Asymmetric Encryption and Defensive Coding CASENET Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is migrating its .NET application to Azure and needs to manage RSA private keys for signing. The compliance team requires that keys be stored in a FIPS 140-2 Level 3 validated hardware security module (HSM) and that keys never leave the HSM. Which Azure service should the developer use?

   • AAzure Storage with client-side encryption
   • BAzure Key Vault (standard tier)
   • CAzure App Service with certificate binding
   • DAzure Key Vault Managed HSM
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A .NET developer is choosing between RSA and ECC for a new system that requires both encryption and digital signatures. The system must minimize bandwidth usage and computational overhead. Which algorithm is the better choice?

   • AECC with a 256-bit key
   • BAES with a 256-bit key
   • CDiffie-Hellman with 2048-bit keys
   • DRSA with 2048-bit keys
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a common pitfall to avoid when implementing asymmetric encryption in code?

   • AHardcoding private keys in the source code
   • BGenerating keys with a secure random number generator
   • CUsing a well-tested cryptographic library
   • DUsing OAEP padding
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A .NET developer is building a secure messaging feature that must encrypt large attachments (up to 100 MB) while ensuring that only the intended recipient can decrypt them. The developer plans to use RSA for the encryption. What should the developer do to achieve both security and performance?

   • AGenerate a random AES key, encrypt the attachment with AES, and encrypt the AES key with the recipient's RSA public key.
   • BGenerate a random RSA key pair, encrypt the attachment with the private key, and send the public key to the recipient.
   • CCompress the attachment and then encrypt it directly with the recipient's RSA public key.
   • DUse RSA to encrypt the attachment directly with the recipient's public key.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A .NET developer is implementing a certificate-based authentication system. The application needs to validate that a client's certificate is still trusted. Which practice should be implemented to ensure that a compromised or expired client certificate is no longer accepted?

   • AUse a self-signed certificate for each client.
   • BRely solely on the certificate's expiration date.
   • CCheck the certificate's revocation status using CRL or OCSP.
   • DStore the certificate's private key in the application's source code.
   Reveal Solution Discussion Select an answer first