Asymmetric Encryption and Defensive Coding CASENET Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A developer is designing a secure communication protocol for a mobile app. The app needs to encrypt messages and ensure forward secrecy. Which approach should the developer use?

   • AUse a static Diffie-Hellman key pair for all sessions.
   • BUse ECDSA to sign each message and AES to encrypt.
   • CUse ECDHE for key exchange and AES for message encryption.
   • DUse RSA to encrypt each message with the recipient's public key.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security audit of a .NET application found that it uses RSA with a 1024-bit key. The application is used for both encryption and signing. What is the most appropriate action?

   • AUse the same key for both encryption and signing.
   • BSwitch to ECC with a 160-bit key.
   • CIncrease the RSA key size to at least 2048 bits.
   • DKeep the 1024-bit key but use OAEP padding.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a primary difference between symmetric and asymmetric encryption?

   • ASymmetric encryption uses a single shared key, while asymmetric uses a key pair.
   • BAsymmetric encryption uses the same key for encryption and decryption.
   • CSymmetric encryption provides non-repudiation, while asymmetric does not.
   • DAsymmetric encryption is always faster than symmetric encryption.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer is implementing digital signatures in .NET and wants to use ECDSA. What is a key advantage of ECDSA over RSA for digital signatures?

   • AECDSA does not require a secure random number generator.
   • BECDSA is immune to side-channel attacks.
   • CECDSA provides smaller signatures and faster signing operations.
   • DECDSA is a symmetric algorithm that is easier to implement.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A .NET developer is implementing RSA decryption in a web service. The service returns different error messages for invalid padding and invalid ciphertext. What vulnerability does this introduce?

   • ATiming attack
   • BMan-in-the-middle attack
   • CPadding oracle attack
   • DReplay attack
   Reveal Solution Discussion Select an answer first