Asymmetric Encryption and Defensive Coding CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A .NET developer is implementing a document signing service. The service must allow users to verify signatures even after the signing certificate has expired. Which practice should be implemented?

   • AUse a self-signed certificate for signing.
   • BStore the private key in the document.
   • CReject any signature whose certificate has expired.
   • DTimestamp the signature using a trusted timestamp authority.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A .NET application needs to establish a secure channel between two servers over an untrusted network. The servers do not have pre-shared secrets. The developer must ensure forward secrecy and resist known attacks on static key exchange. Which algorithm should be used for the key exchange?

   • AAES-256 with a hardcoded key
   • BStatic Diffie-Hellman with a long-term key
   • CRSA key exchange with a 2048-bit key
   • DElliptic Curve Diffie-Hellman (ECDH) with ephemeral keys
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A .NET application uses a public/private key pair for signing software updates. The private key is stored in an HSM. The development team wants to allow multiple developers to sign test builds without exposing the production private key. Which approach is most secure and practical?

   • AGenerate a separate signing key for development and use the HSM only for production releases.
   • BShare the HSM private key with all developers via a secure file share.
   • CStore the production private key in the source code repository for convenience.
   • DUse the same production key for development and production to simplify key management.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is using RSA key pairs for employee digital signatures. An employee's private key has been compromised. What is the immediate step the company should take?

   • ARevoke the employee's public key certificate and generate a new key pair.
   • BContinue using the same key pair but change the passphrase.
   • CNotify the employee and ask them to keep the key pair secret.
   • DDelete the employee's public key from the directory.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A .NET developer is implementing ECDH for key agreement. The developer is concerned about the 'invalid curve attack' where an attacker sends a point not on the curve. Which defensive coding practice is essential?

   • AUse a larger key size to make the attack harder.
   • BValidate that the received public key is on the correct elliptic curve.
   • CHash the shared secret before using it.
   • DUse a different curve for each session.
   Reveal Solution Discussion Select an answer first