to encrypt the session data directly.
   • CUse AES-256 with a key stored in a secure key management service (KMS).
   • DUse a hard-coded key in the application code.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Java application must encrypt data at rest in a database. The compliance team requires that the encryption algorithm be approved by FIPS 140-2 and that the cipher provide authenticated encryption. Which cipher should the developer choose?

   • AAES-GCM with a 256-bit key
   • BDES in ECB mode
   • CRSA with OAEP padding
   • DAES-CBC with a separate HMAC
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A Java application must encrypt data at rest in a database. The security team requires that the encryption key be stored separately from the data and that access to the key be auditable. Which approach should be used?

   • AUse RSA to encrypt the data and store the private key in the application server.
   • BStore the AES key in the same database as the encrypted data.
   • CUse a hard-coded key in the application code.
   • DUse a KMS to generate and store the AES key, and enable audit logging on key access.
   Reveal Solution Discussion Select an answer first